3

We run stand alone instances all virtual. SQL 2012 - SQL 2017 Backups are performed by a third party tool so the server has no need to access anything on the network.

Agent jobs are all run via proxy accounts.

I've started to use virtual service accounts since i don't see the need to setup AD accounts and also Microsoft indicates to use a VSA or MSA (if network access is needed).

I just noticed today that, in my sp_Blitz results, the lowest priority issue indicates AD accounts are preferred. Now of course it is the lowest priority, which to me is a non issue, but I'd really like to know why there is a preference (at least from Brent) to use AD accounts.

Improve this question
0

1 Answer 1

Reset to default
3

I generally start with AD accounts because someday, someone's going to want to join this server into an Availability Group. Then, they're going to wonder why they have problems with Kerberos authentication. Books Online states:

All server instances that host an availability replica for the availability group must use the same SQL Server service account.

So I just head that off at the pass by using an AD account for any SQL Server, and then if I end up needing to add it to an AG later, all I have to do is set up the other replica with the same service account.

Improve this answer
1
  • Thanks Brent, this one point is enough to tip the scales on one being better than the other, and there's always the chance we go back to doing native backups.
    – tvanharp
    Commented Feb 8, 2019 at 19:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.