Re: Specifying a logon account for SQL Server 2005 services


As I mentioned using a Windows domain account with no permissions is the
recommended way to define a service account, the SQL Server setup program
will assign this account ALL the required permissions to do its job. Perhaps
the setup program does not give the 'Lock pages in memory' permission because
AWE is not configured during the software installation and instead, it is
configured only for very specific server and memory configurations.

Using an account with local administrator permissions is not a good security
practice as you are giving too much permissions.

If later you want to configure AWE you will need to assign the 'Lock pages
in memory' permission manually.

Hope this helps,

Ben Nevarez
Senior Database Administrator
AIG SunAmerica







"Hotmail User" wrote:

Well, if I create a least privileged domain account, and specify that as the
account to use while installing SQL Server, will SQL Server give this account
the privileges that you've mentioned like "Lock pages in memory", and the
ability to write to port 135, etc., since I guess I might at least need the
debugging capability.

Thanks.


"Erland Sommarskog" wrote:

Hotmail User (HotmailUser@xxxxxxxxxxxxxxxxxxxxxxxxx) writes:
Is it a less secure practice to specify the LOCALSYSTEM account as the
logon account for services when installing SQL Server 2005? Is it
possible to specify a lesser privileged account? Will that cause
problems for SQL Server?

The recommendation this days is to never give away more privileges than
necessary. The idea is that if you have a hole in an application by
for SQL injection, and xp_cmdshell is open, the intruder should not
have too many privs to play with. So, bascially use a plain user-domain
account.

Then again, LocalSystem has its point. It has strong permissions on
the machine, but cannot have network connections, so the intruder is a
bit contained in such a case. But you lock yourself in two, and cannot
backup to network drives etc.

There are two cases I know SQL Server needs extra privs:

o To use AWE, the account needs the permission "Lock pages in memory".
o For SQL debugging to work, SQL Server needs to have permission to
write back to you on port 135. (I don't know the exact permissions.)

But there may be more that I am ignorant of.

--
Erland Sommarskog, SQL Server MVP, esquel@xxxxxxxxxxxxx

Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/prodtechnol/sql/2005/downloads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodinfo/previousversions/books.mspx

.

Relevant Pages

  • Re: Execute Persmission denied on object sp_OACreate
    ... If so what access and permissions. ... The account is a windows account. ... One method to test permissions is to log in to your SQL Server box using the ... >>> SA account password and gaining access to the database. ...
    (microsoft.public.sqlserver.security)
  • Re: simple security question (need refresher)
    ... If IIS is configured for anonymous access and you connect to SQL Server ... using Windows authentication, the IIS anonymous account ... this account or roles that this account is a member of. ... Permissions are required only on objects directly accessed by the ...
    (microsoft.public.sqlserver.security)
  • Re: "Access denied" with xp_cmdshell (!)
    ... But problem is that I have tried to give for that account full control ... restart Sql Server for those permissions to take effect. ...
    (microsoft.public.sqlserver.security)
  • Re: "Access denied" with xp_cmdshell (!)
    ... Does the command work fine if you execute it from a prompt started as the ... service account? ... Have you checked both the permissions for the share and for the file? ... restart Sql Server for those permissions to take effect. ...
    (microsoft.public.sqlserver.security)
  • Re: What version of SQL is on SBS R2 Standard and can I use it?
    ... The SQL server occupies large amount of RAM, ... specified amount of memory. ... This newsgroup only focuses on SBS technical issues. ... This is something new for 2005 as you need to have an account ...
    (microsoft.public.windows.server.sbs)