Re: SQL DBA Permissions

From: Andrew Mitchell (amitchel_at_removecasey.vic.gov.au)
Date: 03/26/04 

Date: Fri, 26 Mar 2004 06:05:03 -0800

"Oli Restorick [MVP]" <oli@mvps.org> said

> You are talking about the account your DBA uses to log on and not the
> SQL Server service account (which requires surprisingly low privileges
> at the machine it's running on), aren't you?
>

While we're on the subject, what permissions does the service account for SQL
require?
I recently attended the MS security presentation in Melbourne, and we were
advised that the service acct only needs restricted privileges, but I have
been unable to find out exactly what it needs.

It would be nice if MS provided a web page stating what the various services
(SQL, Exchange, SMS etc.) need in order to operate correctly. Having it all
listed on one page would make it very convenient.

Andy.

Relevant Pages

  • Re: SPN creation
    ... will i need to create an spn for the live sql server service account in order ... front end website to get Kerb delegation to the backend if your AD is 2003 ... form port-specific SPNs for HTTP, ...
    (microsoft.public.windows.server.active_directory)
  • Re: SPN for SSL over common name
    ... you can't register those SPNs under the SQL Server's ... service account is the MSSQL SPN. ... That SPN should be registered under ... Lastly, since the SQL Server is not being used for delegation anywhere, ...
    (microsoft.public.inetserver.iis.security)
  • Cannot Use Non-Administrator Account to Start SQL Server and Force Encryption
    ... I changed the service account of a named instance (product ... a certificate from a Microsft Certificate Server ... the SQL Service. ... SQL Server could not spawn FRunCM thread. ...
    (microsoft.public.sqlserver.security)
  • Re: kerberos SQL service accounts
    ... Also, on the delegation question, you only need to enable delegation on the SQL service account if SQL will be making a call to a remote system on behalf of a remote user it is impersonating. ...
    (microsoft.public.windows.server.active_directory)
  • Re: kerberos SQL service accounts
    ... You'll get the best match of "Kerberos working by default" and good security by deciding to use Network Service as the service account for SQL rather than either System or a fixed domain account. ... The reason for this is that when SQL is installed and configured to be run under either Network Service or System, the installer will actually add the appropriate Kerb SPNs to the domain computer account. ...
    (microsoft.public.windows.server.active_directory)