For example, if you have installed Windows on the C:/ drive, then C:/ is your system drive. The system drive is the drive where Windows is installed.
Do not add the account that you create to any Active Directory security groups that needlessly elevate the permissions for the account. Specifically, when you create an account in Active Directory, create an account in the domain User Group. Do not use an account with any kind of domain administrative permissions.Do not restrict read or query permissions for the Run As service account. By default, the NetworkServices account and default domain users have permission to query Active Directory. The Run As service account is used to query users and group membership in Active Directory. By using a dedicated account you can be sure that the data resources that you permission for Tableau Server are only accessible by Tableau Server Run As service account. In other words, don’t use an existing account. Create a dedicated account in Active Directory for the Tableau Server Run As service account.Before you create a Run As service account, review Data Access with the Run As Service Account. In some cases, users may inadvertently access data that their users accounts are not explicitly permissioned for.
It's important to understand how the Run As service account accesses data on behalf of the users in your organization.Configure Tableau Server to use the Run As service account.Create the Run As service account in Active Directory.If you are going to replace the default NetworkService account with a domain account, we recommend using a dedicated account for the Run As service account. Replacing the default Run As local account (NetworkService) with a domain account For information on best practices when creating a Run As service account, see Creating the Run As service account. Using a domain account that is not a member of these administrator groups is a good security practice and can help avoid access to certain data sources and folders. Instead we recommend using a domain user account that is not an administrator for the Run As service account. The account you use for the Run As service account should not be a member of the Local Administrators or Domain Administrators account.
0 kommentar(er)
