up vote 1 down vote favorite
1
share [g+] share [fb]

Our current SQL Server service is running under Local System account. To backup to a network/mapped drive I'm thinking of running it under a domain administrator account. Would such account change break something with SQL Server?

link|improve this question
Unless absolutely unavoidable, NOTHING should run under a domain admin account. – John Gardeniers Sep 27 '10 at 23:13
feedback

3 Answers

up vote -1 down vote accepted

It wouldn't break anything with SQL Server (how could it? it's only getting more permissions). But it's a pretty foolish thing to do from a security standpoint. You will effectively be making it more likely for your domain admin account to be compromised. Instead of only being affected by Active Directory exploites, it's now affected by SQL Server exploits as well.

The proper thing to do is to create a standalone user account in AD to run the service as. Then, give it only the permissions it needs to run properly.

link|improve this answer
Giving it local admin on the box is also not necessary and discouraged. Read the MS doc linked in my answer...... "When choosing service accounts, consider the principle of least privilege. The service account should have exactly the privileges that it needs to do its job and no more privileges." It doesn't need local admin. – Graeme Donaldson Sep 29 '10 at 15:41
I knew someone would call me out on that eventually. Answer edited. You have to admit though, it is better than giving domain admin rights. – Ryan Bolger Sep 29 '10 at 19:26
And particularly on older versions of SQL Server, it was much harder to setup a limited service account than it is today. – Ryan Bolger Sep 29 '10 at 19:28
feedback
up vote 6 down vote

It won't break anything, but it's also completely unnecessary and actually discouraged by Microsoft. Domain Admin gives your SQL service far too many rights it just doesn't need.

The way this is usually done is: - create a dedicated domain user account for each SQL service to use. This should be a normal user account, don't add it to Domain Admins or any special group. - use SQL Server Configuration Manager to change the service accounts used by each service.

When you've done this, you can grant rights to the specific SQL domain user account to the UNC share where you want SQL to write files. I'm a bit rusty with SQL so I'm not sure exactly which service is involved, I'm sure someone else will help out with that... :-)

I'd recommend you read Microsoft's SQL Server 2005 Security Best Practices document as well.

link|improve this answer
feedback
up vote 0 down vote

In the SQL 2000 world you had to use a domain account if you wanted your SQL Agent jobs to be able to email since MAPI (SQL Mail) needed it.

With Database Mail (SMTP) in SQL 2005 and beyond, the domain account isn't needed.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.