You just got put in charge of a large number of SQL Server instances, call it 10 or 100, but there are quite a few. They're spread out on various servers and you are in charge of ensuring that they are properly configured and secure, although almost all of them are running internal applications for your employees.
So you are reviewing service accounts and SA passwords. For this Friday's poll, how do you handle them?
One account or many?
By that I mean do you set up a separate account and password for every instance? Do you have 10 or 100 sa passwords? Or do you use the same one everywhere and change it periodically?
In my experience, service accounts rarely change, but when they do, or need to, you don't want to have dependencies between instances or even servers. You want things as separate as they can be so that things don't start failing. So I would set separate accounts for every server (and separate passwords).
These days I tend to use Windows authentication everywhere, usually with a "DBA" group that has sysadmin privleges on each instance, but in the places where I do use SA passwords, I want them all to match. It's a pain and potentially a problem if I have to keep track of separate passwords for each server. Something like Password Safe helps, but I've found it easier to use the same SA password everywhere.
However I do think these need to change often, like every 30 days at least, or whenever someone in the group leaves, and I think having them all the same keeps some pressure on the DBAs to make sure things change.
But I'm curious to see what other people think. If you manage multiple servers, how do you handle this?
Steve Jones
The Voice of the DBA Podcasts
The podcast feeds are now available at sqlservercentral.mevio.com to get better bandwidth and maybe a little more exposure :). Comments are definitely appreciated and wanted, and you can get feeds from there.
or now on iTunes!
- Windows Media Podcast - 30.1MB WMV
- iPod Video Podcast - 23.5MB MP4
- MP3 Audio Podcast - 4.8MB
Today's podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.
I really appreciate and value feedback on the podcasts. Let us know what you like, don't like, or even send in ideas for the show. If you'd like to comment, post something here. The boss will be sure to read it.