Service SIDs have been around since Windows 2008 but I have found very little information about them.

What I do know is that the SQL install will create the Service SIDs and assign to them the various authorities they need in order to run SQL Server.

To me it looks like Service SIDs have a lot of advantages:

1) You get a unique account for each service, so that if the integrity of one account is compromised then no other services are affected.

2) The Service SIDs are given the minimum rights needed to run the service.

3) The accounts do not have a password, so there is no need to change this on a regular basis (or never change it and risk that former staff known about your current security setup).

4) There is no need to set up a Group Policy Object (GPO) to enforce the security of a Service SID.

What I do not know and have not yet bothered to test is:

a) Can a Service SID be used for a service that needs to accessed over the network

b) How does Kerberos work with a Service SID so that the service can be trusted for 'double hop' authentication

c) Do I need to define a Service Principal Name (SPN) for a Service SID and if so what is the syntax

If anyone has the answers to a),b),c) then please let us all know. If a Service SID can be trusted by Kerberos for double-hop authentication then it seems to me that Service SIDs are a far better choice for SQL Server than are Service Accounts.