SQL Server Service Account Configuration - one account per Server? Planning to re-create new service accounts for our Sql-Servers, I wondered if - from a security perspective - it maybe better to have one domain account per Service and per Server or to create one domain-account per service only and re-use those on the different servers? 

DOMAIN\Service-SSRS
DOMAIN\Service-SSAS
DOMAIN\Service-SSIS

vs.

DOMAIN\Service-SQL01-SSRS
DOMAIN\Service-SQL01-SSAS
DOMAIN\Service-SQL01-SSIS
DOMAIN\Service-SQL02-SSRS
DOMAIN\Service-SQL02-SSAS
DOMAIN\Service-SQL02-SSIS
etc.


We are doing this because we want to have a uniform and consistent configuration on all servers, something that is not yet in place today. I feel like having single accounts for every server might allow more flexibility and so is counterproductive...

Are there specific pros / cons? Is there a lot of usage of having separated service accounts for every server?
Separate service accounts for each server and for each service will restrict any issues to just one server and just one service in the following cases:


Service account getting compromised
Service account getting locked out
Service account password changed
Service account getting disabled/deleted/renamed by mistake


Imagine what would happen with a single service account if you entered the service credentials wrong a handful of times (scripts are great for this): you would lock out the account and tear down the whole SQL Server farm. Not good.