Re: SQL2k Sqlagentproxy fails to logon

From: Sue Hoegemeier (Sue_H@nomail.please)
Date: 06/27/02 

From: Sue Hoegemeier <Sue_H@nomail.please>
Date: Thu, 27 Jun 2002 13:12:23 -0600

I think your permissions are probably not configured
correctly for the SQL Server service account.
I've seen someone else recently hit the Access denied with
xp_sqlagent_proxy_account. The problem was due to the SQL
Server account not running under a Windows
administrator account to read or set the SQL Server Agent
proxy account. It's not sa being denied permissions to
execute the procedure but rather your SQL Server service
account that does not have permissions to read the windows
accounts.
You get the 997 error when information can't be retrieved
about the proxy account as well as when the proxy account
isn't configured correctly. But I think you probably need to
start with the permissions for the SQL Server service
account first.

-Sue

On Thu, 27 Jun 2002 11:50:27 -0700, "Doug Little"
<dlittle5@ford.com> wrote:

>Hi,
>We're running sql2k sp2 on w2k sp2 where we have a number
>of jobs that have been running fine for over a year.
>
>Something recently changed where all jobs that use
>OS Commands (CMDEXEC) now fail with the message "A problem
>occurred while attempting to logon as the Windows
>user 'SQLAgentCmdExec': The parameter is incorrect. The
>step failed."
>
>Executing cmd_exec 'exec xp_cmdshell 'dir c:*.* /ad'
>directly from a non-sa account gets us 'Msg 50001, Level
>1, State 50001. Xpsql.cpp Error 997 from GetProxyAccount
>on line 472"
>
>A review of the sqlagent.log file has an interesting
>message '[298] SQLServer Error: 8198 Could not obtain
>information about win nt grp/usr 'fordna1\cksinfra'.
>sqlstate 42000 (ConnIsLoginSysAdmin)'
>
>We have the sqlagent set use use a proxy domain account
>(which is fine, not locked, expired,etc)
>
>The sa can't execute the xp_sqlagent_proxy_account 'get'
>to validate the proxy account info. He gets 'access is
>denied'. I asked him to grant himself privledges and try
>again. Hopefully that will show a glaring mistake.
>
>But, until then has anybody seen this before and can you
>offer diag tips/resolutions.
>
>Thanks
>Doug little
>313-594-2706 dlittle5@ford.com

Relevant Pages

  • Re: Execute Persmission denied on object sp_OACreate
    ... proxy account to use in the Job Systems tab of SQL Server Agent Properties. ... Does Sql Server Agent recognize that a user does not have SysAdmin ... If so what access and permissions. ...
    (microsoft.public.sqlserver.security)
  • RE: CTP3 Failure - Creating a Remote Distributor (error during dec
    ... It appears that simply changing the SQL Server service account from a domain ... account to the localsystem account even before the distributor is set up had ... > 2) Are the remote distributor and the publisher machines in the same domain? ...
    (microsoft.public.sqlserver.replication)
  • Re: 2005 Enterprise sp 2 install fails - 11009
    ... No mapping between account names and security IDs was done. ... Failed to find installation media path due to datastore exception in FindSetupFolder ... Was your SQL Server service account a domain administrator account? ...
    (microsoft.public.sqlserver.setup)
  • RE: Atteched DBs only "read only"
    ... An OS Error of 5 typically means that you don't have permissions to modify ... please verify the account the SQL Server service is using. ...
    (microsoft.public.sqlserver.jdbcdriver)
  • Re: Unable to set SQL proxy for xp_cmdshell
    ... using a local account that is member of the Administrators group of the ... required service accoint permissions will be set. ... You might try manually deleting the SQLSERVERAGENT proxy account registry ... SQL Server MVP ...
    (microsoft.public.sqlserver.security)