A group managed service account (gMSA) is a Windows-managed identity for services. It provides automatic password rotation, simplified service principal name management, highly complex passwords stored in Active Directory, and noninteractive use. section 14.3
Mistake 1: choosing one service account for too much of the SQL Server estate.
- A coarse-grain strategy may appear easier to coordinate, but compromising one account can expose every instance and feature it manages. section 14.3
- Password rotation commonly fails when many applications depend on the same traditional account, leaving a long-lived credential in place. section 14.3
- Use gMSAs instead: they support broader account grouping without exposing the organization to the same increased security risk. section 14.3
A safer SQL Server arrangement
An organization can begin by segregating gMSAs by ecosystem and business division rather than assigning one traditional service account across its entire SQL Server estate. An Active Directory administrator creates the gMSA, then an authorization script runs on the SQL Server host so that server can use it. section 14.3
Because gMSA passwords are never exposed to administrators and the accounts cannot be used interactively, they are the preferred replacement for traditional SQL Server service accounts. section 14.3 section 14.8
