We are going to be hiring an external contractor to do some work on our SharePoint server and they will need admin rights for kerberos setup and etc.

What are the best practices of setting up the user account that this contractor will remote in as?

Are there some legal documents that should be signed that will protect our enterprise?

Also we will be setting up VPN access for this user through a Meraki firewall, are there any steps that should be taken there?

Is there any way to track this users activity in the network?

  • Does your business need to comply with any regulations (HIPAA, FISMA, etc)? That would be a good place to start. Sep 1, 2016 at 18:39

1 Answer 1


So general best practices first:

  • Do not use generic accounts (i.e. ConsultantCo) rather use named accounts (i.e. JSmith_Consultant). One for each contractor.
  • The contractor probably doesn't need Domain Admin. Local Admin on the SharePoint server (and whatever other systems are needed) should be sufficient.
  • Enable logging on the box(es). If possible, ship the logs to another server that the consultant doesn't have access to for review/audit purposes.
  • Enable time-based logins. In other words, restrict the user's ability to logon to only the times they should be doing work.

For Meraki MX Appliances:

  • Similarly, make sure the user does not have excessive permissions, if the Meraki VPN users are not tied to AD, then configure a separate (complex) password for this account as well.
  • Enable logging, Meraki supports exporting to syslog for reviewing activity.
  • I don't believe Meraki has implemented time restrictions on VPN access yet, so manually disable the account when not in use (nights, weekends, holidays, etc.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.