Hi All,
We have a sql server serving for BizTalk in our staging environment
running under "Local System" account. To make the account privilege identical
to production environment, I'd like to change it to a domain account. I
wonder if there'd be any risks for doing that.
Please advise.
Linda
Rick Sawtell - 07 Jul 2008 16:40 GMT
> Hi All,
>
[quoted text clipped - 7 lines]
>
> Linda
Domain Accounts are generally preferred over the Local Service for a variety
of reasons.
Ensure that the Domain Account that you choose however only has the security
levels it needs to perform its duties. You will also need to ensure that
the domain account has log on as a service right. For example, a Domain
Admin account is not a good choice. A domain account that is a local admin
on that server however may be a better choice.
There are a host of other security concerns. Check the BOL on that.
Rick Sawtell
Linchi Shea - 07 Jul 2008 18:11 GMT
Local System account has extensive privileges on the computer. So if may want
to assign the same privileges to the domain account on that computer. See
http://msdn.microsoft.com/en-us/library/ms684190(VS.85).aspx for the list of
privileges. Personally, if the privileges of the Local System account are
required when a domain account is used, I'd simply put that domain account in
the local admin group. This may raise some eyebrows from a security point of
view, but can simplify support--a trade off I'd make and you may want to
consider.
Linchi
> Hi All,
>
[quoted text clipped - 6 lines]
>
> Linda
Ekrem Önsoy - 07 Jul 2008 18:33 GMT
Ensure that Domain Account does not expire and disable and locked. Otherwise
your SQL Server may stop one day unexpectedly...

Signature
Ekrem Önsoy
> Hi All,
>
[quoted text clipped - 7 lines]
>
> Linda
lindaBztk - 07 Jul 2008 22:06 GMT
Thanks all, very helpful.
Linda