domain account vs local account for SQLServerAgent

[Dave C.]

Hi there,

BOL notes that in order for replication agents to run properly, the
SQLServerAgent must run as a domain account which has privledges to log
into the other machines involved in replication (under "Security
Considerations" and elsewhere). This makes sense; however, I was
wondering if there were any repercussions to using duplicate local
accounts to establish replication where a domain was not available.
Anotherwords, create a local windows account "johndoe" on both machines
(with the same password), grant that account access to SQL Server on
both machines, and then have SQL Server Agent run as "johndoe" on both
machines. I do not feel this is an ideal solution but I have
circumstances under which I may not have a domain available; my
preliminary tests seem to work.

Also, are there any similar considerations regarding the MSSQLSERVER
service, or can I always leave that as local system?

Dave

[Simon Hayes]

"Dave C." <me***@rules.spam> wrote in message news:<Pi**************************************@ccr ma-gate.stanford.edu>...

Hi there,

BOL notes that in order for replication agents to run properly, the
SQLServerAgent must run as a domain account which has privledges to log
into the other machines involved in replication (under "Security
Considerations" and elsewhere). This makes sense; however, I was
wondering if there were any repercussions to using duplicate local
accounts to establish replication where a domain was not available.
Anotherwords, create a local windows account "johndoe" on both machines
(with the same password), grant that account access to SQL Server on
both machines, and then have SQL Server Agent run as "johndoe" on both
machines. I do not feel this is an ideal solution but I have
circumstances under which I may not have a domain available; my
preliminary tests seem to work.

Also, are there any similar considerations regarding the MSSQLSERVER
service, or can I always leave that as local system?

Dave

See "Setting up Windows Services Accounts" in BOL. There are a number
of things that can only be done with a domain account; in addition,
LocalSystem is a highly privileged account, so for both functionality
and security reasons, using a domain account is usually a good idea.

I'm not sure about using multiple local accounts if no domain is
available. I would guess that it would work, but password management
and synchronization could be awkward.

Simon