Managing the Service accounts in large environment

Question

I wanted to know if there's a best practice in regards to secure a large environment of SQL Server instances (version 2000-2012).

Currently the SQL services are running with many users and I'm trying to improve the situation. I know that the best practice is to use a domain account.

But what is the best practice for a large environment ? Should I create a domain user that will be the service account for each service? For each Server? For the entire list of servers?

I would be happy to hear from your experience,

Thanks,

Roni.

Answer 1

A separate AD service account for each service on each instance is the most secure model and if you have some good password management software it shouldn't be a problem. The work involved in creating all the service accounts and entering them into your password software will be quite time consuming depending on how big your environment is.

Some people sacrifice some security by using the same service account for all the services on a SQL instance. The problem with this is if the account gets locked out then all the services including the SQL service account will be locked out. This problem becomes even worse if you use the same AD account across SQL instances as one instance can be affected by another. Also obviously if an account is compromised, the more services it is used for then the more services that are compromised.