Re: Privilege in scheduling packages through sql agent jobs
From: Maria Garcia (MariaGarcia_at_discussions.microsoft.com)
Date: 03/29/05
- Next message: Jason Mauss: "Which Account to run SQL Service under? Best Practice?"
- Previous message: Mike Epprecht \(SQL MVP\): "Re: set AD password from a SQL proc?"
- In reply to: Sue Hoegemeier: "Re: Privilege in scheduling packages through sql agent jobs"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 29 Mar 2005 07:57:03 -0800
Thank you very much you have been very helpful!!!
"Sue Hoegemeier" wrote:
> It means that if the programmer is not a sysadmin, the job
> won't run as the dtsrun command is an CmdExec job step. By
> default, the SQL Agent properties are set so that only
> sysadmins can execute CmdExec and ActiveScripting job steps.
> The package can be scheduled by a non-sysadmin but it won't
> run unless the owner of the job is changed to a sysadmin.
> The other alternative is to allow non-sysadmins to execute
> CmdExec and ActiveScripting jobs and create a proxy account
> which will be used as the security context of jobs not owned
> by sysadmins. However, there are certainly security
> implications with this. There are also other potential
> issues with allowing non-sysadmins to schedule jobs - they
> can't view all jobs and consequently can't take job load,
> server load into consideration when scheduling jobs.
> A sysadmin should probably be reviewing jobs being added and
> this person can change the ownership of the job to a
> sysadmin.
> You can find additional information on scheduling packages,
> job owners, security context, etc. in the following article:
> How to Run a DTS Package as a Scheduled Job
> http://www.support.microsoft.com/?id=269074
>
> -Sue
>
> On Mon, 28 Mar 2005 09:21:08 -0800, Maria Garcia
> <MariaGarcia@discussions.microsoft.com> wrote:
>
> >A programmer can schedule jobs through sql agent and the job step that is
> >executed in the job ran cannot be ran in a package that is scheduled.When the
> >programmer runs the package interactively, it runs fine. When the programmer
> >attempts to schedule a package as sql agent job, the job fails. I have admin
> >privileges to sql server. Therefore, I scheduled the job for the package and
> >had the job run under the programmers account and obtained the following
> >error:
> >Non-sysadmins have been denied permission to run CMDExec job step.
> >Does this mean that the programmer needs to have the system administrator
> >role in order to schedule a package as a job.
>
>
- Next message: Jason Mauss: "Which Account to run SQL Service under? Best Practice?"
- Previous message: Mike Epprecht \(SQL MVP\): "Re: set AD password from a SQL proc?"
- In reply to: Sue Hoegemeier: "Re: Privilege in scheduling packages through sql agent jobs"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
