Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When installing MS SQL Server 2008, one needs to associate a service account with the installation (possibly even several accounts, one for the SQL Server Agent, one for Analysis Services, ..., but let's leave that for the case of simplicity). The service account may be local account, or a Windows domain account.

If a domain account is used: Can MSSQL start, if connectivity to the domain controllers is temporarily down? If the answer is yes:

Should each DBMS instance on each server have a separate account, or does it make sense to use a particular "MSSQL" domain account on all MSSQL-installations in the organization?

If separate accounts are used for each instance on each server: Does it make sense to create a special MSSQL security group in the domain and place all the MSSQL service accounts in that group, perhaps to ease replication, etc?

Is there a common, generally accepted naming convention for MSSQL service account(s)?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

If a domain account is used: Can MSSQL start, if connectivity to the domain controllers is temporarily down?

No, even if you get MSSQL to start it uses authentication more than just when starting. If you are worried about downtime for patching dcs, etc, I would recommend investing in more than a single DC or a more robust AD infrastructure.

Should each DBMS instance on each server have a separate account, or does it make sense to use a particular "MSSQL" domain account on all MSSQL-installations in the organization?

Each server should have its own account. You can go with a single account without issues but keep in mind this limits you in terms of flexibility in distinction between the servers using this account

If separate accounts are used for each instance on each server: Does it make sense to create a special MSSQL security group in the domain and place all the MSSQL service accounts in that group, perhaps to ease replication, etc?

Groups for the accounts is good, I believe when I set it up it wasn't necessary for a group, but wouldn't hurt.

Is there a common, generally accepted naming convention for MSSQL service account(s)?

This should be in alignment with your organizations naming standards. This depends on the size of your org, and sometimes on if you are clustering. Keep in mind only use something like sqlserver or svcsql if you are 100% sure there will not need to be distinction between these. A better idea might be to use the host or cluster name. svcsqlnode1, svcsqlcluster1. These are general examples and always try and align with the standard naming conventions.

share|improve this answer

Can MSSQL start, if connectivity to the domain controllers is temporarily down?

I assume so, just like you can log in to your cached profile when the DC is unavailable.

Should each DBMS instance on each server have a separate account?

That depends, if all the servers have the same security exposure then I would just use one account for easy management. If different databases have different customers/departments/admins or some have sensitive data and some do not I would consider separate users.

Does it make sense to create a special MSSQL security group?

Yes, if you use multiple accounts.

Is there a common, generally accepted naming convention for MSSQL service account(s)?

Even if there is I would suggest creating your own convention for security reasons.

share|improve this answer
2  
If all domain controllers are down, the SQL Service will not start if the account runs as a domain account. Service accounts don't use cached credentials. There's no such thing as a generally accepted naming convention. Every companies is different. –  mrdenny Feb 12 '11 at 3:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.