SQL Server and Failover Cluster service account minimum roles best practice?

Question

SQL Server and Failover Cluster service account minimum roles best practice?

EnterpriseArchitect 6,301

Can you please explain and help me why the Service account for SQL Server and the Cluster Failover service account Primary group are set to Domain Admins rather than Domain Users?

Domain-Admins

Is this really required for SQL Server and SQL Servers running on MSCS Failover Cluster?

Please provide some documentation to explain whether this is the required privilege for the service account.

If there is recommended practice to follow for a minimum privilege role for the SQL Server and Failover cluster (MSCS) service account, that'd be greatly appreciated.

Robbie Varn 351 Reputation points

2023-07-26T14:38:24.4933333+00:00

For installing the Cluster on a windows level and for installing Sql Server, the account you use should be a Domain Admin as a one time thing for the installations. You set the account to run Sql Server as part of the installation. When Sql Server is installed, the installation grants all the permissions the Sql Server Service account you specify will need to properly function. I looked for a quick article to post for you but I cannot find one current at the moment.
EnterpriseArchitect 6,301 Reputation points

2023-07-26T14:51:49.2133333+00:00

Hi @Robbie Varn ,
Thank you for the response, yeah, I thought so, I am still searching for the documentation as well to make sure that I am able to demote the service account safely as the Cluster and the SQL server is now running in production.

Your answer

Robbie Varn 351 Reputation points

2023-07-26T14:38:24.4933333+00:00

For installing the Cluster on a windows level and for installing Sql Server, the account you use should be a Domain Admin as a one time thing for the installations. You set the account to run Sql Server as part of the installation. When Sql Server is installed, the installation grants all the permissions the Sql Server Service account you specify will need to properly function. I looked for a quick article to post for you but I cannot find one current at the moment.
EnterpriseArchitect 6,301 Reputation points

2023-07-26T14:51:49.2133333+00:00

Hi @Robbie Varn ,
Thank you for the response, yeah, I thought so, I am still searching for the documentation as well to make sure that I am able to demote the service account safely as the Cluster and the SQL server is now running in production.

Share via

SQL Server and Failover Cluster service account minimum roles best practice?

Your answer