proxy account and service account

Question

proxy account and service account

sqlfriend

SSC Guru

Points: 52781
More actions
April 29, 2011 at 3:16 pm

#237430

I'm using SQLSERVER 2008. We setup a proxy account by creating a credential first. The account for credential we use is the service account.
Then we use this proxy account for running most of our ssis packages.
It works fine.
My question is what is the difference between by using directly the service account and the proxy account in the job step run as account?
They are both actually use the same accounts.
Thanks

Viewing 5 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic. Login to reply

Warwick Rudd Ten Centuries Points: 1240 More actions · Answer 1

It's to do with permissions. Your SQL service account if you lock things down may only have permissions on the specific directories that were created as part of the install. It may not have any other permissions, or access to other servers. You may not have given it sa permissions at install time . As such a proxy account can be created with approriate permissions. As you will have seen there are a few different types of proxy that can be created.

Using proxy accounts can reduce the security risk footprint.

I hope this has helped.

MCT
MCITP Database Admin 2008
MCITP Database Admin 2008
MCITP Database Dev 2008
www.jnrit.com.au/Blog.aspx

sqlfriend SSC Guru Points: 52781 More actions · Answer 2

But I'm using the same service account for proxy account...

Warwick Rudd Ten Centuries Points: 1240 More actions · Answer 3

Your service account has appropriate permissions then and you do not need to create a credential and corresponding proxy.

Proxy accounts are used for a permissions. Unless you have a specific reason you do not need to use a proxy.

MCT
MCITP Database Admin 2008
MCITP Database Admin 2008
MCITP Database Dev 2008
www.jnrit.com.au/Blog.aspx

SQLBuddy123 One Orange Chip Points: 28294 More actions · Answer 4

Warwick made a good explanation.

The difference in your case is unless the SQL Server Agent account is running under the service account you specified you can't use it as the "Run as" in the Job step.

For example say, SQL Server Agent is running under Domain Account A , then you cant use Service Account that you mentioned as "Run AS" under Job step.

Proxies remove these limitations. You can use any account as proxy and then run the Job under that Proxy account.

Thank You,

Best Regards,

SQLBuddy.