Permissions For Domain User Account

Jun 8, 2007

Hi,
I want to use a domain user account not belonging to local admin or domain admin groups in SQL 2000/2005 Enterprise edition. This is what I've done so far..
On the machine that is the Domain Controller:
- installed SQL 2005 as a domain admin

- created a domain user account using Active Directory Users and Computers. This user is only


"Member of" domain users; not any Administrators group.


- added this user to SQL Server Management Studio->Logins and in Server Roles assigned


sysadmin role.
Question 1: Do I need to give any additional permissions to this user to work with SQL?
Question 2: How can I test this user for basic SQL operations like database creation? Can I use Osql?
Question 3: Can I use this user account to login to my domain controller using remote desktop? I tried adding this user to remote users, but in vain.



Thanks!

View 3 Replies


ADVERTISEMENT

Problems With Change Sql Permissions After Migrating Domain User/group Accounts Into Root Domain

Apr 5, 2007

I have a root domain and child domain.



After using ADMT to migrate the domain user or group into the root domain, when I use enterprise manager to try and change the permissions allocated to that domain user/group, i get the 'Error 15401 NT user or Group not found'.



This is a correct error as the user is now in the root domain, however sql (in sysxlogins) still thinks its in the child domain.



Is there a simpler way, other than collecting the users permissions, deleting the user from SQL then adding back in with the correct domainusername format, then adding the permissions back?



I tried renaming the 'name' in sysxlogins (not recommended) and while that worked, whenever I tried to add the migrated user to another database, the login name was missing and would not resolve.



I believe it is something to do with the SID not matching.



Any ideas on how to fix this ?

View 1 Replies View Related

Domain User Account

Nov 3, 2006

New to SQL Server. Plan to install SQL Server 2005 standard edition on Windows 2k3. After searched a lot of places, still don't understand what exactly "domain user account" is. Could someone explain it to me?
1. Is this a OS account where SQL Server is running?
2. Or, is this an account under domain controller on other machine? Is this an account on DNS srver? How do I create it?
3. Or, is this an account in SQL Server?

Where is this account located? How do I manage it?

TIA.

View 4 Replies View Related

Domain User Or Local System Account ?

Jul 20, 2005

Hello,My server is part of a W2K domain. What do you advice me as account torun my SQL*Server, service started with a domain user account or aslocal system ?I need advices from a security point of view.Thank's in advance

View 4 Replies View Related

Trouble Logging In To SQL Server 2005 Express With Domain User Account

Sep 22, 2006

Hi all,

I have a SQL Server 2005 Express edition instance set up on one server, and IIS on another server.

The SQL Server process account is a domain user account, which I have added to the local groups that SQL Server created during installation (I originally used a local user account instead of domain account; however, the problem occurs with both).

SQL Server runs fine, and if I set my IIS application pool identity to a domain admin, my web app can access the database and retrieve the data necessary.

However, I have a domain user account that I want to use to run the app pool and retrieve the data. The domain user account is added to the IIS_WPG group on the web server. On the database server, I have created a login for the account, as well as added it to the db_datareader role of the database that is used for the site.

However, the user is not able to connect to the SQL Server. I get the "Login failed for user <user account>" error in ASP.NET. I also tried connecting with SQL Server Management Studio, and I get the same error. I checked and the user has connect permission to the database server.

With admin accounts, there are no problems logging in, etc.

Any pointers are appreciated,

Thanks,

SA.

Edit: I was able to find out that the State is 11 for the error. According to http://blogs.msdn.com/sql_protocols/archive/2006/02/21/536201.aspx, this indicates "Valid login but server access failure." I am not sure how to resolve this.

View 1 Replies View Related

Package Won't Run For Domain User With Full Control Permissions

Dec 1, 2007

I'm running my job from the command line using DTExec as follows:-

DTExec /FILE "C:MyPathMyPackage.dtsx" /CONFIGFILE "C:MyPathMyDtsConfig.xml" /MAXCONCURRENT " -1 "

When I log in as Administrator the package runs perfectly.
When I log in as Domain User (the one I really want to have running the package) I get:-

Started: 10:49:08 PM
Error: 2007-11-30 22:49:08.30
Code: 0xC0011007
Source: {807048F4-DE2A-465E-B9A7-82E163791556}
Description: Unable to load the package as XML because of package does not have a valid XML format. A specific XML parser error will be posted.
End Error

I have checked, and the Domain User has


"Full Control" permissions to the directory the package is in and

"Full Control" permissions for the DTSX file and

"Full Control" permissions to the directory the dtsConfig is in and
"Full Control" permissions for the dtsConfig fileAny suggestions as to what is wrong?

View 7 Replies View Related

Setting Permissions In Sql Server 2005 For Asp User Account

May 15, 2006

How would Set permissions  Sql  Server 2005 so that I can access a  asp page created in VWD and Sql Express.
 
On the production server i have just the one instance of Sql
 
I have the following connection string in the web config file:
 
<connectionStrings>
        <add name="ConnectionString" connectionString="server=serversNameXPRESS;uid=aspuser;pwd=aspuserPassworkd;database=DATABName" />
    </connectionStrings>
 
The account i setup to access the db in Sql 2005 Proper on the Production serve is Represented by the name in the above example as “aspuserâ€?. I created this user in security, logins. And  I gave permissions to this on the Db level “create procedure  delete, select, update insert.â€?
 
I get a error when i run the page in the browser that  says “login failed for aspuser.â€?
 
I know virtual directory is configured properly. I can run aspx page in the directory with out a db connection, without and error.
 
Any help would be greatly appreciated.

View 2 Replies View Related

Whether To Use Local System Account Or Domain Account For Service Account

Jan 5, 2006

During install of SQL Server 2005, we can of course use a domain account or the built-in system account for running the services.  I lean toward domain for obvious reaons but would like to know a +/- to each option and why I'd choose one over the other and what consequences or limitations one may encounter if I choose one over the other.

View 6 Replies View Related

How To Give Permissions To A Regular Domain User To Manage SQL Server Database Service?

Jan 22, 2008

After SQL Server 2005 Database Engine is installed by domain administrator, how to give permissions to a regular domain user so that user can control SQL Server Database service?

View 3 Replies View Related

Domain Account Vs Local Account For SQLServerAgent

Jul 20, 2005

Hi there,BOL notes that in order for replication agents to run properly, theSQLServerAgent must run as a domain account which has privledges to loginto the other machines involved in replication (under "SecurityConsiderations" and elsewhere). This makes sense; however, I waswondering if there were any repercussions to using duplicate localaccounts to establish replication where a domain was not available.Anotherwords, create a local windows account "johndoe" on both machines(with the same password), grant that account access to SQL Server onboth machines, and then have SQL Server Agent run as "johndoe" on bothmachines. I do not feel this is an ideal solution but I havecircumstances under which I may not have a domain available; mypreliminary tests seem to work.Also, are there any similar considerations regarding the MSSQLSERVERservice, or can I always leave that as local system?Dave

View 1 Replies View Related

Domain Account Without A SQL Login Account

Apr 25, 2007

I have a situation that I have discovered in our QA database that I need to resolve. When I looked at the Activity Monitor for our server, I discovered that a process is running under a domain user account for one of our .Net applications. The problem is that that domain user account has not been created as a SQL login account on the server. I am trying to figure out how someone can log in to the database server with a domain user account that has not been added to SQL Server as a login account.



Does anyone have any insight on this? I don't like the idea of someone being able to create domain account that can access the database without me granting them specific access.



- Larry

View 6 Replies View Related

User On Trusted Domain Does Have Permission To Access Linked Server On AD Deployed In Another Domain

Sep 28, 2007

Hi,
We have the followoing:

-A "master domain" AD, a "sub domain" AD, a trust relationship between the two (sub trust master)
-A sql server 2005 on a win server 2003 in "sub domain" AD
-A linked server to "sub domain" AD
-A linked server login using a "sub domain" admin acccount
-A view to this linked server
-A grant on masterDomain/Domain Users to the database
-A grant on subDomain/Domain Users to the database
-We want all connections done through "Windows Authentication" not "Database Authentication".

Queries on the view work fine using "sub domain" user accounts.
Queries on the view fail using "master domain" user accounts (including master domain admin accounts)


"Msg 7399, Level 16, State 1, Line 1

The OLE DB provider "ADsDSOObject" for linked server "ADSI" reported an error. The provider indicates that the user did not have the permission to perform the operation."

All connections are done through "Windows Authentication" not "Database Authentication".

Can we establish cross domain connectivity with "Windows Authentication" ?


Below are details of the implementation:

SELECT TOP (100) PERCENT *
FROM OPENQUERY(ADSI,
'SELECT displayname, givenName, sn, cn (etc...)
FROM ''LDAP://OU=PEOPLE,DC=subDomain,DC=com''
WHERE objectCategory = ''Person'' AND objectClass = ''user'' ')

EXEC sp_addlinkedsrvlogin @rmtsrvname ='ADSI', @useself='false',
@rmtuser='subDomainAdminAccnt', @rmtpassword='sunDomainAdminAccntPassword';

In SQL Server Mngt Studio in Server Objects/Linked Servers/Providers/ ADSI properties security tab I have:

"connections will: <be made using this security context> Remote login:'subDomainAdminAccnt' With password: 'subDomainAdminAccntPassword'

Error:
Msg 7399, Level 16, State 1, Line 1

The OLE DB provider "ADsDSOObject" for linked server "ADSI" reported an error. The provider indicates that the user did not have the permission to perform the operation.

Msg 7320, Level 16, State 2, Line 1

Cannot execute the query "SELECT displayname, givenName, sn, cn

FROM 'LDAP://OU=PEOPLE,DC=subDomain,DC=com'

WHERE

objectCategory = 'Person'

AND objectClass = 'user'

" against OLE DB provider "ADsDSOObject" for linked server "ADSI".

View 7 Replies View Related

I Cant Connect To A Domain Account!! HELP!!!

Jun 25, 2004

Hi

Doing webforms in ASP.NET and i have a connection string in the webconfig that connects to a locally created SQL Server user account.

This is fine however when i try to connect to a domain account created by the IT administrator for me, it wont work.

The User name and password he supplied are correct as i logged into my PC (Win 2000) using it to test it. However when i try to connect to this remote network domain account by changing my connection string it fails... anyone any ideas, or am i missing a subtlety of ASP.NET and SQL connectionstrings?

Heres the connection string that works...
ConnectionString = value="Server=MY-SERVER;Network Library=DBMSSOCN;Initial Catalog=MYDATABASE2;User ID=MrLocalUser;Password=password;"

Heres the connection string that fails...
ConnectionString = value="Server=MY-SERVER;Network Library=DBMSSOCN;Initial Catalog=MYDATABASE2;User ID=DOMAINMrDomainUser;Password=password;"

??????

View 1 Replies View Related

Local Vs. Domain Account

Feb 17, 2006

Hi All,

How can I tell how SQL Agent is configured to start up with? Is it with the local system account or domain account?

Thanks.

View 2 Replies View Related

Login With Domain Account

Jul 20, 2005

I doing some testing with security and ran into the following problem.I want to log into the SQL server (from Query Analyzer) using mydomain account. To allow this, I went into Logins section inEnterprise Manager and added my user account as a Windows User.If I set Analyzer to use Windows authentication I am to log in with noproblems. But if it is set to SQL Server authentication and I type inmy username (in the format domainusername or username@domain) andpassword I get a login error.Is there a way to login in to SQL using domain account without usingwindows authentication?Thanks,Jason

View 2 Replies View Related

Domain Account Trying To Access SQL

Oct 5, 2007



Hello,



I am seeing a couple of domain/username accounts trying to access SQL 2k5 SP2 and get the error above. The concern I have is these accounts shouldn't be trying to access SQL at all and do not exist is SQL hence the error The question I have is how can I track down what is trying to use this account and connect to sql? Thanks in advance.



John





SQL Server Log:



Message
Login failed for user 'DOMAIN ampbell'. [CLIENT: <named pipe>]




Message
Error: 18456, Severity: 14, State: 27.

View 3 Replies View Related

Replication Without A Domain Account -

Sep 7, 2007



I have two servers that are setup to use their local system account.
They are in the same workgroup, but aren't on a domain.
Is there a way to setup replication without a domain? If so, how?

Thanks in advance
Susan

View 1 Replies View Related

SQL 2005 SP1 And Domain Account

Jul 4, 2006

I recenly installed SP1 on 2 servers.
For some strange reason I am unable to run the SQL service or the SQL Agent service using the normal SQL service domain account. It has always worked and is currently running on the other server without a problem.

Has anyone had a similar problem?

View 1 Replies View Related

How Can I Install SS2K With Domain Account?

Oct 18, 2005

Hi all,
I have seen in documents that I can install SS2K on a machine without network domain connection using a domain account.It said that domain accounts are prefered according to some reasons and it is not limited to machines on a domain so you should do it on a single PC.
I tried this during installation and entered many different things but no chance:
<OS_account>
<machine_name>/<OS_account>
...
Would you please telling me what should I enter as service starter account if I want to use domain users?
-Thanks in advance

View 1 Replies View Related

Domain Group Account Won't Work

Sep 17, 2007

Greetings,

I am trying to configure Reporting Services to allow a domain group access to reports. I am able to configure the domain and group (mydomaingrpname) in both Report Manager and BIDS. I'm sure I entered the correct name because I purposely misspelled it and received an error. I think this tells me it is finding the group correctly.

However, when my test user goes to Report Manager, there are no folders displayed. I checked and he is in the domain group I am using. If I explicitly add him (mydomainandy) to the folders, he can see them and execute the reports.

After searching the forums and other websites, I have checked IIS is using Windows Integrated Security and not anonymous access.

Any ideas?

Rob

View 7 Replies View Related

Sa Account And Domain Level Rights

Mar 2, 2006

Hey everyone,



I apologize for the newbie question but I'm looking for the correct
answer. We have 4 production SQL servers at this time. When
we had originally set them up the "sa" account belonged to the domain
administrators group. Since we have a SQL admin team and a domain
admin team we would like to remove this privilege. Is this
something we can and should do? Our SQL servers use mixed mode
authentication and some databases are configured for Windows
authentication. I would appreciate any input from the community.

View 7 Replies View Related

Best Practice For Domain Account For SQL Services?

Mar 23, 2007

Hello,

I've done some searching, but have found no definite answer yet. Our SQL 2005 servers are members of Active Directory Services. We want to run SQL services using an ADS account.

I see 7 SQL services in the SQL Server Configuration Manager: Integration Services, FullText Search, SQL Server, Analysis Services, Reporting Services, Browser, and Agent.

Question: Is it a bad move to run them all using the same domain account? I mean, wouldn't this give, say the Browser service, more privileges than it needs by allowing its account access to the same resources as, for example, the Agent service? What I'm concerned about is a vulnerability in one service compromising another service.

I would like to be able to use one domain account for all 7 services on two SQL servers, but I have a feeling this is a poor choice.

What is the best method for running SQL services using a domain account?

Thanks,

-Tony

View 1 Replies View Related

Unable To Add Domain Group Account

Oct 24, 2007

Hi am
i am facing problem adding a domain group to the reporting services.
while setting the security of a report, i am getting the rsUnknownUserName error while adding a domain group.
the group is valid and it does exists. i tried creating a windows group on the machine running reporting services and tried adding the domain group and it accepted. but the reporting services is not accepting.
can somebody tell me whats the problem with this.
i am able to add other domain group belonging to the same domain and the SSRS accepts but not this particular domain group which is like any other domain group.


View 3 Replies View Related

Set Web Service Identity To Domain Account

Mar 26, 2008

I can't get this to work. This is my setup:

2 Windows 2008 Server machines

- first machine holds MOSS 2007
- second machine SQL 2005 SP2+MOSS Web Front

MOSS config. database is on Sql server. I'm trying to configure Reporting Services on SQL server in Sharepoint Integration Mode. As per Microsoft tutorials I've set up domain accounts for Sql services. When I use Reporting Services Configuration to configure Web Service Identity to use an App. Pool that runs under a domain account i get this error:
"ReportServicesConfigUI.WMIProvider.WMIProviderException: An unknown error has occurred in the WMI Provider. Error Code 800708AC at ReportServicesConfigUI.WMIProvider.RSReportServerAdmin.SetWebServiceIdentity(String applicationPool)"

Database Setup and Windows Service Identity work fine using domain account.
I've searched many forums, Microsoft "How To" to no avail.

If anyone has some ideea on this please help.

View 11 Replies View Related

SQL Server 2008 :: Must Setup Be Run With A Domain Account?

Nov 6, 2015

I am running a SQL 2008r2 install while logged onto the server with a local admin account, not a domain account. I am specifying a domain account to run the SQL service. The install fails saying the service account credentials are invalid but I am 99.9% sure they are right.My theory - the local admin account running Setup cannot validate the service account creds against AD. Is it a requirement to run Setup while logged on with a domain account?

View 4 Replies View Related

Failure Audit On Domain Controller Account

Sep 13, 2006

I have SQL 2005 installed in a virtual (ESX) environment with a separate DC. Every minute or so an event shows up in the Application Event Log that says:



Type: Failure Audit

User: dgtestdc1$

Computer: sql1

Source: MSSQLSERVER

Category: (4)

Event ID: 18456

Description:

Login failed for user 'dgtestdc1$'. [Client: <ip address>]

Data includes: SQL1 master



Any idea what is causing this and how to fix it?

Thanks,
Mindy

View 5 Replies View Related

Trying To Force Package To Run Under Chosen Domain Account

Aug 23, 2007

I have a package that needs to be executed from a webpage, which I can get to INITIATE fine. The page calls a stored procedure which in turn starts a package (use DTExec and xp_cmdshell). The problem is that the package reads/writes to flat files that the most accounts do not have rights to. That being the case I get errors that the file doesn't exists. The package was developed by using a domain account which does have access to the files so it obviously runs fine in BIDS.



How do I force the stored package to run under that account when being called by a stored procedure? I've done this with scheduled jobs because I can use a proxy account. Is there something simlilar that I can do vis DTExec?


View 3 Replies View Related

Grant Alter Trace To A Domain Account

Mar 12, 2007

surprisingly, couldn't find anything about granting alter trace permissions to a domain account.

I try to run following sql:

GRANT ALTER TRACE TO MyDomainUser1;
GO

And get the following error when executing:

Msg 102, Level 15, State 1, Line 1

Incorrect syntax near ''.

What is correct SQL to grant alter trace permissions to a domain account?

TIA.

View 4 Replies View Related

Connect To Analysis Manager Over HTTPS And Non Domain Account

Oct 25, 2005

Please, I need your help... I`m desperate...

I`m trying to connect to the Analysis Services (AS 2000 Enterprise Edition SP4 on Windows Server 2003 EE, respository is in Access DB) throught Analysis Manager over HTTPS(HTTP) connection. I dont want to use domain account.

I need to specify USER_ID and PASSWORD to the Analysis Manager, but in registration of new server is only IP address or HTTP adress (for http://server) - but it doesn´t work - it says Unauthorized. But I`ve tried to use Anonymous account and it doesn`t work (client wan`t able to make connection)... I would like to use Basic Authentification.... Thise account is member of OLAP_Administrators... but the problem is where should I put USER_ID and PASSWORD???

It works perfect in Excel 2003.... MSOLAP.asp work fine in IE...

Thanks very much for your advise

Ricmond

View 1 Replies View Related

SQL 2012 :: Domain Account Errors Out When Use As Service Accounts

Jul 23, 2014

Installed sql server 2012 enterprise. Runs with the built in account fine.

I tried entering a domain account to run as the service account from sql configuration it fails with the error "the specified network password is not correct".

I tried from services.msc and entered successfully but when I try to restart it fails that the log in credentials are wrong.

the domain account and password I entered are just fine. What's it I should do or missing?

View 3 Replies View Related

Risks Of Single MSSQL Domain Account For Mult Servers?

Jul 20, 2005

Greetings:I am trying to conceive what risks might be created by runningmultiple SQL servers within a domain under a single domain account, asopposed to 1) running under the local service account or 2) multipledomain service accounts.In this case, all the SQL servers are SQL2000 running on Win2003. Theservice account is assigned only to the "Domain Users" group.We do use linked server calls, and I have played and suceeded gettingKereberos up to avoid double hop issues when using Windows Auth. Infact, this is one of the reasons that sparked the question in my mind-- in all the MS Kerebos SQL<->SQL examples, the SQL servers run undera unique service account.As an aside, most of the servers are "line of business" servers, butHR runs under a unique server with more sensitive information. I don'treally think that merits a seperate service account, but again, Icould well be missing something.I mostly looking for food for thought, but concrete examples ofgotchas would be appreciated.Thanks all.d.

View 2 Replies View Related

Reporting Services :: Domain Account Used For SSRS Service Keeps Getting Locked Out

Oct 15, 2015

Sometimes I have to unlock the account 3 or 4 times a day. This is getting annoying. Why would my service account keep getting locked out?

View 3 Replies View Related

Error During Installation Of Server 2005 When Typing Domain Account

Sep 23, 2010

I am installing SQL Server 2005 on a server (Windows Server Enterprise Edition 2003 SP2) that is not domain controller and on the screen "Service Account" I checked the box "Customize for each service account" and typed a domain account (it has permission to "logon as a service"), its password and domain, and when I click the "Next" button, I am getting the error below:"SQL Server Setup could not validate the service accounts. Either the service accounts have not been provided for all of the services being installed, or the specified username or password is incorrect. For each service, specify a valid username, password, and domain, or specify a built-in system account. "

View 11 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved