RE: Win2000 OS Access for SQL Server Admin

From: Kevin McDonnell [MSFT] (kevmc_at_online.microsoft.com)
Date: 03/10/04 

Date: Wed, 10 Mar 2004 19:30:18 GMT

Previous post:
My questions are, why did this service fail to start and
yet the other SQL services start successfully before
granting the Administrators or the System account
sysadmin privileges?

Changes in sp3 make it necessary for SQL agent if required to run as a
Admin account. LocalSystem has more privledges than local administrator.
If you're not using SQLAgent, then you could either disable the service or
set it to manual.

SQL Server Agent will need local Windows administrator privileges if one of
the following is true:
SQL Server Agent connects to SQL Server using SQL Server Authentication
(not recommended).
SQL Server Agent uses a multiserver administration master server (MSX)
account that connects using SQL Server Authentication.
SQL Server Agent runs Microsoft ActiveX® script or CmdExec jobs owned by
users who are not members of the sysadmin fixed server role.

Also, what are the security risks with granting System sysadmin privileges
vs creating a local windows account and using this to startup the
services? I'd like to use the most secure method.

The risk are associated with a comprimise of the system. If "bad guys" can
comprise a SQL box, then they may be able to run under the context of the
service account. So, if the account has admin or domain admin privledges,
then you're at risk. Best practices are to run the MSSQLService account
under a local nt user account or domain user account.

This goes hand in hand with good Password policies, protecting the server
by a firewall, keeping the server up to date on patches (Windows Update/SMS
or SUS), running good Anti virus software.

You need to assess your threats to your environment and decide what actions
are necessary to take. Example, what protocols are running on this
machine, what machines have access to this machine? Is the machine in a
DMZ or is it sitting in the local lan in the Accounting Dept.?

Thanks,

Kevin McDonnell
Microsoft Corporation

This posting is provided AS IS with no warranties, and confers no rights.

Relevant Pages

  • Re: BULK Insert Problem
    ... > I Log on to my system using the Local System Administrator Account. ... > do I see that The SQL Server Service is starting using the Local Account ...
    (microsoft.public.sqlserver.programming)
  • Re: SQL account rights
    ... Please advice what is the best, suitable rights rather than domain admin ... Warren Brunk - MCITP - SQL 2005, ... Add it as a login to the SQL Server ... files, or backups, make sure that the service account has Full ...
    (microsoft.public.sqlserver.security)
  • Re: User authentication
    ... There are 2 SQL Server 2005 ... 1 SQL Server 2000 installed on another server ... Windows account instead to run backup jobs. ...
    (microsoft.public.sqlserver.clients)
  • Re: user and group permissions
    ... Within SQL - Security - Logons - remove Administrators. ... add SQLAdmins as the SQL Server Role of System ... > Is it possible to deny access to local NT administrator ... > cluster runs under domain user account with adminstrator ...
    (microsoft.public.sqlserver.clustering)
  • Re: Guest Account being enabled
    ... Therefore....I'm clueless when it comes to SQL. ... >the SA account is using SQL and the password is stared. ... >>>I have a User Account named Administrator. ... and the exchange service username are also ...
    (microsoft.public.security)