domain account vs local account for services

What is the general rule with services that require elevated rights? should i make specilized domain accounts or should i create a local account and use that?

I feel like i should create a domain account so i can control the account from a centralized location, in case if i have to change teh password incase the account is compromized for some reasonl. I could be wrong in my thinking.

thank you,

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

RTmarc

Domain Account should be used in nearly every situation unless you just absolutely can't do so. There are a laundry list of reasons not to use local; many of which are security related.

I typically use a random password generator and stored the password in a 256bit AES encrypted file.

datchcha

RTmarc wrote:

Domain Account should be used in nearly every situation unless you just absolutely can't do so. There are a laundry list of reasons not to use local; many of which are security related.

I typically use a random password generator and stored the password in a 256bit AES encrypted file.

thanks...so i was thinking in the right direction.

royal

One thing to keep in mind is that some services will utilize Kerberos and if you use a Domain Services account, you "may" need to register your SPN correctly. The reason is if a services account does not have administrator privileges, it won't register its SPN. Take for instance, SQL. If you use a domain services account that is not a domain admin, you'll have to register the SPN on the user account to use MSSSQLSVR on port 1433 to allow for remote authentication. If the services account is a domain admin (don't do this!!!!), you won't have to manually register the SPN.

datchcha

royal wrote:

One thing to keep in mind is that some services will utilize Kerberos and if you use a Domain Services account, you "may" need to register your SPN correctly. The reason is if a services account does not have administrator privileges, it won't register its SPN. Take for instance, SQL. If you use a domain services account that is not a domain admin, you'll have to register the SPN on the user account to use MSSSQLSVR on port 1433 to allow for remote authentication. If the services account is a domain admin (don't do this!!!!), you won't have to manually register the SPN.

I totally forgot about that - i do remember reading something along these lines. Thank you for bringing that up. I a network engineer, which has been forced to do system administration...

thanks again.