Minimal requirements using a windows (service) domain account for proget

[g.j.spoelstra_9664]

Hi,

I work at a company were i am implementing proget in our ALM enviroment.
I installed Proget on our acceptance enviroment to see how it should run within our organisation.

On the support page i tried to find the minimum requirements for running Proget with a windows domain account (service account) found some recommendations and implement them.

I want to run Proget in a following way.

• Web Server IIS
• Windows Authentication
• SQL Server Database
• Running under a domain service account
• Installing Proget when logged in with a domain account which is member of the local administrator group.

Our company has UAC enabeled on all our servers and we have to install progams on the D-drive.

I got proget running with some configurations on version 5.0.13 a couple of weeks a go and it looked fine.

• gave the service account access to specific folders, log on as a service and made it owner of the database
• gave iisusr access to the web folder

All seem to be working fine until i wanted to update to proget version 5.1.3 using the inedo hub. I got an error that the installer had no access to a specific folder on the d-drive.

After that i could fix it manualy and got proget working again after a reinstall with the offline installer, but this is not a good method to update ProGet every time.

Putting the proget service account in the local administrator groups solves the issue but our security officer is not happy about that.

So my question is:

Can proget run properly on a domain account that is not a member of the local administrator group? If yes what are the minimal requirements for the account?

Kind regards,

Gert-Jan Spoelstra

Product: ProGet
Version: 5.1.3

[atripp]

ProGet runs fine under a domain account.

The Inedo Hub is the desktop application used as an installation center, and doesn't impact the way ProGet is run. Next time you see an error with the Hub, please send us the error report so we can investigate it better.

[g.j.spoelstra_9664]

Alana,

Thank you for answering, but would you be so kind to give aswers to all of my questions?

Can proget run properly on a domain account that is not a member of the local administrator group?
If yes what are the minimal requirements for the account?

[thoven]

For the Windows service, the only requirements for the service account are (assuming default file system package store configuration) read/write access to the directory where the underlying packages are stored (default is in ProgramData), read/write access to the service installation directory (default is in Program Files), and granted access to the ProGet database role named ProGetUser_Role.

For the web application (Windows service or IIS application pool identity), the requirements are the same as the Windows service, plus read/write access to the website installation directory.

Note again that the Desktop Hub installation privileges is orthogonal to the account that ProGet runs as, since it would obviously require more privilege to create/update/grant in the database and also create subfolders in Program Files & %ProgramData%. As an extra word of caution, if D: is a mapped drive, be sure to use the full UNC path in configuration settings within ProGet.