9

Is there any negative performance impact for using the same service account and agent account to run SQL Server and SQL Agent respectively for all SQL server instances running at a small company of say 35 servers? The biggest database is 0.5 GB. any suggestions are welcome. Thank you.

16

Is there any negative performance impact for using the same service account and agent account to run SQL Server and SQL Agent respectively for all SQL server instances running at a small company of say 35 servers?

No. Service accounts do not affect performance in any way. Its all about security !

From the SQL Server 2012 security best practice whitepaper (warning: word doc) :

When choosing service accounts, consider the principle of least privilege. The service account should have exactly the privileges that it needs to do its job and no more privileges.

You also need to consider account isolation; the service accounts should not only be different from one another, they should not be used by any other service on the same server.

If you are running Windows Server 2008 R2 & SQL Server 2012 and up, then best is to use

  • Virtual accounts or

    Virtual accounts are managed local accounts that is automatically provisioned and managed. In SQL Server 2012, they are the default service account specified during setup. It can access the network. A virtual service account has a well-known name in the form of NT SERVICE\ and can access the network using the credentials \$.

  • managed service accounts

    A managed service account is a special type of domain account that can be assigned to a single computer and used to manage a service. It must be provisioned by the domain administrator prior to being used. This type of account cannot be used to log in to a computer and provides automatic SPN and password management, once provisioned.

8

The real problem with using one Service Account for all of your servers is: How secure do you want to be? If someone is able to hack that one account, then all 35 servers are exposed in one swoop.

I much prefer at least a Service Account per server. And having several Service Accounts for different uses is also recommended for security.

See: Configure Windows Service Accounts and Permissions

This offers extensive suggestions on service accounts. It is, of course, up to you to determine how much you need or want to do.

Of course, you can grant local permissions for a service account on another server. This would allow it to make changes according to the permissions you have granted.

4

There is no negative performance impact to using the same account on all your servers. If a change happens to that account, however, it will impact all your services using that account. You may want to consider different accounts for different environments (e.g. DEV, TEST, PROD).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.