SQL Server Security – Reasons to Prefer Windows Authentication Over SQL Server Authentication

authenticationSecuritysql server

This is a rather short question:

When using Microsoft SQL Server (version 2005 and newer), are there any security related reasons to prefer Windows Authentication over SQL Server Authentication?

Just to point it out, I'm interested in security related concerns, not in administrative or any other differences between the two.

Update: If any difference leads to (or is) a security concern, then I'm surely interested in.

Best Answer

An example, separation of duties

On a web server, the password for the service account is only known by one team. It isn't required to lie around in web.config or source control.

  • One team sets up the IIS App Pool (password is known here)
  • One team deploys code
  • One team manages the SQL Server Instance

If you want to pass an audit where PCI or SoX is involved, then you need to have this

Related Question