Microsoft recommends that you do not use the Network Service account to run the SQL Server service (see http://msdn2.microsoft.com/en-us/library/ms143504.aspx).
Can anyone tell me what the drawbacks are of doing this?
I am trying to connect to a sql server from my asp.net application via windows authentication using the Network Service account. When I try to create a login for the ComputerNameNetwork Service account I get the following error.
I know I haven't mistyped it because I clicked the check names button and it showed as a valid id.
So what gives?
TITLE: Microsoft SQL Server Management Studio Express
------------------------------
Create failed for Login 'PREMIERDCNetwork Service'. (Microsoft.SqlServer.Express.Smo)
For help, click: http://go.microsoft.com/fwlink?ProdName=Microsoft+SQL+Server&ProdVer=9.00.3042.00&EvtSrc=Microsoft.SqlServer.Management.Smo.ExceptionTemplates.FailedOperationExceptionText&EvtID=Create+Login&LinkId=20476
------------------------------
ADDITIONAL INFORMATION:
An exception occurred while executing a Transact-SQL statement or batch. (Microsoft.SqlServer.Express.ConnectionInfo)
------------------------------
Windows NT user or group 'PREMIERDCNetwork Service' not found. Check the name again. (Microsoft SQL Server, Error: 15401)
For help, click: http://go.microsoft.com/fwlink?ProdName=Microsoft+SQL+Server&ProdVer=09.00.3042&EvtSrc=MSSQLServer&EvtID=15401&LinkId=20476
------------------------------
BUTTONS:
OK
------------------------------
Without going to services.msc / configuration manager, is there anyway to know the service account through which SQL server is running?
View 6 Replies View RelatedHi
Using SQL Server 2005 with SP1, I have successfully managed to schedule jobs to run SSIS packages. They connect to another SQLServer 2000 box, using SQLOLEDB connection manager, to extract data and import it into SQL 2005. The protection level for the packages is Server storage so that the job is run under the SQL Agent account. This is a specific domain account so that it can access other servers.
However, using the same setup for a scheduled job to to run an SSIS package which connects to another SQL Server 2000 box with connection manager SQL OLEDB, I get the following error message:
The AcquireConnection method call to the connection manager "xxx" failed with error code 0xC0202009.
As the both the successful and failed jobs seem to have been set up in the same way with the same protection levels and are both run under a domain sql agent account, is there anything else I should be checking that I don't know about?
Any help is much appreciated!
Hello,
I am totally confused by what account I should be running my sql server database and my business layer service as.
I take it that when installing sqlserver and my service that I should be logged in as administrator.
Should I be using "Local Service", "Local System" or "Network Service" to run these processes as?
Summary of my business layer service
* Clients connect to this service on a tcp/ip port
* It accesses the file system
* it connects to the database
Thanks,
JP
Hello! I have the following problem. I developed CLR Stored Procedure "StartNotification" and deploy it on db. This sp calls external web service. Furthermore, this sp is called according with SQL Server Agent Job's schedule. On my PC SQL Server works under Local System account and this web service is called correctly (Executed as user: NT AUTHORITYSYSTEM). But on ther other server the following exception is raised during job running:
Date 17.04.2007 16:42:10
Log Job History (FailureNotificationJob)
Step ID 1
Server MSK-CDBPO-01
Job Name FailureNotificationJob
Step Name MainStep
Duration 00:00:00
Sql Severity 16
Sql Message ID 6522
Operator Emailed
Operator Net sent
Operator Paged
Retries Attempted 0
Message
Executed as user: CORPmssqlserver.
A .NET Framework error occurred during execution
of user defined routine or aggregate 'StartNotification':
System.Security.SecurityException: Request for the permission of type
'System.Net.WebPermission, System, Version=2.0.0.0, Culture=neutral,
PublicKeyToken=b77a5c561934e089' failed. System.Security.SecurityException:
at System.Security.CodeAccessSecurityEngine.Check(Object demand,
StackCrawlMark& stackMark, Boolean isPermSet)
at System.Security.CodeAccessPermission.Demand()
at System.Net. The step failed.
What is the reason of this behaviour? Unfortunately I do not have direct access to this server.
I have the following guesses:
1) CORPmssqlserver may have not enough permissions to call web service
2) Something wrong with SQL Server account's permissions
2) Something wrong with SQL Server Agent account's permissions
I will take the will for the deed. Thanks.
Hi all,
I do understand that it is highly recomended to have aserprate user (perfered a domain user account) for each of the SQL Server service and SQL Agent service.
What is the reason behind that? (Someone told me to not run the service with an account that has a powerul privilegs! - I don't undrstanmd this point can you explain it please?)
What is the diffrent between: 1- Local System account 2 -Network Service account
Thanks in advanced!
CS4Ever
Okay now this is weird, today the Reporting Services was not running and here are the entries in the event log:
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7041
Date: 12/12/2007
Time: 9:47:22
User: N/A
Computer: TFS
Description:
The ReportServer service was unable to log on as DOMAINTFSREPORTS with the currently configured password due to the following error:
Logon failure: the user has not been granted the requested logon type at this computer.
Service: ReportServer
Domain and account: DOMAINTFSREPORTS
This service account does not have the necessary user right "Log on as a service."
User Action
Assign "Log on as a service" to the service account on this computer. You can use Local Security Settings (Secpol.msc) to do this. If this computer is a node in a cluster, check that this user right is assigned to the Cluster service account on all nodes in the cluster.
If you have already assigned this user right to the service account, and the user right appears to be removed, a Group Policy object associated with this node might be removing the right. Check with your domain administrator to find out if this is happening.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp
I am the administrator of the machines and I can assure you that no domain policy has changed for a couple of weeks. What should I look for?
During install of SQL Server 2005, we can of course use a domain account or the built-in system account for running the services. I lean toward domain for obvious reaons but would like to know a +/- to each option and why I'd choose one over the other and what consequences or limitations one may encounter if I choose one over the other.
View 6 Replies View RelatedI have several DTS jobs that runs well as a job with my nt login account for the SQL agent service startup account, but if I use the System account
they fail with this error.
" Error opening datafile: Access is denied. Error source: Microsoft Data Transformation Services Flat File Rowset Provider"
The data has change access to the System account under the NT security.
Thank you in advanced.
Jorge
Hello Reporting Services 2005 users or Reporting Services Team,
I have done everything to get pass this error but no luck.
My setup is :- WIndows 2003 Standared Edition SP1
Sql Server :-
Microsoft SQL Server 2005 - 9.00.1399.06 (Intel X86) Oct 14 2005 00:33:37 Copyright (c) 1988-2005 Microsoft Corporation Standard Edition on Windows NT 5.2 (Build 3790: Service Pack 1)
Reporting Services starting SKU: Standard.
From the Reporting Services Configuration Manager:
I can see all other things configured except Encryption Keys(blue sign)
Initialization(Grey sign) and Execution Acct(Yellow sign)
My windows Service Identity is using :
NT AuthorityNetworkService
Builtin Acct :NetworkService
Web Service Identity :-
ASP.NET Service Acct :- NT AuthorityNetworkService
DataBase Setup :- Credentials Type :- Service Credentials
I have also done everything from here thanks to Göran
http://stevenharman.net/blog/archive/2007/03/21/Avoiding-the-401-Unauthorized-Error-when-Using-the-ReportViewer-in.aspx
and
http://support.microsoft.com/default.aspx?scid=kb;en-us;896861
and
http://forum.k2workflow.com/viewtopic.php?t=619&
If you guys any solution for this please let me know.
I was wondering could this be a scale-out deployment issue ?
I also get the error when setting up the DataBase Setup :
Although saving the database connection info succeeded the The report server cannot access internal info about this deployment to determine whetherthe current con fig is valid for this editionThis could be a scale-out deployment and that the feature is not supported by this editionTo continue use a diff report server database or remove the encription keys
My Error log file is below:-
w3wp!webserver!5!16/05/2007-14:52:46:: i INFO: Reporting Web Server started
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing ConnectionType to '0' as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing IsSchedulingService to 'True' as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing IsNotificationService to 'True' as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing IsEventService to 'True' as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing PollingInterval to '10' second(s) as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing WindowsServiceUseFileShareStorage to 'False' as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing MemoryLimit to '60' percent as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing RecycleTime to '720' minute(s) as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing MaximumMemoryLimit to '80' percent as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing MaxAppDomainUnloadTime to '30' minute(s) as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing MaxQueueThreads to '0' thread(s) as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing IsWebServiceEnabled to 'True' as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing MaxActiveReqForOneUser to '20' requests(s) as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing MaxScheduleWait to '5' second(s) as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing DatabaseQueryTimeout to '120' second(s) as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing ProcessRecycleOptions to '0' as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing RunningRequestsScavengerCycle to '60' second(s) as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing RunningRequestsDbCycle to '60' second(s) as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing RunningRequestsAge to '30' second(s) as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing CleanupCycleMinutes to '10' minute(s) as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing DailyCleanupMinuteOfDay to default value of '120' minutes since midnight because it was not specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing WatsonFlags to '1064' as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing WatsonDumpOnExceptions to 'Microsoft.ReportingServices.Diagnostics.Utilities.InternalCatalogException,Microsoft.ReportingServices.Modeling.InternalModelingException' as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing WatsonDumpExcludeIfContainsExceptions to 'System.Data.SqlClient.SqlException,System.Threading.ThreadAbortException' as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing SecureConnectionLevel to '0' as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing DisplayErrorLink to 'True' as specified in Configuration file.
w3wp!library!5!16/05/2007-14:52:46:: i INFO: Initializing WebServiceUseFileShareStorage to 'False' as specified in Configuration file.
w3wp!resourceutilities!5!16/05/2007-14:52:46:: i INFO: Reporting Services starting SKU: Standard
w3wp!resourceutilities!5!16/05/2007-14:52:46:: i INFO: Evaluation copy: 0 days left
w3wp!resourceutilities!5!16/05/2007-14:52:46:: i INFO: Running on 1 physical processors, 2 logical processors
w3wp!runningjobs!5!16/05/2007-14:52:46:: i INFO: Database Cleanup (Web Service) timer enabled: Next Event: 600 seconds. Cycle: 600 seconds
w3wp!runningjobs!5!16/05/2007-14:52:46:: i INFO: Running Requests Scavenger timer enabled: Next Event: 60 seconds. Cycle: 60 seconds
w3wp!runningjobs!5!16/05/2007-14:52:46:: i INFO: Running Requests DB timer enabled: Next Event: 60 seconds. Cycle: 60 seconds
w3wp!runningjobs!5!16/05/2007-14:52:46:: i INFO: Memory stats update timer enabled: Next Event: 60 seconds. Cycle: 60 seconds
w3wp!library!5!05/16/2007-14:52:48:: i INFO: Call to GetPermissions:/
w3wp!library!5!05/16/2007-14:52:48:: i INFO: Catalog SQL Server Edition = Standard
w3wp!library!5!05/16/2007-14:52:48:: e ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.ReportServerServiceUnavailableException: The Report Server Windows service 'ReportServer' is not running. The service must be running to use Report Server., ;
Info: Microsoft.ReportingServices.Diagnostics.Utilities.ReportServerServiceUnavailableException: The Report Server Windows service 'ReportServer' is not running. The service must be running to use Report Server.
w3wp!library!5!05/16/2007-14:52:48:: e ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.ReportServerServiceUnavailableException: The Report Server Windows service 'ReportServer' is not running. The service must be running to use Report Server., ;
Info: Microsoft.ReportingServices.Diagnostics.Utilities.ReportServerServiceUnavailableException: The Report Server Windows service 'ReportServer' is not running. The service must be running to use Report Server.
w3wp!library!5!05/16/2007-14:52:49:: e ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.ReportServerServiceUnavailableException: The Report Server Windows service 'ReportServer' is not running. The service must be running to use Report Server., ;
Info: Microsoft.ReportingServices.Diagnostics.Utilities.ReportServerServiceUnavailableException: The Report Server Windows service 'ReportServer' is not running. The service must be running to use Report Server.
w3wp!library!5!05/16/2007-14:52:49:: e ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.ReportServerServiceUnavailableException: The Report Server Windows service 'ReportServer' is not running. The service must be running to use Report Server., ;
Info: Microsoft.ReportingServices.Diagnostics.Utilities.ReportServerServiceUnavailableException: The Report Server Windows service 'ReportServer' is not running. The service must be running to use Report Server.
How can I find account that the SQL Server service is using ?
Plz help.
hi.. i do not know which to choose when my installation comes to the service account page ..
should i use the local system or write the domain user account ?
i use domain user account .. but what is my domain ?
Folks,
MSSQLServer and SQL Server Agent services under NT are running under a system account under our domain (setup many moons ago) for which we have lost the passsword. Is there any way we can recover these passwords?
Thanks.
Sam
Hi,
I am trying to set properties on a SQL Server7, but when I get to the tab for 'Startup Service account', it is greyed out. Also, the same for properties for SQL Server Agent.
Why can't I change it?
To schedule jobs, and have SQL mail, don't I need to set up a Startup Service Account?
Thanks for your help,
Judith
Has anyone ever converted from running SQL Server under the Local System account to running under a Domain User account?
I have often installed SQL using a Domain User account, but I am inheriting a couple of SQL Servers that were set up to run under Local System. I have never had to convert "on the fly" before.
If you have any input or insights, I would be grateful.
Regards,
hmscott
I just set up a SQL 2005 Server about a month ago that we will be moving all of our scattered DBs onto. I basically set it up with the default settings and didn't touch anything special, until I tried to install Microsoft System Center Essentials 2007 in our environment. I had problems getting it to use our SQL server, and a forum post told me to change all of the service accounts for SQL to use the LocalSystem login. So here are my service accounts:
SQL Server Integration Services
- NT AUTHORITYNetworkService
SQL Server FullText Search (MSSQLSERVER)
- LocalSystem
SQL Server (MSSQLSERVER)
- LocalSystem
SQL Server Analysis Services (MSSQLSERVER)
- LocalSystem
SQL Server Reporting Services (MSSQLSERVER)
- LocalSystem
SQL Server Browser
- LocalSystem
SQL Server Agent (MSSQLSERVER)
- LocalSystem
So Sandisk makes this software called CMC. It's for controlling their enterprise USB drives. And their software won't install. It errors out saying that it couldn't drop the database on our SQL server (but it doesn't exist). If I make an empty DB by the same name, it sees it, and then errors out anyway. I am using the SA login for testing (I was using a purposed SQL account before) so I don't think it's a rights issue. Sandisk says it should work, and they suggested I use SQL server express. But we run VMs, and running SQL server in another VM is going to use more of our memory pool. Plus we want centralized backups and all that.
Do my service account logins have anything to do with it? Can someone tell me what these should be set to by default so I can change them back?
Here's a trace I did when I tried to install the software:
-- network protocol: TCP/IP
set quoted_identifier on
set arithabort off
set numeric_roundabort off
set ansi_warnings on
set ansi_padding on
set ansi_nulls on
set concat_null_yields_null on
set cursor_close_on_commit off
set implicit_transactions off
set language us_english
set dateformat mdy
set datefirst 7
set transaction isolation level read committed
set implicit_transactions on
go
drop database [CruzerDb]
go
IF @@TRANCOUNT > 0 ROLLBACK TRAN
go
And here's more info if needed:
Product Version
- 9.00.3042.00
Edition
- Standard Edition
Server Collation
- SQL_Latin1_General_CP1_CI_AS
Is Clustered
- No
Is FullText Installed
- Yes
Is Integrated Security Only
- No
Is AWE Enabled
- No
# Processors (used by instance)
- 2
SqlServer2k is on the domain serverSqlServer2k is on a laptop tooI want to copy a database from the domain to the laptop over the networkusing the copy database wizard.I have done this before with no problem but this time I get thefollowing error:Your SQL Server Service is running under the local system account. Youneed to change your SQL Server Service account to have the rights tocopy files over the network.I went into the properties of MSSQLSERVER under Services andApplications and see no setting described.Where do manage the SQL Server Service?*** Sent via Developersdex http://www.developersdex.com ***Don't just participate in USENET...get rewarded for it!
View 3 Replies View Related
By default does CLR code run under the SQL Service Server account or the SQL Agent Service Account? Does anybody have a link to BOL or MSDN???
My assumption is its under SQL Server Service Account.
I'm trying to satisfy the DBA's security concerns in regards to CLR Code. If the account it runs under (Agent or service) has zero privliges will a dba still be able to maintain the server? Wouldnt all their backups work under a privilaged account that isnt the SQL Server Service Account?
Double posted in security.
Hi,
I come from an Oracle background, and am having trouble getting to grips with SqlServer
I've installed SqlServer 2005 and created a Database called Midas, which is owned by SA
I've created a login called ServiceAccount. I want this login to have 'select', 'update' and 'insert' permission on specific tables in the Midas database. How do I do this?
Hi All,
I understand Sql Server Integration Services by default uses"NT AuthorityNetwork Service" account as service account. Is running SSIS using "NT AuthorityNetwork Service" account is good or should we create a domain account to run the SSIS service.
Regards, Balaji Thiruvenkataraju.
On the screen "Service Account" during SQL 2005 Developer Edition, I am choosing built-in System Account = Local System and uncheck the Customzie for each service account. that means, that this system account is set to all services,
Right?
please refresh my memory on this.
Thanks,
I am trying to install an SQL Express 2005 instance and have the built-in system account set to "Local system" because I was having some security issues while trying to attach a database. Is there a command line switch that will allow me to do this?
If there isn't then I will have to make sure the clients uncheck the "Hide advanced settings" checkbox and I would rather not have them do anything but hit the next button.
I am installing RS2005 on Windows server 2000 with IIS 5.0. Everything is fine in configuration tool except service account. It is empty. I have added ASPNET account in reportservice user group and tried to add <machinename>ASPNET to <WebServiceAccount>. It is still empty. Any idea?
Thanks.
Hi All,
We are upgrading from Sql Server Express to SQl Server 2005. As part of the installation process, it is not asking us to specify a service account for various services, and we are not sure what to specify. (This was handled automatically with Express). Any ideas?
Thanks.
Claude.
I would like to enter info into the startup service account so that the MS
SQL Server Agent will run under this account. Then I can run jobs.
However, I don't know why the "startup service account" info is
greyed out, which prevents me from entering this information.
Any help would be appreciated!!
We have changed NT Administration Password. Now how to reassign the new password setting for sql server service account. As right now all schedule jobs are getting failed & needs to be executed manually.
Thanks in Advance
Manoj
Ugh! Someone changed the password of our SQL Server service account. It is called syssql, and it is used by the MSSQLServer and SQL Executive services to log in at startup. After the password was changed, we noticed that replication wasn’t running, and since I know that replication uses the Executive service, I restarted that service using the new password. That worked to get replication working again, and since the boxes were production machines I didn’t restart the MSSQLServer service with the new password yet. Now, our syssql account keeps on locking up every so often, and scheduled tasks that use xp_sendmail stopped working, and alerts stopped sending. Is this happening because of the MSSQLServer service still being logged in with the old password? I suspect that the SQL Mail logs in through the MSSQLServer service, which is still using the old password, and the login failures are causing the syssql account to lock. Any other ideas???
Cindy Rutherfurd
cindy.rutherfurd@zcsterling.com
We are debating whether to run the SQL Server service as Local System, a domain user without local admin rights, or a domain user with local admin rights. MSDN recommends local admin rights, but doesn't require them.
I would like to get some idea of how the real world handles this. If you run as a local admin, how do you handle the security implications? And if you run without local admin rights, what gotchas have you run into with extended stored procs, replication, etc?
Thanks,
Jerry Ratner
I have an older instance of SQL Server (2000) used for an old installation of Great Plains. Over the years there have been several custom application built to interface various accounting related systems with the data on this server.
Recently there have been several instances where random transactions are being deleted. The folks in the accounting group setup Great Plains to track any deletes from the GL account and determine who did the deletes. They're telling me that the same account we use to launch SQL Server is the account deleting the data.
It's possible that someone knows the login creds for this account and is using it to do some task that's causing the problem, but that's a long shot in my opinion. I rather believe that one of these custom interface apps is causing the problem.
One of the custom interfaces includes several SQL jobs that run that do some truncating and bulk inserting. In each case these jobs are owned by the sa account. If one of these jobs deleted the data would it be reported as being deleted by sa or by the service account since that's the account that launches SQL Server Agent?
I have a SQL 2000 (SP3) running on a Windows NT 4.0 (SP6) box used in our test environment. The SQL Server was configured to run under the local system account before I got here. In an effort to standardize things, I tried changing the SQL Service account to run under a designated domain user account purpose built for the job. We use this particular account for all of our new-build servers (which are W2K). This domain account is configured to be a "Power User" on the NT 4.0 Server in question.
Soon after changing things over to run under the new account, all the developers complained that they could no longer connect to the server. I could through QA and EM, but none of the developers could.
The developers are using WebLogic and JDBC drivers for the most part. I wasn't aware that the SQL Server service account affected client connectivity. Was I wrong or is there something else at work here?
Thanks,
hmscott
I have recently installed 2005 Standard and 2005 Reporting Services (on a separate server), today we built a service account for the SQL services in Active Directory. I planned to use SQL Configuration tools to change the account but it fails with the message:
'No mapping between account names and security IDs was done'
I ended up going through and following the manual steps outlined in KB article 283811 - http://support.microsoft.com/default.aspx?scid=kb;en-us;Q283811
But I am baffled and concerned as to why it failed.
Any advice?
Future guru in the making.
We are running SQL Server 2000 on two servers and when they were built, the same domain account was used for all installations, and the MSSQLSERVER and SQLServerAgent services run logged in as that same account. That account is also the dbo of all the SQL databases. We now need to change the password and possibly disable that domain account.
What do we need to do to make sure the SQL Servers and databases continue to run without problems after making the password change and/or disabling the account?
I appreciate any advice!