#Service accounts

gMSA in Active Directory: service accounts without static passwords

The svc_sql account has had the same password since the database was installed, because changing it risks downtime. Any domain user can request a ticket for that service and crack it offline. gMSA moves the password to the domain controller: it is 240 bytes long, random and changes every 30 days without an administrator.