1

This question already has an answer here:

Planning to re-create new service accounts for our Sql-Servers, I wondered if - from a security perspective - it maybe better to have one domain account per Service and per Server or to create one domain-account per service only and re-use those on the different servers?

DOMAIN\Service-SSRS
DOMAIN\Service-SSAS
DOMAIN\Service-SSIS

vs.

DOMAIN\Service-SQL01-SSRS
DOMAIN\Service-SQL01-SSAS
DOMAIN\Service-SQL01-SSIS
DOMAIN\Service-SQL02-SSRS
DOMAIN\Service-SQL02-SSAS
DOMAIN\Service-SQL02-SSIS
etc.

We are doing this because we want to have a uniform and consistent configuration on all servers, something that is not yet in place today. I feel like having single accounts for every server might allow more flexibility and so is counterproductive...

Are there specific pros / cons? Is there a lot of usage of having separated service accounts for every server?

marked as duplicate by Kin Shah sql-server Aug 29 '16 at 14:00

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • I don't think it's duplicate because the other question is about performance, not about security and so it's a different question that may lead to the same answers but it is still a different question and from my perspective it is much more relevant to ask for security considerations than for possible performance impacts in that context. – Magier Oct 4 '16 at 12:21
5

Separate service accounts for each server and for each service will restrict any issues to just one server and just one service in the following cases:

  1. Service account getting compromised
  2. Service account getting locked out
  3. Service account password changed
  4. Service account getting disabled/deleted/renamed by mistake

Imagine what would happen with a single service account if you entered the service credentials wrong a handful of times (scripts are great for this): you would lock out the account and tear down the whole SQL Server farm. Not good.

  • Abbreviations? Sorry, I don't get what you're looking for. Can you please clarify? – spaghettidba Oct 4 '16 at 12:27
  • Conform to any naming convention you have in your org. There's no set abbreviation you should use – spaghettidba Oct 4 '16 at 12:29
  • No, the browser service can happily run as localservice. – spaghettidba Oct 4 '16 at 12:52
  • Is there any special reason nobody pointed to group-managed-service-accounts? – Magier Oct 12 '16 at 11:24
  • 1
    It looks like SQL Server 2016 supports gMSAs, so it might be a good idea. – spaghettidba Oct 12 '16 at 13:08
2

I would suggest that hackers love "uniform and consistent configuration on all servers", especially when it comes to security because if they can crack open one server, they possibly have access to other servers. Best practices (https://support.microsoft.com/en-us/kb/2160720) generally suggest a different service account for EACH Sql Service on a given server and using the SAME service account across multiple servers is highly discouraged.

  • Is there any special reason nobody pointed to group-managed-service-accounts? – Magier Oct 12 '16 at 11:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.