Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have three sql server 2005 servers, and I am about to switch them to from running their sql server service as a local user to running as a domain user. Should I use a unique domain user for each machine, or should I use just one domain user for all three?

I am inclined towards just creating one user for all three as they are going to have no real permissions on the rest of the network, their permissions will be administered locally on the machines they run the service upon. This will simplify my user config on my active directory, but are there any security concerns with doing this?

Thanks in advance,

-James

(this is related to my other question: What permissions are required for SQL Server to run as a (active directory) domain user)

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

it depends.... if the 3 servers are running different applications & not related in any way, then definitely go a unique domain account for each server. If one server has a higher threat level or risk level of being compromised (different part of the network, more users? exposed to the internet? then maybe you should try to isolate it more by using its own account. If 2 of the servers are used by the same application, then its probably ok to share the account.

The security concern is that if the account is compromised, then all 3 database servers are at risk. D

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.