We are implementing a password management system to automate the resetting of passwords at regular intervals.
We want this system to update passwords saved in the Credentials Node when the passwords are reset in AD. We're not going to put the password management account in the sysadmin role, and we're reluctant to put it in the security admin role.
If we were to grant ALTER ANY CREDENTIAL to the password management account, are there security implications beyond it having the ability to run ALTER CREDENTIAL commands?