MSSQL Install

"Always run SQL Server services by using the lowest possible user rights. Use a MSA, gMSA or virtual account when possible. When MSA, gMSA and virtual accounts aren't possible, use a specific low-privilege user account or domain account instead of a shared account for SQL Server services. Use separate accounts for different SQL Server services. Don't grant additional permissions to the SQL Server service account or the service groups. Permissions are granted through group membership or granted directly to a service SID, where a service SID is supported." (4)

"When resources external to the SQL Server computer are needed, Microsoft recommends using a managed service account (MSA), configured with the minimum privileges necessary." (2)"Resources external to the SQL Server" would be things like INSERT BULK loading from a file location on a different computer (3)

Virtual Account

MSA

gMSA

Low Privilege Domain Account

MSSQL Service Account

The MSSQL Service Account name should own the MS-SQL Service
The service account (in case of a local or AD account) and service SID should not be members of the Windows Administrators group.

SQL2008

(TODO Needs additional info)

New-ADUser -Name "SQL01_SVC" -Enabled $True -AccountPassword (ConvertTo-SecureString -AsPlainText "InitialPassword!!!" -Force)

SQL2012

(TODO Needs additional info)

New-ADServiceAccount -Name "SQL01_SVC" -DNSHostName "SQL01.mydomain.local" -Enabled $True

MSSQL Agent Service Account

The MSSQL Agent Service Account name should own the MS-SQL Agent Service
The service account (in case of a local or AD account) and service SID should not be members of the Windows Administrators group.

SQL2008

(TODO Needs additional info)

New-ADUser -Name "SQL01_Agent_SVC" -Enabled $True -AccountPassword (ConvertTo-SecureString -AsPlainText "InitPass!!!" -Force)

SQL2012

(TODO Needs additional info)

New-ADServiceAccount -Name "SQL01_Agent_SVC" -DNSHostName "SQL01.mydomain.local" -Enabled $True

Database Administrator Accounts

It is recommended to create a "DBA" AD Group and allocate users to that group as appropriate.

The example below creates a user, a group, and allocates the user to the group...

Group Scope

UniversalAccounts from any domain in the same forestGlobal groups from any domain in the same forestOther Universal groups from any domain in the same forest
GlobalAccounts from the same domainOther Global groups from the same domain
Domain LocalAccounts from any domain or any trusted domainGlobal groups from any domain or any trusted domainUniversal groups from any domain in the same forestOther Domain Local groups from the same domainAccounts, Global groups, and Universal groups from other forests and from external domains

Group Type

Security Groups enable assignment of rights and permissions to members of the groupDistribution groups can be used only with email applications to send email to collections of users.