2

I'm currently starting to upgrade out SQL Server estate to 2012, and historical people have created two domain accounts for the database services MSSSQLServer and one for the SQL Server agent to operate under.

However I've always been concerned that in most case these have been given sysadmin rights on the SQL Server and would like to change this. However I'm unable to find anywhere were best practice is detailed on this subject, I really want to lower this account to its minimal security requirements for starting and stopping the database but will that be enough for it to function?

Hope someone can help :-)

Improve this question

1 Answer 1

Reset to default
1

The engine provisioning Setup makes them sysadmin members, as documented at Configure Windows Service Accounts and Permissions:

SQL Server Per-service SID Login and Privileges The per-service SID of the SQL Server service is provisioned as a Database Engine login. The per-service SID login is a member of the sysadmin fixed server role.

SQL Server Agent Login and Privileges The per-service SID of the SQL Server Agent service is provisioned as a Database Engine login. The per-service SID login is a member of the sysadmin fixed server role.

If the product Setup makes them sysadmin is better you follow the same practice.

Improve this answer
1
  • Thanks, I've read the link prior to posting but thought I'd stick the question out there to see any differing opinions.
    – MrG
    Commented Oct 16, 2013 at 9:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.