Seeking official written response on managing NT Service\MSSQLSERVER and NT Service\MSSQL$MSSQL2016 service account password

Question

Hi,

Need your assistance, I am working with a client whom password policy, strongly required an official explanation on why users are ill advice/cannot self manage this NT Service\MSSQLSERVER and NT Service\MSSQL$MSSQL2016 account.

Answer 1

Hi @Ryan Wong ,

NT Service\MSSQLSERVER and NT Service\MSSQL$MSSQL2016 are virtual accounts automatically created during SQL server installation.

Quote from MS document Virtual accounts. 

Virtual accounts (beginning with Windows Server 2008 R2 and Windows 7) are managed local accounts that provide the following features to simplify service administration. The virtual account is auto-managed, and the virtual account can access the network in a domain environment. If the default value is used for the service accounts during SQL Server setup, a virtual account using the instance name as the service name is used, in the format NT SERVICE<SERVICENAME>. Services that run as virtual accounts access network resources by using the credentials of the computer account in the format <domain_name><computer_name>$. When specifying a virtual account to start SQL Server, leave the password blank.

 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it.

Answer 2

Your post is not very clear for me.

When you install SQL Server and you don't define an existing local/AD account for the services, then those service account are create and used.

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-service-accounts

Answer 3

Here is an old blog post that explains Managed Service Accounts: https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/managed-service-accounts-understanding-implementing-best/ba-p/397009