j.a.estevan

Server	Set
Application Object Server (AOS)	The log directory cannot be changed. The log is always installed in <installationdirectory>\log. Restrict access to the directory to administrators and AOS service accounts. If a domain account is used for the AOS service, use an account that has the following rights: Log on as a service.
Database Server	It is important to follow the recommended practices for securing the database. For the latest information about SQL Server security, refer to the SQL Server TechCenter.
Role Center and Enterprise Portal Server	The computer running IIS must be configured to use Basic authentication and Secure Sockets Layer (SSL) for users who log on from outside the corporate network. The Enterprise Portal server can be in the perimeter network and Internet-facing, or inside the internal network. NOTE: Enterprise Portal uses the Business Connector proxy user. Follow the recommended Microsoft practices for securing IIS and SharePoint technologies. For the latest information about IIS security, refer to the IIS 7.0 documentation. For the latest information about Windows SharePoint Services security, refer to the Windows SharePoint Services TechCenter.
Reporting Server	The computer running the SSRS web site must be inside the internal domain and not Internet-facing. Follow the recommended Microsoft practices for securing SSRS. For the latest information about SSRS security, refer to the SQL Server TechCenter.
Application Integration Framework (AIF) Server	The server requires the local Windows group, Microsoft Dynamics AX Web Service Administrators, created as part of the Setup. Follow the recommended Microsoft practices for securing IIS. For the latest information about IIS security, see the IIS 7.0 documentation.
Online Analytical Processing (OLAP) Server	Follow the recommended Microsoft practices for securing SSAS. For the latest information about SSAS security, refer to the SQL Server TechCenter.

Domain Accounts for Microsoft Dynamics AX Services

Account	Description	To configure this account…
AOS Service Account	The domain account or Network Service account the Microsoft Dynamics AX Object Server Windows service will run as. This account is used to communicate with the database server. Consider the following points when you select an account: It is strongly recommend that you use a domain account in a production environment. You should use the Network Service account only in development and testing environments. If the SQL Server and the AOS are on different computers, you must use a domain account. If you plan to install any Microsoft Dynamics AX components on a domain controller, you must use a domain account. If you plan to use Message Queuing (also known as MSMQ) for document exchange with web services on IIS, and you want to send signed messages, you must use a domain account. (If you are sending unsigned messages using web services on IIS, the AOS can run under the Network Service account.)	Select this account when running the Setup wizard to install an AOS instance.
Business Connector Proxy Account	The domain account the .NET Business Connector will run as. This account will be used to connect to the AOS on behalf of a Microsoft Dynamics AX user, without granting that user excessive privileges in the system. NOTE: This account must not be a Microsoft Dynamics AX user.	Select this account in the System service accounts form.
Synchronize Service Account	The domain account the Microsoft Office Project synchronization service will run as. It is recommended that this account be configured with no local logon rights.	Select this account in the System service accounts form.

Account

Description

To configure this account…

AOS Service Account

The domain account or Network Service account the Microsoft Dynamics AX Object Server Windows service will run as. This account is used to communicate with the database server. Consider the following points when you select an account:

It is strongly recommend that you use a domain account in a production environment. You should use the Network Service account only in development and testing environments.
If the SQL Server and the AOS are on different computers, you must use a domain account.
If you plan to install any Microsoft Dynamics AX components on a domain controller, you must use a domain account.
If you plan to use Message Queuing (also known as MSMQ) for document exchange with web services on IIS, and you want to send signed messages, you must use a domain account. (If you are sending unsigned messages using web services on IIS, the AOS can run under the Network Service account.)

Select this account when running the Setup wizard to install an AOS instance.

Business Connector Proxy Account

The domain account the .NET Business Connector will run as. This account will be used to connect to the AOS on behalf of a Microsoft Dynamics AX user, without granting that user excessive privileges in the system. NOTE: This account must not be a Microsoft Dynamics AX user.

Select this account in the System service accounts form.

Synchronize Service Account

The domain account the Microsoft Office Project synchronization service will run as. It is recommended that this account be configured with no local logon rights.

Select this account in the System service accounts form.

Domain Accounts for SQL Server Services

Account	Description	To configure this account…
SQL Server Database Engine Account	The domain account the SQL Server (MSSQLSERVER) Windows service will run as.	Select this account when installing the Database Engine.
SQL Server Reporting Services Account	The domain account the SQL Server Reporting Services (MSSQLSERVER) Windows service will run as.	When installing Reporting Services, specify that the Reporting Services Windows service should run as the .NET Business Connector account.
SQL Services Analysis Services Account	The domain account the SQL Server Analysis Services (MSSQLSERVER) Windows service will run as.	When installing Analysis Services, specify that the Analysis Services Windows service should run as the .NET Business Connector account. IMPORTANT: The .NET Business Connector account must have read access to the Microsoft Dynamics AX online transaction processing (OLTP) database.

Microsoft Dynamics AX Permissions

Component	Additional permissions required to install
Database	Member of the dbcreator role on the SQL Server instance.
Application Object Server (AOS)	Member of the securityadmin role on the SQL Server instance you want to connect to.
Enterprise Portal	Member of the SYSADMIN role in Microsoft Dynamics AX and a member of the dbcreator role on the SQL Server instance being used for Microsoft SharePoint Services.
Enterprise Search	Member of the SYSADMIN role in Microsoft Dynamics AX, a member of the Administrator group in Microsoft SharePoint Services, and a member of the dbcreator role on the SQL Server instance being used for Microsoft SharePoint Services.
Help Server	Member of the SYSADMIN role in Microsoft Dynamics AX.
Business Intelligence Components	Member of the SYSADMIN role in Microsoft Dynamics AX and a member of the SQL Server db_accessadmin role for the Microsoft Dynamics AX database.
Client	None
Office Add-Ins	None
Debugger	None
Visual Studio Tools	None
Trace Parser	None
AIF Web Services	Member of the SYSADMIN role in Microsoft Dynamics AX.
.NET Business Connector	None
Synchronization Proxy	Member of the dbowner database role on the SQL Server database for Microsoft Office Project Server, and a member of the Administrators group on the computer running Project Server.
Synchronization Service	Member of the Administrators group in Microsoft Dynamics AX.
Management Utility	None