Permissions required for an SQL Server account

Question

We're trying to get SQL running under a domain account, however we're not sure what permissions will be required for the service to start.

At present it is just a standard user in the active directory domain (which won't let the service start), I assume this user account will need permissions to the Program Files\Microsoft SQL Server directory.

But does it need permissions to access anything else?

Thank you.

Myles.

score 3 · Accepted Answer · answered Jul 15 '09 at 08:01

3

See http://support.microsoft.com/kb/283811

JR

answered Jul 15 '09 at 08:01

John Rennie

7,776
1
23
35

1

as a side note, don't forget to give the user account the "manage volume" permission to allow instant file initalization – Nick Kavadias Jul 15 '09 at 11:00

score 3 · Answer 2 · answered Jul 15 '09 at 18:42

For SQL 2005 and 2008 the KB article quoted by JR is obsolete and quite incomplete. Since SQL 2005 the setup creates local user groups and grants all needed privileges to run each service to the respective local group. For example the SQL Server service account needs to be added to the SQLServer2005MSSQLUser$ComputerName$MSSQLSERVER user group (default instance) or SQLServer2005MSSQLUser$ComputerName$InstanceName user group (named instance). The user groups have all the needed priviledges (SeServiceLogonRight, SeBatchLogonRight, SeAssignPrimaryTokenPrivilege etc etc) and all the needed access rights on the registry keys and files and folders used by the respective service. The ones 'missing' are the SeManageVolumePrivilege as Nick already pointed out and the SeLockMemoryPrivilege ("lock pages in memory"): these need be granted explicitly as are not considered mandatory.

So in SQL 2005/2008 case the solution is not to grant access to the folders and hives quoted in the KB, but instead add the desired domain user to the local user group SQLServer2005MSSQLUser$ComputerName$MSSQLSERVER (or the named instance equivalent).

You can read all the details at Setting Up Windows Service Accounts in BOL.

btw not knowing if the OP is on SQL 2000 or not, this advice of course may or may not apply. I just wanted to make sure somebody stumbling on this is aware that since 2005 there is a better way to deal with this issue. In fact in 2K5 there is even an UI wizard to accomplish the task: http://msdn.microsoft.com/en-us/library/ms345578(SQL.90).aspx — Remus Rusanu, Jul 15 '09 at 19:14

Permissions required for an SQL Server account

2 Answers2