The Run As service account is a Windows account that Tableau Server uses ("runs as") when it accesses resources. For example, Tableau Server reads and writes files on the computer where Tableau Server is installed. From the perspective of Windows, Tableau Server is doing this equally the Run As service account. In some cases, Tableau Server may apply the Run As service account to access data from external sources, such as databases or files on a shared network directory.

As you plan your Tableau Server deployment, yous need to determine if the default Run As service business relationship, configured to run under the context of the local Network Service business relationship (NT Authority\Network Service), will suffice for your needs. If it does not, and so yous will need to update the Run As service business relationship to run under a domain account that has access to the resources in your Agile Directory domain(southward).

In either case, it'southward of import to understand the security implications of the account that Tableau Server uses for the Run As service business relationship. Specifically, if Tableau Server needs to access other servers, file shares, or databases that use Windows authentication, then the business relationship that is configured for Run As service account volition be used to access those resources. The business relationship that is configured for Run As service account must too have elevated permissions to the local Tableau Server. A general all-time security practise is to limit the scope of all user accounts to the minimum required permissions. We make the same recommendation to you every bit yous plan Run As service business relationship. For more than information, run into Data Access with the Run As Service Account

The account you employ for the Run As service account should non be a fellow member of the Local Administrators or Domain Administrators account. Instead nosotros recommend using a domain user account that is not an administrator for the Run As service business relationship. Using a domain account that is not a fellow member of these ambassador groups is a good security exercise and can help avoid access to certain data sources and folders. For data on best practices when creating a Run Equally service account, see Creating the Run As service account.

Y'all tin can set the Run As service business relationship during Tableau Server installation, or you tin update the Run As service business relationship using the TSM Web UI. Tableau Services Manager sets permissions for the Run As service account, simply if you are unsure if the account yous want to utilize for Run As service account satisfies the requirements, or if you have inverse the Run As service business relationship and are getting permission errors, come across Required Run Every bit Service Account Settings.

Default Run As service account: Network Service

The Network Service account is a predefined local account with express permissions that exists on all Windows computers. While information technology has limited administrative access to the local estimator on which it runs, it does have more access to resource than members of the Active Directory default Users group. For example the Network Service group tin write to the registry, the effect log, and has special rights to log on for application services.

Past default, the Run As service account is set to a local business relationship called Network Service. Apply the default Network Service account when:

  • You are using local authentication for Tableau Server.

  • All users in your arrangement include extracted information in the workbooks that they are uploading to Tableau Server.
  • You are running Tableau Server in a single-server deployment.
  • External data sources that your users access through Tableau Server exercise not crave Windows NT integrated security or Kerberos. In well-nigh data-access scenarios, Microsoft SQL Server, MSAS, Teradata, and Oracle databases require Windows NT integrated security.

While the Network Service account tin exist used to access resource on remote computers within the same Active Directory domain we practice not recommend using the default business relationship for such scenarios. Instead, configure a domain business relationship for Run Every bit service business relationship if Tableau Server must connect to data sources in your environs. See Change the Run As Service Account.

Run As service account: Domain user

For all Agile Directory scenarios, we recommend updating the Tableau Server Run As service account with a domain user business relationship. Update the Run Every bit service account to a domain user account when data sources accessed through Tableau Server crave Windows NT integrated security or Kerberos.

If y'all take deployed a distributed deployment of Tableau Server, then you can update the Run As service business relationship with either a domain user or a Windows workgroup user. In either case, you must apply the same user account for all server nodes. Meet Distributed Requirements for more information.

To configure your surroundings to use a domain account, run across Change the Run As Service Account .