Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In a Windows environment how do you address the following issues with service accounts?

  1. Regular Password changes - with single service accounts used on multiple machines how do you regularly change passwords without significant outage periods? Do you tend just to never change them?
  2. Keeping track of passwords - by necessity multiple people need to know these, how do you record the passwords whilst keeping them reasonably secret?
  3. To what point do you use the same account across multiple machines / services? How do you track what account is being used where? Any tools to help with this?
  4. Has anyone found any good resources for appropriate minimum permission settings for common service account requirements for applications such as SQL Server, Sharepoint etc.
share|improve this question

closed as off-topic by Sven Sep 17 '15 at 13:22

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

I guess point 4 is a little off topic. My main concern is point 1. I can't see how you can change the passwords without having an outage. – Joel Mansford Jun 23 '09 at 8:16
Even if point 4 is off topic, I'd still love to follow that thread. I found this question while looking for how to prevent interactive logins with a service account. I thought there was a GPO setting, but I haven't found it yet. – Nathan Hartley Sep 18 '09 at 20:50
up vote 3 down vote accepted

Many of our customers use Secret Server to manage their service accounts.

It can automatically discover where your service accounts are used (will scan your network for usages) and then these Windows Services can be added as a "dependency" for the credential. An expiration schedule can be set (say every 30 days) and then it will automatically generate a new random password for the AD service account and change all the places it used (even stopping and restarting the Windows Services). Secret Server also supports IIS Application Pool users and Windows Scheduled Tasks as "dependencies".

Get a free 30 day trial here:

share|improve this answer

Switching to Server 2008 R2 all around ^^ (ok, maybe not - but thought I should mention the Managed Service Account and Virtual Account features of it that promises to resolve this mess)

share|improve this answer
Thanks for that, I hadn't noticed that in the features list of R2. I'm a big Server 2008 (R1) fan. I was a little disappointed with the stability and performance of 2008 R2 beta compared with Win7 RC - let's hope it's good when they release it – Joel Mansford Jun 28 '09 at 21:27


We use a third party application to manage the rotation of passwords for service accounts. The app tracks the passwords, creates new ones, and offers a vault so that you can access the passwords if and when necessary.

We try to reuse service accounts when possible and as part of the account creation process we have a form that people need to complete. when the form is submitted it is saved and the account that was created gets saved with the form. that way, if we need to know who uses the account, or why it was created, we can research. we also make certain the manager field in AD is filled in correctly and managers are assigned the task of know what service accounts they are responsible for.

MSDN would have a wealth of information regarding the minimum permissions required for common service account settings. As always, how you configure those settings depends upon the needs of your environment.

share|improve this answer
Any idea what third party tool you use for this? – Joel Mansford Jun 22 '09 at 14:06
sure, – SQLRockstar Jun 22 '09 at 17:28

i would recommend passgen.exe Download Info Here Just go through its accompanying document. It gives precise scenario of changing password on multiple computers and how easy it is to keep them unique and complex.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.