x

Accounts created when SQL Server 2008 installed on Win2008

We have installed SQL Server 2008 on a Win2008 server. We use a domain\SQLServices account for both the instance service and the Agent. When we looked at the accounts created in the new instance, we found: NT SERVICE\MSSQLSERVER and NT SERVICE\SQLSERVERAGENT both with Sysadmin privs. What are these used for? Why don't we see the domain\SQLServices account that is running the services added? We found this article - http://support.microsoft.com/kb/955763 that warns against removing these accounts, but I can't find additional docs on the 2 accounts. Thanks!

more ▼

asked Dec 16, 2009 at 06:21 PM in Default

SailAway gravatar image

SailAway
37 2 2 2

(comments are locked)
10|1200 characters needed characters left

2 answers: sort voted first

Aren't those the IDs associated with the groups that contain the account domain\SQLServices? Ie... if you go to the "Local Users & Groups" section of Computer Management, you will see a bunch of groups in there, as a way of assigning sufficient permission to a user to run the particular service.

So if you look in the group for SQL Agent, you should see your SQLServices account in there. If you go into SQL Config Mgr and change the service account for SQL Agent, you should see the SQLServices account removed from that group and the new account put in. This is how the system lets you use a low privilege account for those services.

To be able to run the SQL & SQL Agent services, the accounts used need to be in the sysadmin role. But that's okay, because no-one other than the service should be logging on as that account.

more ▼

answered Dec 16, 2009 at 11:15 PM

Rob Farley gravatar image

Rob Farley
5.7k 15 18 20

You're right I do see the NT SERVICE\SQLSERVERAGENT in the OS groups created for SQL Agent. However, we used to see the domain\account in this group. Where is that connection? In otherwords where do I see that domain\account is a member of NT SERVICE\SQLSERVERAGENT?
Dec 17, 2009 at 11:53 AM SailAway
(comments are locked)
10|1200 characters needed characters left

the service for SQL does not need to be sysadmin.

more ▼

answered May 28, 2010 at 10:47 AM

alex 3 gravatar image

alex 3
1

(comments are locked)
10|1200 characters needed characters left
Your answer
toggle preview:

Up to 2 attachments (including images) can be used with a maximum of 524.3 kB each and 1.0 MB total.

New code box

There's a new way to format code on the site - the red speech bubble logo will automatically format T-SQL for you. The original code box is still there for XML, etc. More details here.

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

SQL Server Central

Need long-form SQL discussion? SQLserverCentral.com is the place.

Topics:

x1832
x161
x66

asked: Dec 16, 2009 at 06:21 PM

Seen: 6583 times

Last Updated: Dec 16, 2009 at 06:21 PM