I am looking at changing all of our SQL Server instances to use AD accounts for the running services. I plan to use a different AD account for each service type, e.g. DB, SSIS, SSRS, etc. My question is whether I should create an account for each type and use those accounts across all the instances in the environment or create accounts for each service per server.
For example, if I have 2 servers A and B both running a database instance and SSIS:
Scenario 1 (single AD account across domain)
- SQLDB (database service)
- SQLSSIS (SSIS service)
Scenario 2 (multiple AD accounts)
Server A accounts
- SVRA_DB (database service on server A)
- SVRA_SSIS (SSIS service on server A)
- SVRB_DB (database service on server B)
- SVRB_SSIS (SSIS service on server B)
I know scenario 2 won't work for failover clusters and does pose a potential headache in terms of maintenance if the AD accounts are set to expire. Just wondering if there are any other gotchas to either approach and what best practices might be?
As an idea of our environment, we have about ~75 servers running various versions of SQL Server from 2005 up to 2014.
Thanks in advance for any help or insight!