Software Install Account

Previous SQL Server Accounts	SQL Service Accounts Next

It is Best Practice to use a dedicated account for performing software installs, fixes and upgrades.

This is because Windows local Administrator authority is required to perform a software install, but day-to-day administration of already-installed software does not need Windows local Administrator authority. The security principal of using minimum possible rights for a given task therefore mandates the use of separate accounts for software installation and administration.

All installation tasks must be performed using an account that has the following attributes:

• Local Administrator authority on the Windows instance where SQL Server is being installed
• Ability to update Registry entries, which can be restricted via a GPO

When an installation is performed on Windows 2008 or above, the installation should be explicitly started with the Run as Administrator option. The password used for the install account should be given as the /AdminPassword: parameter value so that SQL FineBuild can log on automatically after a reboot and continue with the install process.

After SQL Server install activity has completed, the install account should be disabled within SQL Server, and only re-enabled when it is required to install SQL Server fixes or upgrades.

Copyright FineBuild Team © 2013 - 2020. License and Acknowledgements

Previous SQL Server Accounts	Top	SQL Service Accounts Next