One SAM Account or multiple?

Question

Hello,

We are new users to Solarwinds SAM.  We are in the design process and are going to monitor some of the following:

- Windows/Linux servers

- Exchange

- SQL DB

I'm currently thinking about using one domain account to monitor Windows/Linux servers, one for exchange, and one to monitor multiple SQL databases, 40+. However I don't know if there are any "real world" pros and cons to using one or multiple domain accounts for monitoring the different things in an environment.  Would it make sense to just use one account for monitoring everything?

Thank you in advance.

bobmarley · Answer

Depends on your companies security policies. I like to use as few accounts as possible and the accounts I use have the bare minimal rights to run the SAM templates.

The more accounts you have, the more time your going to spend administering those accounts. For example, in my environment the magical password genie sends me a reminder ticket whenever my passwords need rotated. When the rotation will

occur and then uses a super top secret method of sending me the new password. I have to create a change record that matches the time of the change, let the NOC know some transactions may fail during the change, and then change the password in Orion.

Not a bad deal if your going to do them the same day/time but if your using 15 - 20 passwords it gets to be a daunting task to remember to get everything done on time.

Also, when running my own scripts against another server I will set up my Orion server as a Computer Account on the remote machines, that way no passwords are passed in the scripts and I can assign the appropriate rights on the remote machine. This was the easiest method I have found for running scripts that restart services, read files, execute actions etc.

cmarti · Answer

Thank you both Mark and Steffen for your replies.  I will get with our security department and see if they have any concerns between using one account and using multiple accounts.  My main concern was with whether there were any issues with using either, but it looks like it's based on preference and need, which is ok.

Thank you all again.

m_roberts · Answer

The majority of our customers create a single domain admin 'Service Account' which SAM will use to poll.

In addition to the above, a consideration is one of security. If you use a single account, does this increase the risk of malicious use, where by knowledge of this account may compromise different business units, security zone infrastructure etc. As the service account needs such high level privileges for some function, but less for others, I suggest you review how having multiple accounts can reduce your risk exposure.