question

Troy_2012 avatar image
Troy_2012 asked

What is the best practice for SQL Server service(MSSQLServer, SQLServerAgent) in domain environment

Hi , What is the best practice for SQL Server service(MSSQLServer, SQLServerAgent) in domain environment to run under 1- Virtual Account [NT Service\Servicesname] 2- [Domain User account] and also for this user what is the best privilege it should have :- - Just be member of Domain Users Group ***or*** other group on domain Server. - do we need to put this [Domain User account] member of Administrator group on server that host SQL Server Best. SQL Server 2012 & Windows server 2012
sql serverdomain
10 |1200
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

1 Answer

·
perrywhittle avatar image
perrywhittle answered
domain accounts are the best practice, if your AD catalog supports MSAs then these are viable although not recommended for clustered environments. At the end of the day, domain user accounts provide security and network access for the service it is running under.
4 comments
10 |1200
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Troy_2012 avatar image Troy_2012 commented ·
Ok,but what privilege we give to domain user account for the services like MSSQLServer ,SQLAgent ,SSIS.
0 Likes 0 ·
perrywhittle avatar image perrywhittle commented ·
To facilitate the smooth registration and deregistration of SPNs you may want to grant the following permissions in active directory. readserviceprincipalname writeserviceprincipalname But apart from that, None, the sql server installer takes care of granting required permissions to the account
0 Likes 0 ·
Troy_2012 avatar image Troy_2012 perrywhittle commented ·
I saw in many production environment they put these domain user for services in [Administrators group] on server that host SQL Server and just in [Domain Users Group] in AD , is this not good scenario?
0 Likes 0 ·
perrywhittle avatar image perrywhittle commented ·
the service account does not need to be a member of the local administrators group on the server, the permissions required on the account such as "logon as service" are granted by the sql server installer. All users inherit the Domain users group ;-)
0 Likes 0 ·

Write an Answer

Hint: Notify or tag a user in this post by typing @username.

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.