BPA Vs. Security Best Practices Paper

I would like to refer to the following technical article



SQL Server 2005 Security Best Practices - Operational and Administrative Tasks

http://www.microsoft.com/technet/prodtechnol/sql/2005/sql2005secbestpract.mspx



Among best practices for SQL Server service accounts on page 8, it is recommended to 'use a separate account for each service'. I created separate account for each service as advised and assign account to relevant Windows group created for each SQL Server service during SQL setup.



Now when I run Best Practices Analyzer, its report seemed to contradict what the above article said. For example, BPA reports excerpts:

"We recommend that the service SQLBrowser on host MachineName be run under Network Service Account". I get similar recommendation for SQLSERVERAGENT account as well. Most importantly, it recommends that MSFTESQL be run under SQL Server Service Account.



Can anyone of you shed some light on it?



Thanks,

Asaf