SQL Server Agent Doesn't Act As Batch Queue Login

[I originally posted this in the General Tools forum, but perhaps I'll get better response here...]



I am wondering if this is a bug or a (strange) feature: when a SQL Server Agent job step is a CmdExec job (properly configured for owner/proxy, etc), the step is invoked with the proper user credentials (of the 'Run As' account); HOWEVER, the job step doesn't ever seem to be logged in and thus the step does not pick up the critical local group membership(s) such as BATCH (my preference) or SERVICE, etc. Provided that the command consists solely of built-ins or specifically-permissioned executable invocations (permissioned to the specific 'Run as' account), all is well. However, if the command attempts to invoke general OS exe's (cmd.exe as a sub-shell, whoami, ftp, etc -- anything that is generally permissioned via a local group such as BATCH or SERVICE), such invocations fail with access denied. Specifying a CmdExec step with 'whoami /all' as the command demonstrates the missing group memberships.

(The only workaround seems to be to either crawl through the OS exes and assign permissions, or to grant administrator membership to the proxy credentials account.)

So, design feature or major annoyance?



[Additional info I left out: SS05 (same behavior on SP2 and SP1); on WS03R2-x64; in an Active Directory domain; 'Run as' account granted log on as service, log on as batch, etc.]



Thanks,

-frank