Domain user accounts, local user accounts, managed service accounts, virtual accounts, and built-in system accounts can all be used to start and run SQL Server. Each SQL Server service must have a startup account defined after installation in order to start and run.

This section covers the accounts that can be used to start SQL Server services, the SQL Server Setup default values, the idea of per-service SIDs, startup options, and firewall configuration.

Default Service Accounts :

The default service accounts used by setup when installing all components are listed in the table below. Except when otherwise specified, the default accounts given are the recommended accounts.

Stand-alone Server or Domain Controller

Component	Windows Server 2008	Windows 7 and Windows Server 2008 R2 and higher
Database Engine	NETWORK SERVICE	Virtual Account*
SQL Server Agent	NETWORK SERVICE	Virtual Account*
SSAS	NETWORK SERVICE	Virtual Account* **
SSIS	NETWORK SERVICE	Virtual Account*
SSRS	NETWORK SERVICE	Virtual Account*
SQL Server Distributed Replay Controller	NETWORK SERVICE	Virtual Account*
SQL Server Distributed Replay Client	NETWORK SERVICE	Virtual Account*
FD Launcher (Full-text Search)	LOCAL SERVICE	Virtual Account
SQL Server Browser	LOCAL SERVICE	LOCAL SERVICE
SQL Server VSS Writer	LOCAL SYSTEM	LOCAL SYSTEM
Advanced Analytics Extensions	NTSERVICE\ MSSQLLaunchpad	NTSERVICE\ MSSQLLaunchpad
PolyBase Engine	NETWORK SERVICE	NETWORK SERVICE
PolyBase Data Movement Service	NETWORK SERVICE	NETWORK SERVICE

Microsoft recommends utilizing a Managed Service Account (MSA) with the bare minimum of privileges when resources from outside the SQL Server workstation are required. A virtual account as the service account is not supported when deployed on a Domain Controller.

SQL Server Failover Cluster Instance

Component	Windows Server 2008	Windows Server 2008 R2
Database Engine	None. Provide a domain user account.	Provide a domain user account.
SQL Server Agent	None. Provide a domain user account.	Provide a domain user account.
SSAS	None. Provide a domain user account.	Provide a domain user account.
SSIS	NETWORK SERVICE	Virtual Account
SSRS	NETWORK SERVICE	Virtual Account
FD Launcher (Full-text Search)	LOCAL SERVICE	Virtual Account
SQL Server Browser	LOCAL SERVICE	LOCAL SERVICE
SQL Server VSS Writer	LOCAL SYSTEM	LOCAL SYSTEM

Managed Service Accounts, Group Managed Service Accounts, and Virtual Accounts are all types of managed service accounts.

Managed service accounts, group managed service accounts, and virtual accounts are designed to give critical programs like SQL Server their own accounts while removing the need for an administrator to manage the Service Principal Name (SPN) and credentials for these accounts manually. This simplifies the long-term maintenance of service account users, passwords, and SPNs..

• Managed Service Accounts A Managed Service Account (MSA) is a type of domain account that the domain controller creates and manages. It’s tied to a single member computer and is used to run a service. The domain controller manages the password automatically. A MSA cannot be used to log into a computer, but it can be used to start a Windows service by a computer. When given read and write service PrincipalName permissions, an MSA can register a Service Principal Name (SPN) in Active Directory. A MSA is identified by a $ suffix, such as DOMAINACCOUNTNAME$. Leave the password field blank when designating an MSA. A MSA can only be used on one computer, hence it can’t be utilized on several nodes.. Before SQL Server setup may use the MSA for SQL Server services, the domain administrator must create it in Active Directory.
• Group Managed Service Accounts An MSA for numerous servers is known as a Group Managed Service Account (GMSA). A service account is managed by Windows for services running on a group of servers. Without restarting services, Active Directory automatically refreshes the group managed service account password. You can use a group managed service account principal to configure SQL Server services. SQL Server offers group managed service accounts for standalone instances starting with SQL Server 2014, and SQL Server 2016 and later for failover cluster instances and availability groups. The operating system must be Windows Server 2012 R2 or later to use a group managed service account for SQL Server 2014 or later. KB 2998082 must be installed on Windows Server 2012 R2 servers in order for services to log in without interruption after a password change. See Group Managed Service Accounts for further details. Note: Before SQL Server setup may use the group managed service account for SQL Server services, the domain administrator must create it in Active Directory.
• Virtual Accounts Virtual accounts (starting with Windows Server 2008 R2 and Windows 7) are managed local accounts that ease service administration by providing the following characteristics. The virtual account is administered automatically, and it can connect to the network in a domain environment. If the default setting for service accounts is chosen during SQL Server setup, a virtual account with the instance name as the service name, in the format NT SERVICE, is created. The credentials of the computer account in the format $ are used by services that run as virtual accounts to access network resources. Leave the password blank when creating a virtual account to start SQL Server. Manually register the Service Principal Name (SPN) if the virtual account fails to do so. See Manual SPN Registration for further information on manually registering an SPN.
• Note : Because virtual accounts do not have the same SID on each node of the cluster, they cannot be used for SQL Server Failover Cluster Instance.
• Examples of virtual account names are included in the table below.

Service	Virtual Account Name
Default instance of the Database Engine service	NT SERVICE\MSSQLSERVER
Named instance of a Database Engine service named PAYROLL	NT SERVICE\MSSQL$PAYROLL
SQL Server Agent service on the default instance of SQL Server	NT SERVICE\SQLSERVERAGENT
SQL Server Agent service on an instance of SQL Server named PAYROLL	NT SERVICE\SQLAGENT$PAYROLL

See the Managed Service Accounts and Virtual Accounts ideas part of the Service Accounts Step-by-Step Guide and the Managed Service Accounts Frequently Asked Questions for further information on Managed Service Accounts and Virtual Accounts (FAQ).

Security Note: Always run SQL Server services with the least amount of user rights possible. When feasible, use an MSA or virtual account. Use a specific low-privilege user account or domain account instead of a shared account for SQL Server services when MSA and virtual accounts aren’t available. For different SQL Server services, use distinct accounts. Do not provide the SQL Server service account or the service groups any new permissions. Where a service SID is supported, permissions will be granted either through group membership or directly to a service SID.

More information on SPN Registration can be found at the following link:

https://help.deepsecurity.trendmicro.com/11_2/on-premise/kerberos-mssql.html