Home Forums SQL Server 7,2000 Administration Should each SQL Server service have its own domain account? RE: Should each SQL Server service have its own domain account?

  • My 2 pennies worth... it depends.

    Using a separate account for each SQL Service on each SQL instance gives maximum security and maximum maintenance overhead. Using the same account for all SQL services and instances gives minimum security and minimum maintenance overhead (until you HAVE to change the password then you get the worst migraine possible).

    You need to talk to to your site's security people to get an understanding of the risks deemed acceptable by your management.

    Many organisations will enforce separate accounts for Dev, Test, Prod, but not require separate accounts for each service or instance within each environment. Others will add to this the need for a separate account for web and non-web facing SQL instances.

    If you have data that requires a high level of confidentiality (eg compliance with PCI or HIPAA) then for the affected servers the use of separate accounts for each service and instance is an important part of risk minimisation. If you did use a common account for data covered by PCI and you got hacked and the hacking was made easier because you had a common account, then do not be surprised if a court awards greater damages against your organisation because of their lax attitude to security.

    With SQL2012 and above running on Windows 2012 and above then consider using Domain Managed Accounts if you need to use separate accounts for each service and instance. These offer enhanced security compared to normal domain accounts, and have the advantage they have no password to manage.

    Original author: https://github.com/SQL-FineBuild/Common/wiki/ 1-click install and best practice configuration of SQL Server 2019, 2017 2016, 2014, 2012, 2008 R2, 2008 and 2005.

    When I give food to the poor they call me a saint. When I ask why they are poor they call me a communist - Archbishop Hélder Câmara