Is there a reason to change the service account name?

Question

Is there a reason to change the service account name?

shmulikc1204

SSC Enthusiast

Points: 179
More actions
December 11, 2019 at 12:55 pm

#3706895

Hi All
I was asked to change the SQL service account name. I asked for a reason, I was told this is for security reasons. As far as I know, the default service account is a virtual user found in NT Services, (for default instances it is NT Services\MSSQLSERVER ) which has access only to resources needed by the SQL server (e.g the directories of the executable files, data and log), and no one can log in using this virtual user or impersonating it. So is there a good reason to change the service account, and if there is, what is it?

Viewing 7 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic. Login to reply

alevyinroc SSC Rookie Points: 30 More actions · Answer 1

Were you asked to change just the name of the service account, or to change the account the service runs under entirely (perhaps to use a domain account)?

shmulikc1204 SSC Enthusiast Points: 179 More actions · Answer 2

shmulikc1204

SSC Enthusiast

Points: 179

December 11, 2019 at 1:32 pm

#3706944

I was asked to use a domain account.

John Mitchell-245523 SSC Guru Points: 148809 More actions · Answer 3

One very good reason to use a domain account instead of the default account is to get access to network resources so that you can, for example, back up your databases to a file share instead of to a folder on the same server.

John

muthukkumaran Kaliyamoorthy SSCoach Points: 19026 More actions · Answer 4

shmulikc1204 wrote:

I was asked to use a domain account.

Yes, use domain account, you will have a more control.

Muthukkumaran Kaliyamoorthy
https://www.sqlserverblogforum.com/

shmulikc1204 SSC Enthusiast Points: 179 More actions · Answer 5

Thank you for the answers. I didn't think about backing up the DBs to a share in the network, and it can be a good reason, but I suspect the manager who asked me to change the service account did not think about it as well, since he said this is a security policy, and the DB is backed to a local directory in this instance. So, does anyone knows any security related reason to change the service account?

(I did change it as I was requested, I just want to know if I'm missing here something)

frederico_fonseca SSCoach Points: 16154 More actions · Answer 6

Note that the domain account in this case should be a GMSA/MSA account - not a normal user account.

If this is not the type of account you created/used I would go back to them and confirm this aspect - Normal user account is insecure while GMSA/MSA is fully managed by AD and can't be used interactively.