Forum Discussion
Oliver_Hoechli
May 16, 2024Copper Contributor
Group Managed Service Accounts for SQL Services -> Best Practices Microsoft
Hello everyone
I would like to address the SQL community with the following question:
We use Group Managed Service Accounts for all SQL services on our new SQL server.
I have now been told by a software supplier that Microsoft recommends either leaving the predefined SQL service accounts for the services or using a service account (AD user) with user name and password and not Group Managed Service Accounts.
Is this correct? Should I not use Group Managed Service Accounts for the SQL services? What is official best practice from Microsoft?
My thought for using Group Managed Service Accounts is from a security perspective.
Thanks for your support
Greetings
Oliver
Another mockup with lambdas
prefix = {"No", "No:"}; removeFirst = lambda(str, txt, SUBSTITUTE(str, txt, "",1) ); //// noPrefix = lambda(str, k, IF(k=0, TRIM(str), LET(t, removeFirst(str, INDEX(prefix,1,k)), noPrefix(t, k-1) ) )); cleanText = lambda(str, noPrefix(str, COLUMNS(prefix))); nFirstSpace = lambda( str, FIND(" ", str)-1); textStart = lambda(str, n, TRIM(LEFT(str, n))); textEnd = lambda(str, n, TRIM(RIGHT(str, LEN(str)-n))); lastPos = lambda(str, chr, n, IF(RIGHT(str)=chr, n, lastPos(LEFT(str, n-1), chr, n-1))); posRightSpace = lambda(str, lastPos(str, " ", LEN(str))); //// splitParts = lambda( str, LET( txt, cleanText(str), nA, nFirstSpace(txt), partA, textStart(txt, nA), partBC, textEnd(txt, nA), first40, textStart(partBC, 40), space40, posRightSpace(first40), partB, IF(LEN(partBC)<=40, partBC, textStart(partBC, space40) ), partC, IF(LEN(partBC)<=40, "", textEnd(partBC, space40) ), IFERROR(CHOOSE({1,2,3}, partA, partB, partC),"") ) );
4 Replies
Sort By
- olafhelperBronze Contributor
Oliver_Hoechli , sure you can use gMSA for SQL Server, see
Configure Windows service accounts and permissions - SQL Server | Microsoft Learn
=> Group-managed service accounts
- Oliver_HoechliCopper Contributor
Hello Olaf
Thank you very much for your quick reply. What I am still interested in is whether Microsoft has a recommended preference regarding the account for the SQL services? My software vendor explicitly states that the Microsoft recommendation is either a username and password account or the predefined SQL service account that is displayed during installation and that the Group Managed Service Accounts is not best practice?
Greetings
Oliver- olafhelperBronze ContributorThen your vendor should send you a link for that MS recommendation.
gMSA support was first introduced in SQL Server 2014; I can't imagine MS added that feature just for fun.