Windows time sync

w32tm /config /manualpeerlist:"0.north-america.pool.ntp.org 1.north-america.pool.ntp.org" /syncfromflags:manual /reliable:yes /update

w32tm /query /peers

net stop w32time

net start w32time

Least Privileged for SharePoint

1. SQL Server Service Account (sp_sql): run mssql server, mssql agent svc
- Standard Domain User Account

2. SharePoint Setup User (sp_admin): run as logon account when install SP or configure SP
- Standard Domain User Account
- Local admin group of every sp server of the farm
- SQL role: db server security, db creator, db admin

3. Server Farm/DB Access Account (sp_farm) 
- Standard Domain User Account

Create account for every services
-App Pool Account
-App Pool Account for BDC service app, excel app, ..