local system account for sql server service

Question

local system account for sql server service

bodhilove

SSCarpal Tunnel

Points: 4035
More actions
December 1, 2008 at 12:57 am

#196442

Hi Folks,
what are the ramifications of using the local system account for the sql server service?

Viewing 12 posts - 1 through 11 (of 11 total)

You must be logged in to reply to this topic. Login to reply

george sibbald SSC Guru Points: 104210 More actions · Answer 1

main effect is that SQL can not perform any actions that require network connectivity, e.g. access shares on other servers, backup across the network, logshipping or mirroring would not work if you required those options.

Also local admin is more access at the the server level than SQL really requires so there is an enhanced security risk.

---------------------------------------------------------------------

Jerry Hung SSChampion Points: 12968 More actions · Answer 2

Local System is pretty minimal, safe for a local SQL instance

If you need Network-features such as back up to UNC, talk to other servers etc... use a domain account if you can

You don't need Local Admin

This is for SQL 2005 Express, but applicable as well

http://msdn.microsoft.com/en-us/library/ms143170(SQL.90).aspx

Use the built-in System account
You can assign Local System, Network Service, or Local Service to the logon for the configurable SQL Server services.
Local System account
The Local System option specifies a local system account that does not require a password to connect to SQL Server on the same computer. However, the local system account might restrict the SQL Server installation from interacting with other servers, depending on the privileges granted to the account.
Important:
Local System is a powerful account. It might not be appropriate for all service settings. For more information, see "Security Considerations for a SQL Server Installation." in SQL Server 2005 Books Online.
Network Service account
The Network Service account is a special, built-in account that is similar to an authenticated user account. The Network Service account has the same level of access to resources and objects as members of the Users group. Services that run as the Network Service account access network resources using the credentials of the computer account.
Important:
We recommend that you do not use the Network Service account for the SQL Server. Local User or Domain User accounts are more appropriate for these SQL Server services.
Local Service account
The Local Service account is a special, built-in account that is similar to an authenticated user account. The Local Service account has the same level of access to resources and objects as members of the Users group. This limited access helps safeguard the system if individual services or processes are compromised. Services that run as the Local Service account access network resources as a null session without credentials. For more information on service accounts, see Setting Up Windows Service Accounts in SQL Server 2005 Books Online.

SQLServerNewbieMCITP: Database Administrator SQL Server 2005

bodhilove SSCarpal Tunnel Points: 4035 More actions · Answer 3

I think you can use mirroring if you use certificates

http://msdn.microsoft.com/en-us/library/ms191477.aspx

Mike Levan SSChampion Points: 14201 More actions · Answer 4

I am trying to change local account to windows account as service ac for sql server but when i change login as from services>SQL Server Service > properties its net getting started after restarting.

do i need to change anything else ofr the newly created windows account.

thanks

Steve Jones - SSC Editor SSC Guru Points: 736568 More actions · Answer 5

Change this in Configuration manager, not control panel, and you should be fine.

Mike Levan SSChampion Points: 14201 More actions · Answer 6

yeah it worked. can u let me know what is the diffrence.

thanks

Steve Jones - SSC Editor SSC Guru Points: 736568 More actions · Answer 7

I don't have the list handy, but Configuration Manager grants the rights needed (folders/files/user rights) for the service account.

Roy Ernest SSC-Dedicated Points: 38780 More actions · Answer 8

Along with what steve said, I would also add that some registery entries wont be done properly if you use services to change the account.

-Roy

K. Brian Kelley SSC Guru Points: 114642 More actions · Answer 9

I know I'm coming in late on this, but the preference is not to use the local System account. It's not a minimal account (that's Local Service). It has all the rights of an administrator-level account + some (there are rights granted to System, such implicitly that are not normally granted to members of the local Administrators group). If you have the option, create a new local account with a strong password and use that, instead.

K. Brian Kelley
@kbriankelley

juice 93056 Grasshopper Points: 16 More actions · Answer 10

Hi,

how does this sqaure with http://msdn.microsoft.com/en-us/library/ms190926.aspx where they say "For improved security, use a Windows domain account with the permissions listed in the following section, 'Windows Domain Account Permissions.'"

(this is my first post, I joined just to ask this :cool:)

K. Brian Kelley SSC Guru Points: 114642 More actions · Answer 11

Local system fails the recommendation on two points:

- It is a local, not a domain account.

- It is, by rule, a member of the administrators group (actually it has more power than this).

K. Brian Kelley
@kbriankelley