kerberos SQL service accounts

Hello all

The AD forest and domain are at windows 2003 native mode. The SQL DBA's are being asked to change all SQL service accounts from local system to a domain user account. My question is and if this is not the correct forum for this please politely let me know. Once the SQL service account is changed from local system to a domain user account does SQL start using kerberos authentication? Does the spn for the domain account get registerd in AD automatically? If i have a SQL cluster that has several SQL instance or virtual servers that are running on one of the pyhsical node's in the cluster, what spn gets registered in AD? I would think i would need to regsiter a SPN for the service account that is running on the SQL virtual server or instance and not the physical node?

Example physical node name is irv-idc-ms11 SQL virtual server running on physical node is irv-idc-vs11. Service account name is sqladmin. If i did a query on the service account name (sqladmin) using setspn then if this is correct the output from the command should look like

"MSSQLSvc/irv-idc-vs11"


Last question Delegation. If the SPN's are registered correctly for the service account why must i enable delegation on the service account in AD?

Many thanks for any guidance on this



.

Relevant Pages

  • Re: SPN creation
    ... will i need to create an spn for the live sql server service account in order ... front end website to get Kerb delegation to the backend if your AD is 2003 ... form port-specific SPNs for HTTP, ...
    (microsoft.public.windows.server.active_directory)
  • Re: SPN for SSL over common name
    ... you can't register those SPNs under the SQL Server's ... service account is the MSSQL SPN. ... That SPN should be registered under ... Lastly, since the SQL Server is not being used for delegation anywhere, ...
    (microsoft.public.inetserver.iis.security)
  • Cannot Use Non-Administrator Account to Start SQL Server and Force Encryption
    ... I changed the service account of a named instance (product ... a certificate from a Microsft Certificate Server ... the SQL Service. ... SQL Server could not spawn FRunCM thread. ...
    (microsoft.public.sqlserver.security)
  • Re: kerberos SQL service accounts
    ... Also, on the delegation question, you only need to enable delegation on the SQL service account if SQL will be making a call to a remote system on behalf of a remote user it is impersonating. ...
    (microsoft.public.windows.server.active_directory)
  • Re: kerberos SQL service accounts
    ... You'll get the best match of "Kerberos working by default" and good security by deciding to use Network Service as the service account for SQL rather than either System or a fixed domain account. ... The reason for this is that when SQL is installed and configured to be run under either Network Service or System, the installer will actually add the appropriate Kerb SPNs to the domain computer account. ...
    (microsoft.public.windows.server.active_directory)
Quantcast