Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In a Windows environment how do you address the following issues with service accounts?

  1. Regular Password changes - with single service accounts used on multiple machines how do you regularly change passwords without significant outage periods? Do you tend just to never change them?
  2. Keeping track of passwords - by necessity multiple people need to know these, how do you record the passwords whilst keeping them reasonably secret?
  3. To what point do you use the same account across multiple machines / services? How do you track what account is being used where? Any tools to help with this?
  4. Has anyone found any good resources for appropriate minimum permission settings for common service account requirements for applications such as SQL Server, Sharepoint etc.
share|improve this question
    
I guess point 4 is a little off topic. My main concern is point 1. I can't see how you can change the passwords without having an outage. –  Joel Mansford Jun 23 '09 at 8:16
    
Even if point 4 is off topic, I'd still love to follow that thread. I found this question while looking for how to prevent interactive logins with a service account. I thought there was a GPO setting, but I haven't found it yet. –  Nathan Hartley Sep 18 '09 at 20:50
add comment

4 Answers 4

up vote 3 down vote accepted

Many of our customers use Secret Server to manage their service accounts.

It can automatically discover where your service accounts are used (will scan your network for usages) and then these Windows Services can be added as a "dependency" for the credential. An expiration schedule can be set (say every 30 days) and then it will automatically generate a new random password for the AD service account and change all the places it used (even stopping and restarting the Windows Services). Secret Server also supports IIS Application Pool users and Windows Scheduled Tasks as "dependencies".

Get a free 30 day trial here: http://www.thycotic.com

share|improve this answer
add comment

Switching to Server 2008 R2 all around ^^ (ok, maybe not - but thought I should mention the Managed Service Account and Virtual Account features of it that promises to resolve this mess)

share|improve this answer
    
Thanks for that, I hadn't noticed that in the features list of R2. I'm a big Server 2008 (R1) fan. I was a little disappointed with the stability and performance of 2008 R2 beta compared with Win7 RC - let's hope it's good when they release it –  Joel Mansford Jun 28 '09 at 21:27
add comment

Joel,

We use a third party application to manage the rotation of passwords for service accounts. The app tracks the passwords, creates new ones, and offers a vault so that you can access the passwords if and when necessary.

We try to reuse service accounts when possible and as part of the account creation process we have a form that people need to complete. when the form is submitted it is saved and the account that was created gets saved with the form. that way, if we need to know who uses the account, or why it was created, we can research. we also make certain the manager field in AD is filled in correctly and managers are assigned the task of know what service accounts they are responsible for.

MSDN would have a wealth of information regarding the minimum permissions required for common service account settings. As always, how you configure those settings depends upon the needs of your environment.

share|improve this answer
    
Any idea what third party tool you use for this? –  Joel Mansford Jun 22 '09 at 14:06
    
sure, cyber-ark.com –  SQLRockstar Jun 22 '09 at 17:28
add comment

i would recommend passgen.exe Download Info Here Just go through its accompanying document. It gives precise scenario of changing password on multiple computers and how easy it is to keep them unique and complex.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.