Planning to re-create new service accounts for our Sql-Servers, I wondered if - from a security perspective - it maybe better to have one domain account per Service and per Server or to create one domain-account per service only and re-use those on the different servers?




We are doing this because we want to have a uniform and consistent configuration on all servers, something that is not yet in place today. I feel like having single accounts for every server might allow more flexibility and so is counterproductive...

Are there specific pros / cons? Is there a lot of usage of having separated service accounts for every server?

  • I don't think it's duplicate because the other question is about performance, not about security and so it's a different question that may lead to the same answers but it is still a different question and from my perspective it is much more relevant to ask for security considerations than for possible performance impacts in that context. – Magier Oct 4 '16 at 12:21

Separate service accounts for each server and for each service will restrict any issues to just one server and just one service in the following cases:

  1. Service account getting compromised
  2. Service account getting locked out
  3. Service account password changed
  4. Service account getting disabled/deleted/renamed by mistake

Imagine what would happen with a single service account if you entered the service credentials wrong a handful of times (scripts are great for this): you would lock out the account and tear down the whole SQL Server farm. Not good.

| improve this answer | |
  • Abbreviations? Sorry, I don't get what you're looking for. Can you please clarify? – spaghettidba Oct 4 '16 at 12:27
  • Conform to any naming convention you have in your org. There's no set abbreviation you should use – spaghettidba Oct 4 '16 at 12:29
  • No, the browser service can happily run as localservice. – spaghettidba Oct 4 '16 at 12:52
  • Is there any special reason nobody pointed to group-managed-service-accounts? – Magier Oct 12 '16 at 11:24
  • 1
    It looks like SQL Server 2016 supports gMSAs, so it might be a good idea. – spaghettidba Oct 12 '16 at 13:08

I would suggest that hackers love "uniform and consistent configuration on all servers", especially when it comes to security because if they can crack open one server, they possibly have access to other servers. Best practices (https://support.microsoft.com/en-us/kb/2160720) generally suggest a different service account for EACH Sql Service on a given server and using the SAME service account across multiple servers is highly discouraged.

| improve this answer | |
  • Is there any special reason nobody pointed to group-managed-service-accounts? – Magier Oct 12 '16 at 11:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.