4

The security folks want all AD passwords to expire every three months. I'm really not excited about this, since I definitely won't remember, and I'll likely be on my boat, drunk, when they expire.

Question How often do you/should you change the passwords on your sql service accounts?

  • what version of sql server are you using ? – Kin Shah May 17 '18 at 16:42
  • everything from 2005-2016 – James May 17 '18 at 16:43
  • 1
    Thats a long shot.. AD user account passwords can expire but why service account passwords ? You will have outages all over and would be a nightmare to support. – Kin Shah May 17 '18 at 16:45
  • 1
    Not the answer you want to hear, but i've seen an admin and service account passwords never expire. Same password for over a decade. Tried to change it, was overruled and kept my mouth shut after that. – Alen May 17 '18 at 17:52
  • 1
    Just to throw in my 2 cents here..... I manage over 400+ SQL servers for a defense contractor, and we change our engine and agent service account passwords every other quarter. :) – H.79 May 17 '18 at 23:14
7

The security folks want all AD passwords to expire every three months.

Normally 1 year is pretty standard, 3 months might be expected in a more secure environment where virtual accounts can't be used.

... since I definitely won't remember, and I'll likely be on my boat, drunk, when they expire.

I thought it was in a submarine under the polar ice caps (Dilbert Reference)

How often do you/should you change the passwords on your sql service accounts?

I'll reiterate that once a year is fairly standard, but it still isn't a great story. You have to change the account, there is a service restart required, and in general no one is happy about it except InfoSec.

This is why you should modernize by using Managed Service Accounts and/or Group Managed Service Accounts (or virtual accounts). In MSAs, the password is automatically rotated and is not known by anyone, gMSAs work a bit different but you can think of them the same as MSAs for use with multiple computer objects. The automatic password rotation does not require a service restart.

| improve this answer | |
1

I've worked at places that never expire service account passwords and other places that do it as a requirement.

I personally don't feel it's necessary in most environments because the service account passwords are generally not known to anyone except admins and can be made to be very strong. Also, if you are managing the service accounts security, they should each have limited access to do exactly what it needs and no more. If that is the case, the risk associated with such accounts is very low.

At one point, I actually designed an application to handle the security aspects of sharing passwords within the IT organization. With hundreds of environments and potentially thousands of service accounts, managing it all with a spreadsheet was getting out of hand, not to mention the lax security associated with Excel.
I'm hoping to add some new features like PW expiration warnings to the app at some point but its not really a priority now. My current employer never expires service account passwords.

| improve this answer | |
1

In all organizations I have worked with, including some heavily regulated environments like healthcare and financial services, it is usually permissible to configure functional login IDs with non-expiring passwords, provided that certain conditions are enforced, such as:

  • Interactive login is disabled for these accounts.
  • Functional accounts do not have privileged authorities (such as sudo rights). If elevated privileges are required for certain commands, they are only granted for those specific commands.
  • Their passwords have enforced complexity and are stored encrypted.
  • There exists a mechanism to reset these passwords if compromised.
  • Accounts are regularly (at least yearly) reviewed for continuing business need.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.