Recommended settings for 2-tier server environment

Question

I'm trying to setup a 2-tier server environment in Windows Server 2008, which I'm finding is a little different from XP or Server 2003. The web tier is using IIS and ASP.NET 3.5 and the database tier is using SQL Server 2008. The only services that I'm using there is the database engine, Integration services, and Reporting services.

What user account should the various Windows services be running as? Are there any other settings that I should be aware of when setting this up?

Answer 1

Applications should always run at the lowest possible security level.

• Microsoft's Best Practices and Requirements for account permissions for SQL Server 2008.

• Microsoft's Best Practices for ASP.net 2.0

• Microsoft's Developer Highway checklist

Additionally -- when you install your application on top of ASP.net and SQL Server, do not use the SA, or Administrator accounts. Your application should have its own restricted login and restricted SQL user.

Answer 2

I've got a SQL Server setup checklist that covers a lot of best practices to get more security & performance out of your install:

http://www.brentozar.com/archive/2008/03/sql-server-2005-setup-checklist-part-1-before-the-install/

It's good for any version of Windows, and for SQL Server 2005 and newer.