Skip to content

Commit 755663c

Browse files
authored
Update configure-the-report-server-service-account-ssrs-configuration-manager.md
Add "Group Managed Service Account (gMSA)" to table ------- cc: @maggiesMSFT
1 parent d254dfb commit 755663c

1 file changed

Lines changed: 3 additions & 2 deletions

File tree

docs/reporting-services/install-windows/configure-the-report-server-service-account-ssrs-configuration-manager.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.prod: reporting-services
77
ms.prod_service: "reporting-services-native"
88
ms.topic: conceptual
99
ms.custom: seo-lt-2019​, seo-mmd-2019
10-
ms.date: 12/04/2019
10+
ms.date: 06/09/2020
1111
---
1212

1313
# Configure the Report Server Service Account (SSRS Configuration Manager)
@@ -67,7 +67,8 @@ ms.date: 12/04/2019
6767

6868
|Account|Explanation|
6969
|-------------|-----------------|
70-
|Domain user accounts|If you have a Windows domain user account that has the minimum permissions required for report server operations, you should use it.<br /><br /> A domain user account is recommended because it isolates the Report Server service from other applications. Running multiple applications under a shared account, such as Network Service, increases the risk of a malicious user taking control of the report server because a security breach for any one application can easily extend to all applications that run under the same account.<br /><br /> If you use a domain user account, you have to change the password periodically if your organization enforces a password expiration policy. You might also need to register the service with the user account. For more information, see [Register a Service Principal Name &#40;SPN&#41; for a Report Server](../../reporting-services/report-server/register-a-service-principal-name-spn-for-a-report-server.md).<br /><br /> Avoid using a local Windows user account. Local accounts typically don't have sufficient permission to access resources on other computers. For more information about how using a local account limits report server functionality, see [Considerations for Using Local Accounts](#localaccounts) in this topic.|
70+
|Domain user accounts|If you have a Windows domain user account that has the minimum permissions required for report server operations, you should use it.<br /><br /> A domain user account is recommended because it isolates the Report Server service from other applications. Running multiple applications under a shared account, such as Network Service, increases the risk of a malicious user taking control of the report server because a security breach for any one application can easily extend to all applications that run under the same account.<br /><br /> If you use a domain user account, you have to change the password periodically if your organization enforces a password expiration policy. You might also need to register the service with the user account. For more information, see [Register a Service Principal Name &#40;SPN&#41; for a Report Server](../../reporting-services/report-server/register-a-service-principal-name-spn-for-a-report-server.md).<br /><br /> Avoid using a local Windows user account. Local accounts typically don't have sufficient permission to access resources on other computers. For more information about how using a local account limits report server functionality, see [Considerations for Using Local Accounts](#localaccounts) in this topic.|
71+
| **Group Managed Service Account (gMSA)** | Standalone Managed Service Accounts were introduced in Windows Server 2008 R2 and Windows 7. They're managed domain accounts that provide automatic password management and simplified SPN management, including delegation of management to other administrators. The **Group Managed Service Account** provides the same functionality within the domain but also extends that functionality over multiple servers. |
7172
|**Virtual Service Account**|**Virtual Service Account** represents the windows service. It is a built-in least-privilege account that has network log on permissions. This account is recommended if you don't have a domain user account available or if you want to avoid any service disruptions that might occur as a result of password expiration policies.|
7273
|**Network Service**|**Network Service** is a built-in least-privilege account that has network log on permissions. <br /><br /> If you select **Network Service**, try to minimize the number of other services that run under the same account. A security breach for any one application compromises the security of all other applications that run under the same account.|
7374
|**Local Service**|**Local Service** is a built-in account that is like an authenticated local Windows user account. Services that run as the **Local Service** account access network resources as a null session with no credentials. This account is not appropriate for intranet deployment scenarios where the report server must connect to a remote report server database or a network domain controller to authenticate a user prior to opening a report or processing a subscription.|

0 commit comments

Comments
 (0)