MSSQLServer Service and Domain user

[anthonymeluso]

I just ran the new Baseline Security Analyzer from Microsoft and it flagged down that I'm running this service under the domain admin account. How can I change this to a different user and is this even safe?

I really think everything is working fine now but don't want to take a chance to screw things up. So which account should this service be running under?

Anthony

 

[LawnBoy]

Sure it's safe, as long as you know what you're doing

IF this instance of SQL is stand-alone (it does not care about or need access to other SQL instances on the network) then you can run it under the SYSTEM account.

IF, like me, you can't guarantee this instance will never need to access other instances on the network for infinity, the best practice is to create a windows account with Admin privileges for it to use. I usually create an account called "services" (or something easily recognized) and assign all my add-on services (SQL, backup exec, scheduler) to run using it.

To change which account a service runs under:
Control Panel -> Computer Management ->Services. Highlight the service in question (in your case, MSSQLSERVER is the main engine, and SQLSERVERAGENT is what runs backups, maintenance plans, etc.) and click the "Startup" button. There you can pick which account the highlighted service runs under.

 

[LawnBoy]

Whoops, that path is
Control Panel -> Administrative Tools -> Services.

 

[mrdenny]

It is recommended that you change the SQL Service Startup account is changed via the SQL Enterprise Manager if you can. This will ensure that the account has the rights that it needs.

For the tightest security the domain account should not be a domain admin, or a server admin. You should give it the least rights that it needs to do what you need it to do.

It is more secure to have the account running from a domain account rather than under the system account.

Denny
MCSA (2003) / MCDBA (SQL 2000)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

(Not quite so old any more.)