1

When installing MS SQL Server 2008, one needs to associate a service account with the installation (possibly even several accounts, one for the SQL Server Agent, one for Analysis Services, ..., but let's leave that for the case of simplicity). The service account may be local account, or a Windows domain account.

If a domain account is used: Can MSSQL start, if connectivity to the domain controllers is temporarily down? If the answer is yes:

Should each DBMS instance on each server have a separate account, or does it make sense to use a particular "MSSQL" domain account on all MSSQL-installations in the organization?

If separate accounts are used for each instance on each server: Does it make sense to create a special MSSQL security group in the domain and place all the MSSQL service accounts in that group, perhaps to ease replication, etc?

Is there a common, generally accepted naming convention for MSSQL service account(s)?

Improve this question

2 Answers 2

Reset to default
2

If a domain account is used: Can MSSQL start, if connectivity to the domain controllers is temporarily down?

No, even if you get MSSQL to start it uses authentication more than just when starting. If you are worried about downtime for patching dcs, etc, I would recommend investing in more than a single DC or a more robust AD infrastructure.

Should each DBMS instance on each server have a separate account, or does it make sense to use a particular "MSSQL" domain account on all MSSQL-installations in the organization?

Each server should have its own account. You can go with a single account without issues but keep in mind this limits you in terms of flexibility in distinction between the servers using this account

If separate accounts are used for each instance on each server: Does it make sense to create a special MSSQL security group in the domain and place all the MSSQL service accounts in that group, perhaps to ease replication, etc?

Groups for the accounts is good, I believe when I set it up it wasn't necessary for a group, but wouldn't hurt.

Is there a common, generally accepted naming convention for MSSQL service account(s)?

This should be in alignment with your organizations naming standards. This depends on the size of your org, and sometimes on if you are clustering. Keep in mind only use something like sqlserver or svcsql if you are 100% sure there will not need to be distinction between these. A better idea might be to use the host or cluster name. svcsqlnode1, svcsqlcluster1. These are general examples and always try and align with the standard naming conventions.

Improve this answer
2

Can MSSQL start, if connectivity to the domain controllers is temporarily down?

I assume so, just like you can log in to your cached profile when the DC is unavailable.

Should each DBMS instance on each server have a separate account?

That depends, if all the servers have the same security exposure then I would just use one account for easy management. If different databases have different customers/departments/admins or some have sensitive data and some do not I would consider separate users.

Does it make sense to create a special MSSQL security group?

Yes, if you use multiple accounts.

Is there a common, generally accepted naming convention for MSSQL service account(s)?

Even if there is I would suggest creating your own convention for security reasons.

Improve this answer
1
  • 2
    If all domain controllers are down, the SQL Service will not start if the account runs as a domain account. Service accounts don't use cached credentials. There's no such thing as a generally accepted naming convention. Every companies is different.
    – mrdenny
    Feb 12, 2011 at 3:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .