John Sterrett gets rid of a password:
Somewhere in your environment, a SQL Server service account password hasn’t changed in years. Several people know it, and it’s probably in a script or a spreadsheet. I wouldn’t be surprised if someone hasn’t even put it in an AI chat. Group managed service accounts (gMSAs) remove that problem.
This past weekend, during my Advanced Security Protection talk (online version you can watch) at Days of Data in Pittsburgh, someone asked: “What are the best practices for encrypting passwords in connection strings?” That reminded me I’m overdue to blog about Group Managed Service Accounts, so here we are, because the best way to encrypt them is to not need to encrypt them.
This does get a lot trickier if you’re not on Windows, and it does require Active Directory. But for most environments, gMSAs are an outstanding idea.