Prior to deployment of a Devolutions Server instance, some accounts are needed to operate the various services involved in a secure deployment of Devolutions Server. The first decision is to use either domain accounts for operating the platform, or to use local SQL accounts paired with local service accounts. Since this decision is a matter of personal preference, we support both models.
Before proceeding, please take the following into account:
- The names used in this guide are to ease comprehension of the role fulfilled by the account. Our documentation uses these names as well, but there is no requirement that you use them.
- The following accounts interacting with the SQL database will be granted the least privileges permissions from scripts that will run during the creation and the upgrade of the Devolutions Server instance.
Domain-based operation (integrated security option)
The Administration credentials needs full read permissions on the AD structure, but does NOT perform any changes to your directory. Sadly, because of a side effect of how the net Directory Services are built, there is an issue when that account tries to read properties of AD groups that may reside in a protected area of your directory. The easiest fix was to grant full admin permissions, but we are looking into implementing a better fallback strategy to handle the case where access is denied. It may require higher privileges than being part of the Domain Users built-in Active Directory group. In most cases, it should be sufficient.
# | Name | ORIGIN | DESCRIPTION | SET IN... |
---|---|---|---|---|
1 | VaultDBOwner | AD |
| Interactive Windows session used to run the installation/upgrade of a Devolutions Server instance. This account must be a local administrator of the Devolutions Serverhost machine. |
2 | VaultDBRunner | AD |
| IIS Application pools that are running a Devolutions Server Instance. |
3 | VaultADReader | AD |
| Devolutions Server Instance Settings - Administration credentials. |
4 | VaultDBSchedulerService | AD |
| Windows Service Control Manager. |
Non-domain based operation or Azure SQL environment
On a non-domain-based deployment, a single connection string is used for three different aspects of the system. This will be improved in a future release to respect the least-privilege principle.
For Azure SQL hosted database, domain-based operation (integrated security option) is not supported.
# | NAME | ORIGIN | DESCRIPTION | SET IN... |
---|---|---|---|---|
1 | VaultDBOwner | SQL |
| The Devolutions Server Console only for installation/upgrade sessions. |
2 | VaultDBRunner | SQL |
| The Devolutions Server Console for operations of the instance. |
3 | VaultADReader | AD |
| Devolutions Server Instance Settings - Administration credentials. |
4 | VaultDBSchedulerService | SQL |
| Devolutions Server Console – Scheduler service. The database access will be performed by the single ConnectionString that is the subject of the informational note above. |