0

I come from a unix background and is trying to managed some Window Servers right now.

I cannot grasp the concept of the different service accounts available and what they are used for.

During the installation of SQL server, there are certain services that allow us to choose what service account to logon as.

What is the relationship between a service account and a service ?

How can we be sure that a particular service can run under a service account ? Can some guru shed some introductory and point me to the right direction to read.

1
  • 1
    This is such a broad topic, that I honestly believe you'd be much better off if you went and got Windows Internals, 6th Edition by Mark Russinovich, et al. If you are truly interested in learning about the platform.
    – Ryan Ries
    Feb 26 '16 at 14:53
3

Every process that runs on a Windows computer needs to be run under some kind of credentials. Put more simply, every process needs to be "logged on" with some account in order to run. I assumed/thought this was true of Unix/Linux processes also.

Anyway, since services represent processes, every service has to "log on" in order to be able to run. Whatever access rights and permissions apply to the account being used by a service also apply to the service as it runs.

If you open up the list of services (in Computer Management or the Services snap-in), you will see the "Log On As" column in the list of services. Most services either log on as "Local System" or "Network Service". Neither of those objects are appropriate for certain application services like SQL Server services, but the SQL Server services still must log on as some account.

That is all a service account is. It's an account used by a service that is not using the Local System or Network Service accounts. It can either be a local account or a domain account, as needed and/or appropriate. In order for services to function correctly, service accounts must be granted certain rights and permissions. If you create service accounts when installing applications that request them, they usually grant the appropriate rights and permissions when the accounts are created. Tracking down and granting the rights and permissions manually can be tedious. It's good to plan service accounts before you install applications that need them.

You may often be tempted to use an administrator account for a service account, since usually they already have the necessary rights and permissions. There are practical reasons and security reasons not to do this, which I won't go into here, but don't do it. It's also best for each application to have its own service account, rather than for all applications to use a single service account. There are many other considerations, but that should be enought to get you started.

8
  • 1
    Addl. Info: A service running under NT Authority\Local Service can not communicate with the network resources unless it has some internal way to use alternate credentials. OTOH, that is exactly what Network Service is used for - a less-than-administrator/System user to run services. SQL, though needs SYSTEM or a real user account assigned appropriate permissions. Btw, SYSTEM and Network Service will authenticate to network resources as the computer's domain computer account. MS's TechNet SQL docs have a section covering how to handle "Log On As".
    – user339468
    Feb 27 '16 at 1:49
  • @Todd Wilcox - yeap, in unix/linux, services/process to run under certain users and uses the user's privilege/resource/profile. Back to the topic, does it means that if i specify a local account as "Log On As" for the particular service, I would have to logon as that user in order to start the service ?
    – tiongmaru
    Feb 28 '16 at 13:20
  • @tiongmaru No, you can configure a service to use an account that you have not logged on with and when you ask the service to start, it the system will authenticate the service's process with the credentials you have provided and it will ignore any other credentials. Only the configured credentials are used. If the credentials configured for the service are incorrect or do not have the appropriate rights, the service will fail to start and an event log entry will be added indicating the failure of the credentials. If the start request was made interactively, a message will also pop up. Feb 28 '16 at 15:55
  • @ToddWilcox thanks. - so it means that i do not really need to "physically" logon as that account in order to start the service, the "logon credentials" are specified and stored during the installation and will be use automatically when starting the service - right ?
    – tiongmaru
    Feb 28 '16 at 16:02
  • @tiongmaru Yes, if you actually look at the list of services on any windows server you'll see the credentials used by each service right there. You can change the credentials at any time by going into that list and changing the service properties, but that might create problems in some situations. I recommend documenting the service accounts you use in a secure location in case you need that information for re-building servers or other situations. Feb 28 '16 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.