Clarification about SQL Server Browser and Service Account Recommendations for ADMS

[samer.kanaah]

Dear community and Autodesk,

I often install Autodesk Vault Professional Server 2025 (and other versions) for clients and I want to ensure full compliance with Autodesk recommended configuration, particularly for SQL Server. I found that the online help contains screenshots of older versions of SQL.

Could someone or Autodesk please confirm the following:

For example, for SQL Server Express 2022, should the SQL Server Browser service be configured to Automatic or Disabled?

I noticed that by default, if the SQL Server version is Standard, this setting is set to Automatic.
And if the SQL version is Express, this setting is set to Disabled by default.

Additionnaly, Autodesk documentation indicates that the NT AUTHORITY\NETWORK SERVICE account should be used for the SQL Server database engine.
However, the default SQL Server configuration is NT Service\MSSQL$AUTODESKVAULT.

Could someone or Autodesk please clarify which one is officially recommended for Vault Server 2025 and later?

I know that probably these differents settings will all work but I need an official answer so I can follow the best practices.

Thank you

[ihayesjr · Accepted solution]

For example, for SQL Server Express 2022, should the SQL Server Browser service be configured to Automatic or Disabled?

This is not dependent on the SQL Edition. It depends on how you deployed Vault and SQL.

• The SQL Browser Service is needed to identify the port on which the SQL Database Engine is running. Named instances of SQL (AutodeskVault) run on a dynamic port. The Default, non-named instance of SQL runs on port 1433.
• SQL Express is usually installed on the same machine as the Vault Server, if you let Vault install it. Even if you are running SQL Standard or Enterprise on the same machine as Vault Server, the SQL Browser Service is not needed because SQL calls will use the named-pipe protocol and connect to the local SQL instance.
• If you install SQL on a remote machine, only supported with Vault Professional, the SQL Browser is needed if you are running SQL on a dynamic port. Since this is a remote SQL Server, the TCP protocol is used, and the Vault Server needs to be able to find the dynamic port the SQL instance is using. This relies on the SQL Browser to return the port.

Could someone or Autodesk please clarify which one is officially recommended for Vault Server 2025 and later?

• Use the default account when you install SQL. We will have to update that page as some of those things are outdated depending on the version of Help you are looking at.

[samer.kanaah]

Thank you for your reply.

So in most cases, we can leave this SQL configuration page by default, just be careful with Vault Pro if we use remote SQL or not (regarding SQL Browser Service to be set to automatic).

It would indeed be a good idea to update the online help, please.

Thanks!

[jzarczynski]

@ihayesjr

Analyzing the same issue, I'd like to know if when hosting SQL on a remote SQL Server (instead of local), we can use a gMSA account instead of the standard NT Service\MSSQL$AUTODESKVAULT account. This would be a great addition to this thread.

SQL Server has natively supported gMSA accounts since SQL 2014, and they can be granted access to network folders (SQL share).

Our security auditor has recommended this approach (currently we're using a domain account instead of NT Service\MSSQL$AUTODESKVAULT).

[ihayesjr]

@jzarczynski 

Vault does not care which account is used to run the Database Engine. 

However, this may or may not affect how you perform a remote backup. 

See: Vault Help | Set Up a Remote Backup Location | Autodesk

[jzarczynski]

Just wanted to add a bit of extra info to this thread:

-Interestingly, I contacted Autodesk support about this some time ago and they claimed that gMSA is not supported.

-That said, I've been running gMSA for almost a year now without any issues whatsoever. The only thing I had to take care of was granting these accounts the proper permissions to the SQL folders and the Vault shared folder. I also recently migrated SQL from 2019 to 2022 and two of our production Vault servers to 2027.1 — again, no problems at all.