Securing Subscribers
Merge Agents and Distribution Agents connect to the Subscriber. These connections can be made under the context of a SQL Server login or a Windows login. It is important to provide an appropriate login for these agents while following the principle of granting the minimal rights necessary and also protecting the storage of all passwords. For information about managing logins and passwords, see Managing Logins and Passwords in Replication. For information about the permissions required for each agent, see Replication Agent Security Model.
In addition to the general considerations for subscriptions, there are a number of considerations for updating subscriptions for transactional replication. For more information, see Security Considerations for Updating Subscriptions.