Had a question about how local permission are granted(like Log on as a service and Replace a process-level token) when you change the SQL Server service account from Virtual account (NT SERVICE\MSSQLSERVER) to an Windows AD account.
I first installed sql server without specifying an windows account. After installation when I check "Local Security Policy" I could see "NT SERVICE\MSSQLSERVER" added to permissions like "Log on as a service" and "Replace a process-level token".
Then I changed service account to a windows AD account using configuration manager and went back and checked Local Security Policy again and I couldn't find the new windows AD account added in any of them.
So I am wondering how the windows AD account gets those permissions? Is it somehow linked to the virtual accounts?
SQL Server 2014, Windows 2012R2
I have gone through the below questions, but this specific question is not covered.