Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The installation documentation says best practice is to create a minimum-privilege account for the SQL Engine service to run as.

What is the recommended practice on Windows to create such an account... what groups should the account be a member of (and not a member of)? What other account privileges should be dropped?

share|improve this question

3 Answers 3

Create a new account with no special rights. Use either the SQL Server installer to assign the account to a new instance, or use the SQL Server Configuration Manager to change the account that the service uses. The config manager will set the rights for the account correctly by it self.

share|improve this answer

I don't know if this is best practices or not, but I just created a new group called SQL Servers, made sure that my SQL accounts only belonged to that group (not even Domain Users), and then just never gave that group any rights or permissions anywhere except to network shares that the SQL accounts need to access (log shipping, backups, etc).

Seems to have been quite successful to date, I haven't had any issues with it.

share|improve this answer

There is a Microsoft SQL article listing all necessary privileges.

http://msdn.microsoft.com/en-us/library/ms143504.aspx

share|improve this answer
    
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Scott Pack Nov 4 '12 at 1:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.