When configuring the ‘Run As’ service account for Tableau Server on a Windows system, what is a key consideration to ensure proper access and…

The 'Run As' service account is a dedicated Windows account used by Tableau Server to access resources. Following the principle of least privilege, this account must be granted only the specific permissions required to operate. This includes 'Log on as a service' rights and modify permissions for specific Tableau Server installation folders, the data directory, and associated registry keys. This configuration ensures the service can function correctly while minimizing the potential security risk if the account were compromised, as its access is restricted to only necessary Tableau-related resources.

A. Sharing passwords, especially with a high-privilege administrator account, is a critical security violation that negates the purpose of a dedicated service account and creates a single point of failure.

B. While password rotation is a good security practice, forcing a 30-day expiration on a service account without an automated management process can cause unexpected service outages when the password expires.

D. The 'Run As' service account runs background processes and does not require interactive logon capabilities like Remote Desktop. Enabling this unnecessarily increases the system's attack surface.

---

1. Tableau Server Help (Official Vendor Documentation): "Run As Service Account". This document outlines the requirements for the account. In the "Windows account permissions and rights" section

it explicitly states the account needs specific permissions: "The Run As service account needs permissions for the local computer... The Tableau Server installer will grant these permissions... on the Tableau Server installation directory." This directly supports option C. It also notes the account "does not require elevated privileges

" reinforcing the principle of least privilege.

Source: Tableau Corp. (2023). Tableau Server on Windows Help. "Run As Service Account". Section: "Windows account permissions and rights".

2. Tableau Server Help (Official Vendor Documentation): "Required Run As Service Account Settings". This page details the specific folder permissions required

such as Full Control over the Tableau Server data directory (C:\ProgramData\Tableau\Tableau Server). This reinforces that permissions are scoped specifically to Tableau resources

as stated in option C. The page also advises

"The Run As service account password is not set to expire

" which directly contradicts the practice suggested in option B.

Source: Tableau Corp. (2023). Tableau Server on Windows Help. "Required Run As Service Account Settings". Section: "Folder Permissions".

3. Microsoft Documentation (Official Vendor Documentation): "Service Accounts Step-by-Step Guide". While not specific to Tableau

this official Microsoft guide on service account security principles states

"The principle of least privilege should be applied to all service accounts... A service account should be granted only the rights and permissions that are required for the application to function successfully." This foundational principle from the OS vendor validates the approach described in option C.

Source: Microsoft. (2010). Service Accounts Step-by-Step Guide. Section: "Applying the Principle of Least Privilege to Service Accounts".