|
|
|
Old Hand
      
Group: General Forum Members
Last Login: Tuesday, November 23, 2010 11:36 PM
Points: 305,
Visits: 888
|
|
Hi Folks,
what are the ramifications of using the local system account for the sql server service?
|
|
|
|
|
SSCertifiable
       
Group: General Forum Members
Last Login: Yesterday @ 4:02 PM
Points: 5,269,
Visits: 11,203
|
|
main effect is that SQL can not perform any actions that require network connectivity, e.g. access shares on other servers, backup across the network, logshipping or mirroring would not work if you required those options.
Also local admin is more access at the the server level than SQL really requires so there is an enhanced security risk.
---------------------------------------------------------------------
|
|
|
|
|
Right there with Babe
      
Group: General Forum Members
Last Login: Yesterday @ 11:40 AM
Points: 768,
Visits: 1,160
|
|
Local System is pretty minimal, safe for a local SQL instance If you need Network-features such as back up to UNC, talk to other servers etc... use a domain account if you can
You don't need Local Admin
This is for SQL 2005 Express, but applicable as well http://msdn.microsoft.com/en-us/library/ms143170(SQL.90).aspx
Use the built-in System account
You can assign Local System, Network Service, or Local Service to the logon for the configurable SQL Server services.
Local System account
The Local System option specifies a local system account that does not require a password to connect to SQL Server on the same computer. However, the local system account might restrict the SQL Server installation from interacting with other servers, depending on the privileges granted to the account. Important: Local System is a powerful account. It might not be appropriate for all service settings. For more information, see "Security Considerations for a SQL Server Installation." in SQL Server 2005 Books Online.
Network Service account
The Network Service account is a special, built-in account that is similar to an authenticated user account. The Network Service account has the same level of access to resources and objects as members of the Users group. Services that run as the Network Service account access network resources using the credentials of the computer account. Important: We recommend that you do not use the Network Service account for the SQL Server. Local User or Domain User accounts are more appropriate for these SQL Server services.
Local Service account
The Local Service account is a special, built-in account that is similar to an authenticated user account. The Local Service account has the same level of access to resources and objects as members of the Users group. This limited access helps safeguard the system if individual services or processes are compromised. Services that run as the Local Service account access network resources as a null session without credentials. For more information on service accounts, see Setting Up Windows Service Accounts in SQL Server 2005 Books Online.
SQLServerNewbie
MCITP: Database Administrator SQL Server 2005
|
|
|
|
|
Old Hand
      
Group: General Forum Members
Last Login: Tuesday, November 23, 2010 11:36 PM
Points: 305,
Visits: 888
|
|
I think you can use mirroring if you use certificates
http://msdn.microsoft.com/en-us/library/ms191477.aspx
|
|
|
|
|
Ten Centuries
      
Group: General Forum Members
Last Login: Saturday, April 03, 2010 2:42 PM
Points: 1,023,
Visits: 1,893
|
|
I am trying to change local account to windows account as service ac for sql server but when i change login as from services>SQL Server Service > properties its net getting started after restarting. do i need to change anything else ofr the newly created windows account.
thanks
|
|
|
|
|
SSC-Dedicated
           
Group: Administrators
Last Login: Yesterday @ 6:14 PM
Points: 31,421,
Visits: 13,734
|
|
|
|
|
|
Ten Centuries
      
Group: General Forum Members
Last Login: Saturday, April 03, 2010 2:42 PM
Points: 1,023,
Visits: 1,893
|
|
yeah it worked. can u let me know what is the diffrence. thanks
|
|
|
|
|
SSC-Dedicated
           
Group: Administrators
Last Login: Yesterday @ 6:14 PM
Points: 31,421,
Visits: 13,734
|
|
|
|
|
|
Hall of Fame
       
Group: General Forum Members
Last Login: Yesterday @ 7:52 AM
Points: 3,280,
Visits: 6,622
|
|
Along with what steve said, I would also add that some registery entries wont be done properly if you use services to change the account.
-Roy
|
|
|
|
|
Keeper of the Duck
Group: Moderators
Last Login: Yesterday @ 4:47 PM
Points: 6,584,
Visits: 1,788
|
|
I know I'm coming in late on this, but the preference is not to use the local System account. It's not a minimal account (that's Local Service). It has all the rights of an administrator-level account + some (there are rights granted to System, such implicitly that are not normally granted to members of the local Administrators group). If you have the option, create a new local account with a strong password and use that, instead.
K. Brian Kelley, CISA, MCSE, Security+, MVP - SQL Server Regular Columnist (Security), SQLServerCentral.com Author of Introduction to SQL Server: Basic Skills for Any SQL Server User | Professional Development blog | Technical Blog | LinkedIn | Twitter
|
|
|
|