Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

As part of a security policy, the company I work for has given me the task of changing the sa's and SQL Server Agent service accounts' passwords for several instances.

What's the possible impact of doing this? Is there anything in particular I should watch out for? Is there any whitepaper, guide or even blog post about this kind of task? What kind of 'backup' plan should I have in place in case anything goes wrong?

Any guidance is appreciated.

share|improve this question
    
I would personally say you that do not use random passwords your passwords should be in the way , its unique and other shouldnt grab it. –  user7685 Mar 27 '12 at 4:39

2 Answers 2

up vote 4 down vote accepted

Well for security reason you should not be letting anyone use the "sa" account. If you do then obviously changing that password will break whatever is using it. I try to set this password to a random password, rename it (only SQL 2005 and above allow this), and then disable it. I have not found anything so far that explicitly requires the "sa" account to function, my own admin account suffices.

With regards to the service account this should not cause any problems. Again as long as no other resource or service is using the same account.

The only backup plan I can suggest is having the old password handy to reset the accounts back to in the event something breaks.

share|improve this answer
    
You are right, nobody but the DBAs have access to the sa account, and even we don't actually use it. –  ivanmp Feb 9 '12 at 0:41
    
I would suggest setting the password to a random guid and then disable it then. –  Shawn Melton Feb 9 '12 at 1:17

In addition, one should always use the Sql Server Configuration Manager to change any accounts and passwords Sql Server uses. As per MSDN, Config Manager makes sure registry permissions and the like are updated when an account is changed. What's more, no restart is required if Config Manager is being used.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.