1

Our current SQL Server service is running under Local System account. To backup to a network/mapped drive I'm thinking of running it under a domain administrator account. Would such account change break something with SQL Server?

Improve this question
1
  • Unless absolutely unavoidable, NOTHING should run under a domain admin account.
    – John Gardeniers
    Sep 27, 2010 at 23:13

3 Answers 3

Reset to default
-1

It wouldn't break anything with SQL Server (how could it? it's only getting more permissions). But it's a pretty foolish thing to do from a security standpoint. You will effectively be making it more likely for your domain admin account to be compromised. Instead of only being affected by Active Directory exploites, it's now affected by SQL Server exploits as well.

The proper thing to do is to create a standalone user account in AD to run the service as. Then, give it only the permissions it needs to run properly.

Improve this answer
3
  • Giving it local admin on the box is also not necessary and discouraged. Read the MS doc linked in my answer...... "When choosing service accounts, consider the principle of least privilege. The service account should have exactly the privileges that it needs to do its job and no more privileges." It doesn't need local admin.
    – ThatGraemeGuy
    Sep 29, 2010 at 15:41
  • I knew someone would call me out on that eventually. Answer edited. You have to admit though, it is better than giving domain admin rights.
    – Ryan Bolger
    Sep 29, 2010 at 19:26
  • And particularly on older versions of SQL Server, it was much harder to setup a limited service account than it is today.
    – Ryan Bolger
    Sep 29, 2010 at 19:28
7

It won't break anything, but it's also completely unnecessary and actually discouraged by Microsoft. Domain Admin gives your SQL service far too many rights it just doesn't need.

The way this is usually done is: - create a dedicated domain user account for each SQL service to use. This should be a normal user account, don't add it to Domain Admins or any special group. - use SQL Server Configuration Manager to change the service accounts used by each service.

When you've done this, you can grant rights to the specific SQL domain user account to the UNC share where you want SQL to write files. I'm a bit rusty with SQL so I'm not sure exactly which service is involved, I'm sure someone else will help out with that... :-)

I'd recommend you read Microsoft's SQL Server 2005 Security Best Practices document as well.

Improve this answer
0

In the SQL 2000 world you had to use a domain account if you wanted your SQL Agent jobs to be able to email since MAPI (SQL Mail) needed it.

With Database Mail (SMTP) in SQL 2005 and beyond, the domain account isn't needed.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .