Question: Can I install SQL Server on a domain controller? Setup does not block installation on a writable domain controller, but Microsoft advises against it for security reasons. That is the beginning of the answer, not the end.
A client asked me the five questions below. After researching their situation, I was confident the same questions would eventually appear in interviews. The original answers needed an important correction about service accounts.
Why does setup warn me?
The original practical concern still matters: database work and domain authentication would compete for the same machine’s CPU, memory and I/O. More seriously, placing another service on a domain controller expands the exposure of a system responsible for domain security.
What about a read-only domain controller?
SQL Server setup cannot create its required security groups or service accounts there. Do not treat a successful partial installation as a supported deployment plan.
Can I install SQL Server, then promote the machine?
You must uninstall SQL Server before changing the host from a domain member to a domain controller, or back again. Reinstall after the role change. SQL Server failover cluster instances also are not supported on nodes that are domain controllers.
Which account should run the service?
The original conclusion that LocalSystem was the only remaining choice was wrong. A dedicated, suitably configured low-privilege domain service account is an alternative. Local service-account choices on a domain controller have restrictions, so do not carry over an ordinary member server’s defaults blindly.
LocalSystem has extensive privileges, including unrestricted Active Directory access on a domain controller. It is a poor shortcut for solving an account problem. Choose the account and permissions with the Windows administrators, and manage SQL Server service-account changes through SQL Server Configuration Manager.
The useful interview answer covers installation, security, role-change restrictions and the service identity. My preferred design remains a separate member server for SQL Server.
The LocalSystem documentation explains the domain exposure. Service-account guidance covers least privilege.
Published by Pinal Dave on SQLAuthority. More of my work at pinaldave.com.
Discover more from SQL Authority with Pinal Dave
Subscribe to get the latest posts sent to your email.
2 Comments. Leave new
In Q5, the answer should also be that you can use a service account as well.
hi can someone help me with this trying to install sql 2017 on domain Controller comes up with that warming.
what can I do to fix most other people say you can’t install on domain so that must be wrong
because you said you can do under local account how do I make that account and login it to it to install it
From Oliver