1

I just inherited a set of new servers and whoever set them up left the "Log On As" account as the default "NT Service\MSSQLSERVER". I'd like to change that over to an Active Directory service name. I have never attempted changing it after we have already went live in production. Is there anything I should be aware of? Will it require a restart of the service? This server is only using SQL, not SSIS, SSAS, SSRS. I will make sure the AD service name has access to all the folders necessary to reach files. Anything else I'm missing?

1

As long as you change the service account within SQL Server Configuration Manager (SSCM) it will apply all the permissions required (registry, files, etc.).

Only thing to be aware of are those rare occasions where SSCM process does not apply all permissions as expected, generally from some WMI issue. I so far have not come across this in new versions of SQL Server (2008 R2+).

By the name of that service account I am going to assume you are on an OS of Window Server 2008 R2 or higher. Just as a side note, if you do not actually need access to Active Directory resources leaving that account as the system account is perfectly alright. Most security standards will allow it as well if you are running on a current Operating System. These are virtual accounts that offer more security than the previous local system accounts did in previous versions of the OS. They are less chances of someone impersonating those accounts. I use them on most servers I setup for clients now unless they have some reason to need full domain access.

  • My understanding is that local accounts like that cannot be granted read/write permissions to shared drives on other servers. That is the problem I'm running into now (along with my assumption that it's best practice to use AD accounts). Can local accounts be granted read/write perms to a shared drive? – Chris Woods Jan 28 '15 at 17:40
  • If the computer account is registered on your domain, yes you can. You would be granting the computer access and not a single account, which some don't like doing. If you don't then just use a domain account. – Shawn Melton Jan 28 '15 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.