What are the minimum access rights for MTS User while installing SDL Tridion

Question

Scenario: Sometime, client's IT policies does not allow us to have a user with Admin right that we can use as MTS user to install SDL Tridion

Query:

What are the minimum access rights needed to use a domain user as an MTS user, since as per the IT policy, I have observed that a domain user with Local Admin rights was not able to function as MTS User

Answer 1

Follow below steps to make a (non-administrator) domain user to act as an MTS user:

1. Give the user Read rights on the Tridion installation location (defaults to C:\Program files(x86)\Tridion) which in turn will inherit down to the other directory levels. Also give read and write access on the C:\windows\temp directory on the server.
2. Restart the Tridion COM+ application and all Tridion services on the CM server.
3. Open the security policy configuration manager by running following command 'SecPol.msc' and perform following steps.
   • Add the domain MTSUser itself to the 'Allow log on locally' Local Security Policy.
   • Add the domain MTSUser itself to the 'Log on as a batch job' Local Security Policy.
   • Add the domain MTSUser itself to the 'Log on as a service' Local Security Policy.
   • Add the domain MTSUser itself to the 'Take ownership of files and other objects' Local Security Policy.
   • Add the domain MTSUser itself to the 'Act as par of the operating system'
   • Add the domain MTSUser itself to the 'Impersonate a client after authentication.

4. On CMS Server Run the following command from the command line from .Net framework directory (i.e.C:\Windows\Microsoft .Net\Framework64\v4.0):

   aspnet_regiis -pa "TridionRsaKeyContainer" "[domain]\[MTS User name]".

5. Restart IIS and the Tridion COM+ application after successfully running this command.

After following above mentioned steps you can use this user as an MTS user.

A document regarding same can be seen at my blog HERE