The following post describe the installation of the Dynamics CRM 2013 Server. Specially it gives you an overview what will be created and what is necessary.
When you install Microsoft Dynamics CRM Server 2013, Setup creates the default folders listed in the following table.
| Folder |
Content |
|
SystemDrive:\Program Files\Microsoft Dynamics CRM\
|
Microsoft Dynamics CRM Server 2013 program files
|
|
SystemDrive:\Program Files\Microsoft Dynamics CRM\LangPacks\<LanguageID>\Reports\MSCRM
|
Contains a Microsoft Dynamics CRM subfolder that contains an .rdl file for each default report
|
|
SystemDrive:\Program Files\Microsoft Dynamics CRM\LangPacks
|
Location of Language Pack installations. Language Packs are downloaded and installed separately
|
|
SystemDrive:\Program Files\Microsoft Dynamics CRM\Trace
|
Stores trace file logs when tracing is enabled
|
|
SystemDrive:\Program Files\Microsoft Dynamics CRM\CustomizationImport
|
Location used to process data imports
|
|
SystemDrive:\Program Files\Microsoft Dynamics CRM\Unzip
|
Location used for unpackaging solutions
|
|
SystemDrive:\Program Files\Microsoft Dynamics CRM\CRMWeb
|
Microsoft Dynamics CRM website and Web services
|
|
SystemDrive:\Program Files\Microsoft Dynamics CRM\CRMWeb\CRMReports
|
Microsoft Dynamics CRM report services
|
The following web components are added:
|
Component
|
Name
|
Description
|
|
Application Pool
|
CRMAppPool
|
Microsoft Dynamics CRM Server Setup creates a separate application pool for the Microsoft Dynamics CRM application.
|
|
Application Pool
|
CRMDeploymentServiceAppPool
|
Microsoft Dynamics CRM Server Setup creates a separate application pool for the Deployment Web Service.
|
|
Site
|
Microsoft Dynamics CRM
|
Website for Microsoft Dynamics CRM.
|
|
Applications
|
XRMDeployment
|
Facilitates the implementation of xRM deployments.
|
|
Applications
|
Help
|
Services the Microsoft Dynamics CRM Help system for the application.
|
The following Active Directory groups are added. When the Active Directory domain is set to Native Mode, this group must be of the type Domain Local Security or Universal Security.
|
Group
|
Description
|
|
PrivReportingGroup
|
Privileged Microsoft Dynamics CRM user group for reporting functions. This group is created during Microsoft Dynamics CRM Server Setup and configured during Microsoft Dynamics CRM Reporting Extensions Setup.
|
|
PrivUserGroup
|
Privileged Microsoft Dynamics CRM user group for special administrative functions; including CRMAppPool identity (domain user or Network Service). The users who configure Microsoft Dynamics CRM Server 2013 must be added to this group.
|
|
SQLAccessGroup
|
All server processes/service accounts that require access to SQL Server; including CRMAppPool identity (domain user or Network Service). Members of this group have db_owner permission on the Microsoft Dynamics CRM databases.
|
|
ReportingGroup
|
All Microsoft Dynamics CRM users are included in this group. This group is updated automatically as users are added and removed from Microsoft Dynamics CRM. By default, all Microsoft Dynamics CRM Reporting Services reports grant Browse permission to this group.
|
The following services are added:
|
Service
|
Description
|
Possible Service User Name (depending on your user naming convention)
|
|
Microsoft Dynamics CRM Asynchronous Processing Service
|
Services asynchronous processes such as bulk email and workflow.
|
DOMAIN\crm.asynchron |
|
Microsoft Dynamics CRM Asynchronous Processing Service (maintenance)
|
Services asynchronous maintenance such as encryption key generation for authentication and database deletion clean up.
|
DOMAIN\crm.application |
|
Microsoft Dynamics CRM Unzip Service
|
Handles the uncompressing of zipped files for data import. This service is installed as part of the Web Application Server role.
|
DOMAIN\crm.web |
|
Microsoft Dynamics CRM Sandbox Processing Service
|
The Sandbox Processing Service server role enables an isolated environment to allow for the execution of custom code, such as plug-ins.
|
DOMAIN\crm.sandbox |
|
Microsoft Dynamics CRM Monitoring Service
|
Monitors all Microsoft Dynamics CRM Server 2013 server roles that are installed on the local computer.
|
DOMAIN\crm.monitoring |
|
Microsoft Dynamics CRM VSS Writer
|
Provides an interface to backup and restore Dynamics CRM data by using the Windows Server Volume Shadow Copy Service (VSS) infrastructure.
|
DOMAIN\crm.vss |
Microsoft Dynamics CRM Server Setup
The user account used to run Microsoft Dynamics CRM Server Setup that includes the creation of databases requires the following minimum permissions:
- Be a member of the Active Directory Domain Users group. By default, Active Directory Users and Computers adds new users to the Domain Users group.
- Be a member of the Administrators group on the local computer where Setup is running.
- Have Local Program Files folder read and write permission.
- Be a member of the Administrators group on the local computer where the instance of SQL Server is located that will be used to store the Microsoft Dynamics CRM databases.
- Have sysadmin membership on the instance of SQL Server that will be used to store the Microsoft Dynamics CRM databases.
- Have organization and security group creation permission in Active Directory service (ADDS).
- If Microsoft SQL Server Reporting Services is installed on a different server, you must add the Content Manager role at the root level for the installing user account. You must also add the System Administrator role at the site-wide level for the installing user account.
Services and CRMAppPool IIS Application Pool Identity Permissions
The user account that is used for the Microsoft Dynamics CRM services and IIS application pools must meet the following criteria:
- Microsoft Dynamics CRM services and application pool identity accounts must not be configured as a Microsoft Dynamics CRM user. Doing so can cause authentication issues and unexpected behavior in the application for all Microsoft Dynamics CRM users.
- Managed service accounts, introduced in Windows Server 2008 R2, are not supported for running Microsoft Dynamics CRM services.
Microsoft Dynamics CRM Sandbox Processing Service
Sandbox Processing Service server role enables an isolated environment to allow for the execution of custom code, such as plug-ins.
- Domain User membership.
- That account must be granted the Logon as service permission in the Local Security Policy.
- Folder read and write permission on the \Trace, by default located under \Program Files\Microsoft Dynamics CRM\Trace, and user account %AppData% folders on the local computer.
- Read permission to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRM subkey in the Windows Registry.
- The service account may need an SPN (server principal name) for the URL used to access the Web site that is associated with it. To set the SPN for the Sandbox Processing Service account, run the following command at a command prompt on the computer where the service is running.
- SETSPN –a MSCRMSandboxService/<ComputerName> <service account>
Services and CRMAppPool IIS Application Pool Identity Permissions
The user account that is used for the Microsoft Dynamics CRM services and IIS application pools must meet the following criteria:
- Microsoft Dynamics CRM services and application pool identity accounts must not be configured as a Microsoft Dynamics CRM user. Doing so can cause authentication issues and unexpected behavior in the application for all Microsoft Dynamics CRM users.
- Managed service accounts, introduced in Windows Server 2008 R2, are not supported for running Microsoft Dynamics CRM services.
Microsoft Dynamics CRM Sandbox Processing Service
- Domain User membership.
- That account must be granted the Logon as service permission in the Local Security Policy.
- Folder read and write permission on the \Trace, by default located under \Program Files\Microsoft Dynamics CRM\Trace, and user account %AppData% folders on the local computer.
- Read permission to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRM subkey in the Windows Registry.
- The service account may need an SPN for the URL used to access the Web site that is associated with it. To set the SPN for the Sandbox Processing Service account, run the following command at a command prompt on the computer where the service is running.
- SETSPN –a MSCRMSandboxService/<ComputerName> <service account>
Microsoft Dynamics CRM Asynchronous Processing Service
- Domain User membership.
- Performance Log Users membership.
- That account must be granted the Logon as service permission in the Local Security Policy.
- Folder read and write permission on the Trace folder, by default located under \Program Files\Microsoft Dynamics CRM\, and user account %AppData% folder on the local computer.
- Read and write permission to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRM and HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSCRMSandboxService subkeys in the Windows Registry.
- The service account may need an SPN for the URL used to access the Web site that is associated with it.
Deployment Web Service (CRMDeploymentServiceAppPool Application Pool identity)
- Domain User membership
- That account must be granted the Logon as service permission in the Local Security Policy.
- Local administrator group membership on the computer where the Deployment Web Service is running.
- Local administrator group membership on the computer where SQL Server is running.
- Sysadmin permission on the instance of SQL Server to be used for the configuration and organization databases.
- Folder read and write permission on the Trace and CRMWeb folders, by default located under \Program Files\Microsoft Dynamics CRM\, and user account %AppData% folder on the local computer.
- Read and write permission to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRM and HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSCRMSandboxService subkeys in the Windows Registry.
- CRM_WPG group membership. This group is used for IIS worker processes. The group is created and the membership is added during Microsoft Dynamics CRM Server Setup.
- The service account may need an SPN for the URL used to access the Web site that is associated with it.
Application Service (CRMAppPool IIS Application Pool identity)
- Member of the Active Directory Domain Users group.
- Member of the Active Directory Performance Log Users group.
- Administrators local group membership on the computer where SQL Server is running.
- Administrators local group membership on the computer where the Microsoft Dynamics CRM Web site is installed.
- Folder read and write permission on the Trace and CRMWeb folders, by default located under \Program Files\Microsoft Dynamics CRM\, and user account %AppData% folder on the local computer.
- Read and write permission to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSCRM and HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MSCRMaSandboxService subkeys in the Windows Registry.
- CRM_WPG group membership. This group is used for IIS worker processes. The group is created and the membership is added during Microsoft Dynamics CRM Server Setup.
- The service account may need an SPN for the URL used to access the Web site that is associated with it.
As a summary, for each service, it is recommend to select a low-privilege domain user account that is dedicated to running these services and is not used for any other purpose. Additionally, the user account that is used to run a Microsoft Dynamics CRM service cannot be a Microsoft Dynamics CRM user. The domain account must be a member of the Domain Users group. Additionally, if the Asynchronous Service and Sandbox Processing Service roles are installed, such as in a Full Server or a Back End Server installation, the domain account (Application- Asynchron- and Sandbox user) must be a member of the Performance Log Users security group.
If you select to run the ASP.NET service under a domain user account that is not a domain administrator or a local administrator, you must set a local security policy after you install Microsoft Dynamics CRM Server 2013 for the ASP.NET service to work correctly. Also, depending on the password policies that you have implemented for your organization, the password for the user may expire.
The following SQL Server components are added:
|
Component
|
Name
|
Description
|
|
Databases
|
MSCRM_CONFIG
OrganizationName_MSCRM
|
Microsoft SQL Server Setup creates the SystemDrive:\Program Files\Microsoft SQL Server\MSSQL<ver>\MSSQL\Data\ folder and Microsoft Dynamics CRM Server Setup installs the Microsoft Dynamics CRM configuration database and organization databases in it.
|
|
SQL Server Jobs
|
MSCRM_CONFIG.SiteWideCleanup
|
Microsoft Dynamics CRM Server Setup creates one SQL Server job that is used for maintenance.
|
|
Logins
|
PrivReportingGroup
ReportingGroup
SQLAccessGroup
MSCRMSqlLogin
|
Microsoft Dynamics CRM Server Setup creates SQL Server logins for the PrivReportingGroup, ReportingGroup, and SQLAccessGroup Active Directory groups that are created.
MSCRMSqlLogin is used for time zone conversions when you use dashboards and charts, and do queries using Advanced Find. When Microsoft SQL Server is enabled to use common language runtime (CLR), this can significantly improve performance for those features.
Note
By default, CLR is not enabled in Microsoft SQL Server. For more information about how to enable CLR, see Enabling CLR Integration.
|