Service Accounts on SQL Server

Issue

All services log on under an account, with some services running as LocalSystem. This can be a potential security vulnerability because a bug in the service code could be exploited by a malicious user to gain system-level access, which is possible because the service runs in the context of the local computer. It is recommended that you run services that do not require full system access under a lesser-privileged account, and that this account is not a member of the Local Administrators group.

Solution

Ensure that the SQL service accounts are not running as LocalSystem and are not running under accounts that are a member of the Local or Domain Administrators group. It is recommended that you run these service accounts under a domain user account. Windows XP introduces two new service accounts: LocalService and NetworkService. Services running under the LocalService account have minimum privileges on the local computer, and they present anonymous credentials on the network. Services running under the NetworkService account have minimum privileges on the local computer, and they act as the computer on the network. For more information, see Additional Resources.

Instructions

To ensure that services are not running as Local System Accounts in Windows 2000

  1. Click Start, point to Settings, and then click Control Panel.
  2. Double-click Administrative Tools, and then double-click Computer Management.
  3. Under the Services and Applications node, click Services.
  4. Double-click the service that was flagged in the security report.
  5. In the dialog box that appears, click the Log On tab.
  6. Under Log On As, select the This account radio button and specify a local account under which the service should run.

To ensure that services are not running as Local System Accounts in Windows NT 4.0

  1. Click Start, point to Settings, and then click Control Panel.
  2. Click Services.
  3. Double-click the service that was flagged in the security report.
  4. Under Log On As in the dialog box that appears, select the This account radio button and specify a local account under which the service should run.

Important:  Changing the service account for any SQL Server services outside of SQL Enterprise Manager could cause SQL to stop functioning.

To create a new Domain User account under which the SQL services will run

  1. Click Start, Programs, Administrator Tools, and then click on Active Directory Users and Computers.

  2. Click the Users container and create a new domain user account.

  3. Set the password to never expire.

  4. Choose to create a mailbox if you are planning on using SQL mail.

To change the service account for the MSSQLServer Service

  1. Click Start, Programs, Microsoft SQL Server, and then click on Enterprise Manager.

  2. In SQL Server Enterprise Manager, double-click SQL Server Group, then right-click the SQL Server that you want to secure and click Properties.

  3. Click on the Security tab, and in the "startup service account" section, select "this account" and enter the login information for the domain user created in the previous step.

To change the service account for the SQL Server Agent Service

  1. Click Start, Programs, Microsoft SQL Server, and then click on Enterprise Manager.

  2. In SQL Server Enterprise Manager, double-click SQL Server Group, then double-click on the SQL Server that you want to configure.

  3. Click the Management folder, right-click SQL Server Agent, and then click Properties.

  4. In the "startup service account" section, select "this account" and enter the login information for the domain user created in the previous step.

Additional Resources

SQL Server 7.0 Security

Microsoft SQL Server 2000 Security

LocalService Account

NetworkService Account

⌐ 2002 Microsoft Corporation. All rights reserved.