Configure Service Accounts for
all SQL Server services.
Microsoft recommends creating individual accounts for all
services. If you use the same service account for every server, then when
somebody repeatedly mistypes the service account password during an
installation, you can lock out the service account, causing widespread havoc.
Do not make the service
account a local administrator. As a best practices SQL Server service should be
using a minimally privileged account. We should always avoid running SQL Server
services under the contexts of the local system, local administrator or domain
administrator accounts.
If you're installing multiple components, the
recommendation is to use separate accounts. Example you have two services to be
concerned with: the main SQL Server service and the SQL Server Agent service.
Even in this case it's recommended to use separate accounts.
We need to make sure that the SQL Server service account
has “full control” permissions on data, log and backup directories for read and
write activities so need to grant the ‘Perform Volume Maintenance Tasks’ right
to the account that will be used for the SQL Server service.
We need to use SQL Server Configuration manager to do any modifications
for SQL Services. Account change and Password change both should be done only
via configuration manager not services.msc. If we update/change service account details through
SQL Server configuration manager, it will perform additional configurations,
such as updating the Windows local
security store which protects the service master key for the Database Engine
etc.
Windows Domain Account Permissions
SQL DATABASE Engine Service account should have below permissions
·
Log on as a serive
permissions
·
Replace a process-level token
·
Bypass traverse checking
·
Permission to start SQL Writer
·
Permission to read the Event Log service
·
Permission to read the Remote Procedure Call
service
SQL AGENT Service account should have below permissions
·
Log on as a serive
permissions
·
Replace a process-level token
·
Bypass traverse checking
·
Adjust memory quotas for a process
