My company doesn't allow using Local Service / Network Service accounts for SQL Server. So I created domain service accounts. Can multiple SQL Server installations use the same domain service accounts ?
View 4 RepliesI am working with a client who is rolling out 50+ VM's based of a template we created. This is SQL 2012 CU1 running on Windows Server 2008 R2. Using the default service account the installer has it registers fine and we get the following in the SQL log.
The SQL Server Network Interface library successfully registered the Service Principal Name (SPN) [ MSSQLSvc/server.domain.com:1433 ] for the SQL Server service.
When we change to a domain service account through SQL configuration manager we see the following and cannot connect remote using integrated authentication The SQL Server Network Interface library could not register the Service Principal Name (SPN) [ MSSQLSvc/server.domain.com:1433 ] for the SQL Server service. Windows return code: 0x2098, state: 15. Failure to register a SPN might cause integrated authentication to use NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies and if the SPN has not been manually registered.
My understanding is you should and could change service accounts using the SQL Server Configuration Manager and it would set all permissions. Is there something we need to do in addition to get this up and working?
Convert DTS to SSIS |
Document SSIS |
30+ SSIS Tasks |
Real-time SSIS Monitoring |
Quick Starts |
BI Blitz
Installed sql server 2012 enterprise. Runs with the built in account fine.
I tried entering a domain account to run as the service account from sql configuration it fails with the error "the specified network password is not correct".
I tried from services.msc and entered successfully but when I try to restart it fails that the log in credentials are wrong.
the domain account and password I entered are just fine. What's it I should do or missing?
Hi There
I am doing an unattended upgrade of Sql Express with Advanced Services SP1.
Before the upgrade the services run under domain accounts.
I use the following command :
start /wait setup UPGRADE=SQL_Engine INSTANCENAME=MSSQLSERVER SQLACCOUNT=DOMAINUser SQLPASSWORD=p@ssw0rd ADDLOCAL=Client_Components,SQL_SSMSEE /qn
However after the ugrade the service accounts are running under local system.
Documentation is unclear, i find the following:
; The services for SQL Server and Analysis Server are set auto start. To use the *ACCOUNT settings
; make sure to specify the DOMAIN, e.g. SQLACCOUNT=DOMAINNAMEACCOUNT
; NOTE: When installing SQL_Engine 3 accounts are REQUIRED: SQLACCOUNT, AGTACCOUNT and SQLBROWSERACCOUNT.
; SQLACCOUNT Examples:
; SQLACCOUNT=<domainuser>
; SQLACCOUNT="NT AUTHORITYSYSTEM"
; SQLACCOUNT="NT AUTHORITYNETWORK SERVICE"
; SQLACCOUNT="NT AUTHORITYLOCAL SERVICE"
To my knowledge the <> is not required.
Can someone please help as i cannot get the services accounts to run under a domain user after upgrade.
Thanx
I'm trying to install SQL 2005 onto a 2012 R2 server. The install is failing at the end when it is trying to start the database service. I have looked in the install logs and I'm getting the following error. I'm running 8 virtual processors on the virtual machine (8 Cores). URL...
Error 29503. The SQL Server service failed to start. For more information, see the SQL Server Books Online topics, "How to: View SQL Server 2005 Setup Log Files" and "Starting SQL Server Manually."The error is (1067) The process terminated unexpectedly.
<Failure Type='Fatal' Error='1067'>
<EndFunc Name='LaunchFunction' Return='1067' GetLastError='203'>
CustomAction Do_sqlScript.3EA9D9BF_D9D2_4023_B2A7_9E2137B2FB1B returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
05/18/2015 14:56:41.705 [4924]: Assembly Install: Failing with hr=80070005 at RemoveDirectoryAndChildren, line 396
[code]...
Do we still need the below service accounts in SQL 2008+ version even if we have proper SQL service accounts added in the logins?
[NT AUTHORITYSYSTEM]
[NT ServiceMSSQLSERVER]
[NT SERVICEReportServer]
[NT SERVICESQLSERVERAGENT]
[NT SERVICESQLWriter]
[NT SERVICEWinmgmt]
I cannot get a consistent answer as to how many domain accounts would be suggested in a SQL Server 2014 installation. Previously the recommendation was a separate account for each service to provide isolation and minimum permissions for each account. It seems from what I've read that a single domain account would have something added to make it unique from SQL Server's perspective. Several still advocate multiple accounts. I don't know if they are doing so because that's the way it's always been done or if there is still some compelling reason to do so. I don't want to create unnecessary accounts simply because something is "ideal."
View 8 Replies View RelatedIf I install a new named instance of SQL Server 2008 R2 on a machine that already has 3 named instances that are upgraded to service pack 3, will the install of the new instance overwrite any of the current SP3 files? Will I have to re-apply SP 3 to the existing instances?
View 4 Replies View RelatedI have a root domain and child domain.
After using ADMT to migrate the domain user or group into the root domain, when I use enterprise manager to try and change the permissions allocated to that domain user/group, i get the 'Error 15401 NT user or Group not found'.
This is a correct error as the user is now in the root domain, however sql (in sysxlogins) still thinks its in the child domain.
Is there a simpler way, other than collecting the users permissions, deleting the user from SQL then adding back in with the correct domainusername format, then adding the permissions back?
I tried renaming the 'name' in sysxlogins (not recommended) and while that worked, whenever I tried to add the migrated user to another database, the login name was missing and would not resolve.
I believe it is something to do with the SID not matching.
Any ideas on how to fix this ?
Hi There
Currently we run a certain instance , agent under local system on a server.
I want to create specific domain accounts for the sql server service and agent, now i know that one should create these accounts with the least priviledge for security reasons.
cannot find the topic in BOL, can some please give me the BOL topic or a link to exactly what the least priviledge is for the domain accounts for sql server services.
Thanx
I installed a SQL server 2008 R2 on a 64 bit Stand alone system today morning
Now I am trying to apply SP1 on it. But it is not progressing further with the below. How to overcome this issue.
Note: Cluster services not installed on this server. Cluster service is not there in the services.msc as well.
I needed to re-install the entire sql server 2005, I used add/remove program. everything went normal, except reporting service. I deleted the entire upper sql server directory, rebooted the box, however, it still shows up in services, even though the path does not exist. I tried to reinstall it again, but it complains about name already exists. I cannot change the name, but I am not able to find how I can remove it and reinstall it properly.
Last Action : DetectInstanceClash
Error String : An instance with the same name is already installed on this computer. To proceed with SQL Server Setup, provide a unique instance name.
Error Number : 28086
I have a question about Service Packs and Cumulative Updates for SQL 2008 R2.
Do you need to apply them in the order that they are released? Or can you just apply the latest Service Pack and Cumulative Update?
Hello all,
I have 2 networked PC's both running vista ultimate
1st is Laptop and is running its own SQL Server at laptoplaptopSQL
2nd is Desktop and is running its own SQL Server at desktopdesktopSQL
Now both machines have seperate windows login accounts.
When I go SQL Server management studio I go to browse and each machine can see the other machines SQL Server, but when I go to login I get SQL Login falied for users" The user is not associaed with a trusted SQL server connection".
So I then go to logins new login and try to add my other pc's user account.
The problem I see is that when I go to search and then location it only shows its own PC's location and not the location of my other networked pc? So if I am on Desktop and in my theory want to add laptopuser to the desktop SQL Server logins I get:
"create failed for login laptopuser
An exception occurred while executing Transact SQL statement laptopuser is not a valid windows NT name. give the complete name
Not sure on where to go from here.
Any help would be great
I am running a number of SQL instances on my PC. Within the network, I have think server with various System Center components. For compatibility reasons, some features of System Center 2012 R2 had to be delegated to different SQL databases. My question is, because there is now more than one IP address on my system, and each instance of SQL is assigned to its own IP, is there a way to setup DNS and SQL so the namespace points to the desired IP address? For Instance:
MSSQL2008 instance is set to run on = 11.12.13.1
MSSQL2012 is set to run on = 11.12.13.2
IN DNS:
A Record: Mike-PC = 11.12.13.1
A Record: Mike-PC = 11.12.13.2
If I want to use MSSQL2008 by specifying Mike-PC as the DNS name, how would I do that with 100% accuracy? If there is another way to get the job done, I am more than willing to approach this differently.
I have 4 new SQL Server 2005 installations on Windows 2003 that I configured at our main office and shipped to a hosting center. All four servers are members of our domain. I set up test datbases with replication on one of the servers and facilitated this with a domain account.
Now that I've moved the servers to the hosting center (which has a DC) and I'm not having any luck adding domain accounts to the permissions section on any of the the SQL Server boxes.
When I try to add a domain account in the SQL Server's permissions window I get "Name Not Found". By every indication the server is connected to the domain. I can log on using my domain account; I can create shares specifying domain accounts but I can't seem to add domain accounts to the SQL server permissions. When I look in the permission's tab I still see the original domain account, I had added back in the main office, stranded by itself in the list of users. We're using mixed authentication by the way.
Why doesn't SQL Server recognize the domain? Where does it get it's list of users? Does the account I'm logging in with just not have the permission to add domain accounts? These diaglogs are slightly different from the normal 'add a user' dialog boxes.
I feel like this must be a simple oversight. Any help would be appreciated. I'd prefer to move away from local accounts to keep things simple.
Can I build a cluster by adding the cluster service, then the SQL instances, then add the other nodes and their passive SQL instances?I would lean to building the cluster first, the add the SQL instances.
View 4 Replies View RelatedWe're getting an error where we can't add a login with the full dns name of a user - domain.xyzuser, for example. Get an error 15401, "Windows NT user or group domain.xyzuser' not found". The domain has a different Netbios name and DNS domain names, so we can add the user when we use the form "netbiosnameuser". So far so good.
Unfortunately, we have another application - Office Share Point Server whose shared services provider won't run, giving errors in the event log every 60 seconds that "Windows NT user or group 'domain.xyzuser' not found".
It looks as if SQL insists upon listing users in the form netbiosdomainnameuser, and applications that look for domain.xyzuser simply fail to authenticate.
Suggestions?
jnfranc at yahoo period com
I am currently hardening our SQL 2012 (with AlwaysOn Availability Groups) environment. Both the SQL service and agent account are using service accounts (only domain user). SQL browser service is disabled. Permissions to all roles are handled by using domain groups.
Currently a lot of (default) NT Service accounts are listed (some with sysadmin privileges). Are there accounts that can be removed?
I am running a SQL 2008r2 install while logged onto the server with a local admin account, not a domain account. I am specifying a domain account to run the SQL service. The install fails saying the service account credentials are invalid but I am 99.9% sure they are right.My theory - the local admin account running Setup cannot validate the service account creds against AD. Is it a requirement to run Setup while logged on with a domain account?
View 4 Replies View Related
I'm attempting to write a script that I can execute accross 30 servers that will create a domain login and subsequently grant access to said account on all databases per server. The only problem that I'm running into is trying to dymanically create the login. Example source is below.
declare @sql varchar(1000)
declare @loginname varchar(50)
select @loginname = 'DOMAINaccountname'
set @sql = 'if not exists (select * from master.dbo.syslogins where name = N' + char(39) + 'DOMAINaccountname' + char(39) + ')' + char(10) + char(13)
set @sql = @sql + 'begin ' + char(10) + char(13)
set @sql = @sql + char(9) + 'exec master.dbo.sp_grantlogin ' + quotename(@loginname)
print @sql
exec (@sql)
Here is the generated output and the error. Any suggestions would be appreciated.
if not exists (select * from master.dbo.syslogins where name = N'DOMAINaccountname')
begin
exec master.dbo.sp_grantlogin [DOMAINaccountname]
Msg 102, Level 15, State 1, Line 3
Incorrect syntax near 'DOMAINaccountname'.
We're doing upgrades from SQL 2008 R2 to SQL 2014. This is blocked due to RS is installed but not configured. Our desired action is to uninstall RS and proceed with the upgrade. But when setuparp.exe is raised, it does not list all the features on the 'Select Features' page. In fact, it only lists the last 2 shared features (SQ Client Connectivity SDK and Microsoft Sync Framework). However, all items appear to be listed on the 'Select Instance' page including RS. I've seen this issue on 2 of our SQL 2008 R2 Servers already.
View 3 Replies View RelatedI'm trying to install SQL Server Management studio 2012 on my Windows 7 (x64) standalone laptop. When I click "New SQL stand-alone installation..." it runs a Setup Support Rules check and always fails "Setup Account Privileges". I've looked into the error and I keep getting that I need to change security rules but I don't have that option in window 7. How do I get around this without having to resort to a computer running Windows Server?
I have Visual Studio 2013 premium installed along with Localdb v11. I just want to connect and manage my database engine through SSMS when developing any application.
Can anyone tell me the purpose to using service accounts in SQL Server rather than just having the services start as a system account.
Thanks
John Shurer
john.shurer@gte.net
when i open my computer and want to use SQL SERVER and when iam connecting it this error will occur "A network related or instance specific Error in SQL SERVER 2012" Then aim going to Services and Find SQLSERVER and start the services and it will connect..My Question is that why every time iam going to Start the services..I want to connect Automatically when i click on connect button in sql server its very rediculous to go evrytime in Services. i update my window 8.1 to windows 10 before it will connect automatically no need to go in services to start the SQLSERVER.
View 5 Replies View RelatedI ran into problem while trying to install SQL Server 2008 to join to another node in a failover cluster ,you will find here the configuration doc and installation details. URL...
View 4 Replies View RelatedI am working on SQL Server 2014 and I want to know, Is it possible to change the location of SQL log file and will it affect to the database if it is possible to change its location?
View 4 Replies View RelatedI just had a question,
Is it possible to have a different account for the accoutn that starts the MSSQLServer service and the account tied to the Mail profile on the server?
We had created an account to start the SQLServer but we are in a network where we have a 1 way trust with another domain, we trust them but they dont trust us, and our exchange is on their domain.
WE currently use Windows authentication so our account used to start SQL Server would not be trusted by exchange.
Our thoughts on a solution were to have them create a service account that we would have access to the mailbox and would also start the SQL Server but thats it.
I was just wondering if anyone else had any other suggestions.
Thanks.
Hi Everyone. I have 150 SQL servers (2000 MSDE). They all run using various domain accounts as their service logins. Is there an automated way to find out those service logins? Maybe a query I could run on each server? I really do not want to go to each of those 150 servers and look at their properties manualy! :S Any help would be greatly appreciated! Thank you.
View 6 Replies View Related
Trying to install Backup Exec 12 which comes bundled with SQL Server 2005 Express.
OS is a clean install of Swedish Windows Server 2003 Std R2, fully patched.
SQL fails to install, and the following is in the SQL summary-log:
Product : Microsoft SQL Server 2005 Express Edition
Product Version : 9.2.3042.00
Install : Failed
Log File : C:ProgramMicrosoft SQL Server90Setup BootstrapLOGFilesSQLSetup0002_VAXSRV02_SQL.log
Last Action : Validate_ServiceAccounts
Error String : SQL Server Setup could not validate the service accounts. Either the service accounts have not been provided for all of the services being installed, or the specified username or password is incorrect. For each service, specify a valid username, password, and domain, or specify a built-in system account.
The logon account cannot be validated for the service SQL Server.
Error Number : 28075
Install log:
"C:Documents and SettingsadministratorSkrivbordBEWS_12.1364_32BIT_VERSIONWINNTINSTALLSQLExpressSQLEXPR.exe" /wait /qn /norestart /lv "C:ProgramMicrosoft SQL Server90Setup BootstrapLOGSummary.txt" INSTANCENAME=BKUPEXEC INSTALLSQLDIR="C:ProgramMicrosoft SQL Server" INSTALLSQLDATADIR="C:ProgramMicrosoft SQL Server" INSTALLSQLSHAREDIR="C:ProgramMicrosoft SQL Server" SQLACCOUNT="NT AUTHORITYSYSTEM" SQLPASSWORD="" ADDLOCAL=SQL_Engine,SQL_Data_Files,SQL_Replication,Client_Components,Connectivity SAPWD=**** DISABLENETWORKPROTOCOLS=0
03-19-2008,13:52:10 : V-225-53: ERROR: Failed to install SQL Express BKUPEXEC instance with error 28075.
Since the installation of SQL is bundled with the Backup Exec installation, there is no(?) possibility for me to specify usernames for the different services. The Backup Exec installation is initiated under the Domain Admin's login.
I suspect the problem occurs because of the OS not being English, but I am not sure. Have installed earlier versions of Backup Exec with SQL Server 2005 Express, on Swedish Windows Server 2003, before without issues.
No help at Veritas/Symantec's homepage.
Grateful for any help.
I have been reading through many postings here, through the MS SQL Server Unleashed book by SAMS, the MS SQL Tech article "Failover clustering for Microsoft SQL Server 2005 and SQL Server 2005 Analysis Services" for installing a brand new SQL 2005 2 node cluster.
So far I have not found the definitive answer that I am looking for and that is, what rights does the SQL service account need to work properly? One article states that it needs both Domain Admin permissions and local admin permissions (and this is a domain account by the way) and then another article states that it only needs domain users group permissions and the least amount of privledges possible.
Can anyone please tell me what is correct for installation and running the server? The more I read about this the more confused I get.
Please be patient as I am brand new to SQL.
Thank you very much!
Have a production server, 12 Enterprise, and we are adding a new app to an existing instance. Next app needs SSRS and that was not put in the install request a year ago for the instance.
I do not think a reboot is required but have been wrong before. There are no SPs applied to this server and only last week we were given go ahead from one app vendor to apply SPs. That would have been done in monthly maintenance cycle next weekend. Our test server is doing just fine with all apps on SP1.
I have destroyed the cluster in failover cluster manager and then i am trying to remove node from the sql server installation centre.I am facing the cluster node and cluster service verification errors.I am not able to start the cluster service in services as well.
View 4 Replies View Related