Pre-deployment account survey

Prior to deployment of a Devolutions Server instance, some accounts are needed to operate the various services involved in a secure deployment of Devolutions Server. The first decision is to use either domain accounts for operating the platform, or to use local SQL accounts paired with local service accounts. Since this decision is a matter of personal preference, we support both models.

The names used in this guide are to ease comprehension of the role fulfilled by the account. Our documentation uses these names as well, but there is no requirement that you use them.

The following accounts interacting with the SQL database will be granted the least privileges permissions from scripts that will run during the creation and the upgrade of the Devolutions Server instance.

Please choose the appropriate section

  • Domain Based Operation
  • Non-Domain Based Operation or Azure SQL environment

Domain Based Operation (Integrated Security option)

The Administration Credentials needs full read permissions on the AD structure, but does NOT perform any changes to your directory. Sadly, because of a side effect of how the net Directory Services are built, there is an issue when that account tries to read properties of AD groups that may reside in a protected area of your directory. The easiest fix was to grant full admin permissions, but we are looking into implementing a better fallback strategy to handle the case where access is denied. It may requires higher privileges than being part of the Domain Users built-in Active Directory group. In most case, it should be sufficient.

# Name Origin Description Set in...
1 VaultDBOwner AD Account with full privileges on the DB. Interactive Windows session used to run the installation/upgrade of a Devolutions Server instance.
2 VaultDBRunner AD Least-privileged account to run the web application. Used to connect to the DB, and to read from the file system. IIS Application pools that are running a Devolutions Server Instance.
3 VaultADReader AD Least-privileged account to query the AD. Devolutions Server Instance Settings - Administration credentials.
4 VaultDBSchedulerService AD Least-privileged account to operate the scheduler service. Used to connect to the DB and to read/write from the file system. Windows Service Control Manager.

Non-Domain Based Operation or Azure SQL environment

On a non-domain based deployment, a single connection string is used for three different aspects of the system. This will be improved in a future release to respect the least-privilege principle.

For Azure SQL hosted database, domain based operation (Integrated Security option) is not supported.

# Name Origin Description Set in...
1 VaultDBOwner SQL Account with full privileges on the DB. The Devolutions Server Console only for installation/upgrade sessions.
2 VaultDBRunner SQL Least-privileged account to run the web application. The Devolutions Server Console for operation of the instance.
3 VaultADReader AD Least-privileged account to query the AD through LDAP. Devolutions Server Instance Settings - Administration credentials.
4 VaultDBSchedulerService SQL Least-privileged account to operate the scheduler service. Used to read/write from the file system. Devolutions Server Console – Scheduler service. The database access will be performed by the single ConnectionString that is the subject of the informational note above.