sdg's questions

For a fairly standard, internal facing, web app of an IIS layer talking to an MS SQL back end, we are using a service account for the IIS to talk to SQL.

We also have in our Active Directory setup a password lockout set, so that too many guesses lock the account.

Following on from Is account lockout a denial of service attack waiting to happen? scenario - does setting the Deny Logon Locally for the service account user impact this lockout feature in any way?

Alternatively (additionally?) is this the kind of scenario that Managed Service Accounts are supposed to help fix?

In the past I have used Veritas Cluster Server for HA clusters of Sybase and other databases at large financial institutions.

Now I am going to have locally written processes that could benefit from some similar behavior. e.g. "fail onto this machine if this process fails"

We will have VCS in the environment for various databases, so the overall skill set is not an issue; but this specific aspect.

Have you used VCS for custom application deployments? Was it worth it? Did it buy you much?