Re: Granting login and access privileges to LocalSystem

From: Eskimo (Eskimo_at_discussions.microsoft.com)
Date: 09/30/04 

Date: Thu, 30 Sep 2004 06:01:01 -0700

Hi Mary,

Here is the setup...

Domain Controller :

- Computers "Server1" and "Server2" are domain members.
- "UserGroup1" global user group exists.
- Computer "Server2" is a member of "UserGroup1"

Server1 :

- "SQLServer1" SQL Server 2000 instance installed.
- "UserGroup1" has login permissions on "SQLServer1".
- "UserGroup1" has read/write permissions on "Database1" database on
"SQLServer1".

Server2 :

- Services started with login "LocalSystem" need to connect to "SQLServer1"
using ODBC.

This setup works sometimes and other times, it does not work. *I think* that
anytime the 'sa' SQL Server account has a password (as recommended by
Microsoft), the above setup fails.

What I need to know is if it is possible to specifically give the
"LocalSystem" account of "Server2" login permissions on the "SQLServer1" SQL
Server instance.

I thought that giving login permissions to "UserGroup1", which the "Server2"
computer is a member of, was enough. But that is not the case.

I am either missing something, or it is simply not possible to specifically
allow a remote "LocalSystem" account to login to a SQL Server instance.

If you can, let me know if my situation is hopeless or if there is something
else I can try.

Cheers and thanks for your help,

The Eskimo

P.S. Using a domain account which is a member of the "UserGroup1" user group
as the services' login on "Server2" is not an option. There are specific
reasons, which I will not discuss here, why we are using the "LocalSystem"
account as our services's login.

"Mary Bray" wrote:

> You need to run sql under a domain user account - local system cannot be
> used for cross server communication.
> What is it that you need SQL to do?
>
> "Eskimo" <Eskimo@discussions.microsoft.com> wrote in message
> news:9E17CB4E-9A8B-4AE9-B75A-F0CB5C49AD0E@microsoft.com...
> > Hi,
> >
> > Our software runs services that access a SQL Server 2000 database that is
> > located somewhere on the domain. The services use the LocalSystem
> > credential.
> >
> > How can I grant SQL login access and DB read/write access to a specific
> > LocalSystem account on a SQL server?
> >
> > Example: On domain 'Domain1', I want to grant the LocalSystem account of
> > the
> > 'Server1' system login access to the SQL server located on the 'Server2'
> > system.
> >
> > How can this be done?
> >
> > Thanks in advance for your help.
> >
> > --
> > The Eskimo
>
>
>

Relevant Pages

  • Re: Error 15401 using sp_grantlogin (not addressed by current KB articles)
    ... Restarting Windows 2000 resolved the problem for this particular account, ... confused when it sees a duplicate SID. ... > One way to get SQL Server to agree with the renamed NT ... > Preview (to ensure the script was created), ...
    (microsoft.public.sqlserver.security)
  • Re: SharePoint V3 Install Error
    ... But it our case it had to do with Group Policies that forbid the account of ... WSS FAQ:www.wssv3faq.com/wss.collutions.com ... Event Source: WindowsSharePointServices3Search ... whatever you are installing WSS as sufficient rights to the SQL Server ...
    (microsoft.public.sharepoint.windowsservices)
  • RE: Problems with WebParts
    ... to a database called aspnetdb. ... > The connection string specifies a local SQL Server Express instance using a ... > server account must have read and write access to the applications directory. ... > This is necessary because the web server account will automatically create ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Cannot connect to Query Analyzer
    ... For Query Analyzer, I tried replacing the file as you suggested but had the ... same results (Enterprise Manager starts up fine, ... I created an account on my laptop and changed SQL ... Try replacing the MMC app for SQL Server from the original ...
    (microsoft.public.sqlserver.connect)
  • Problems with WebParts
    ... The connection string specifies a local SQL Server Express instance using a ... database location within the applications App_Data directory. ... server account must have read and write access to the applications directory. ... logged-in user needs the dbcreator privilege in the appropriate SQL Server ...
    (microsoft.public.dotnet.framework.aspnet)