Discussion Locked

Service Passwords

0 helpful
6 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I had a server delivered all set up and it had some services depend on the Administrator account and some depend on the System account. What are the resoning for this? Can I just have all of my server service's start with the system account?

6 replies

by bchesmer

Can you be specific about what svcs you are concerned about that are useing the admin account? (When you login as admin, many svcs are started just because of this). If you can provide a short list, I'd be happy to help you out.

by banyanman

No, you can't have all services started with the system account. For example due to the way SMS interacts with machines and the domain, the SMS executive starts with a domain ID which is a member of the domain admins security group. What I would suggest you do is to create separate user accounts for each service that starts using the administrator account and switch the logon information over to the newly created accounts. For grouped services such as SMS_Executive and SMS_SITE__COMPONENT_MANAGER, I would use the same account for all like services. Name the accounts after the service so they are more easily recognized and possibly the same password for all the accounts so that administration is not a nightmare. When faced with serviceaccounts I choose to make the password never expire to prevent a service outage and for security I change the password afterhours and reconfigure the services if I feel the account has been compromised. Hope this is the info you are looking for.

This discussion is closed to new replies.