Assigning a Service Account to SQL Server or SQL Executive

SQL Server is installed by the setup program to run as a Windows NT service under the computer's LocalSystem account. In most situations, this is appropriate and suitable. However, LocalSystem is a special account that has no user account information associated with it and cannot be granted any privileges on another computer. In some cases, services running under the LocalSystem account will be unable to access certain network resources.

For example, Microsoft LAN Manager user-level security servers and Novell NetWare Servers will not allow a Windows NT service running under the LocalSystem account to access their file shares. Therefore, in some situations¾primarily when SQL Server will be accomplishing connectivity-related tasks¾it may be necessary to create and assign a Windows NT user account to SQL Server. This allows SQL Server to run in the security context of the user account and not in the context of the computer's LocalSystem account.

The account you create will usually be a domain account (although it could be an account on the local server). To create the user account, use the User Manager application¾provided with Windows NT¾to create a user account that belongs to the Administrators local group on the local SQL Server computer. It is also a good idea to have the Password Never Expires option selected. For information on how to do this, see your docmentation for Windows NT or the online Help for User Manager. If you do not have privileges that allow you to use User Manager for Domains, have a network administrator create the user account for you.

In most cases, as part of SQL Server installation, you will have already created an account with these characteristics and assigned it to SQL Executive. If this has been done, then you can usually assign the same account to SQL Server, and you will not need to create a new user account.

However, if during SQL Server installation you did not assign a user account to SQL Executive, then you will need to create the account. You can use the following procedure to assign a user account to both SQL Executive and SQL Server.

The SQL Server service is named MSSQLServer. The SQL Executive service is named SQLExecutive.

    To assign a user account to SQL Server or SQL Executive

1. Open the Main program group and double-click the Control Panel icon.

   The Control Panel window appears.

2. Double-click the Services icon.

   The Services dialog box appears.

   

3. From the list of services, select MSSQLServer or SQLExecutive, and then choose the Startup button.

   The Service startup dialog box appears.

   

4. Choose the This Account option, and then type the user account in the This Account box.

   Or to select from a list of available user accounts, choose the browse (...) button and complete the Add User dialog box that appears.

   

5. Enter the password for that user account in the Password and Confirm Password boxes.

   Make certain you type the correct password. The service will not start if the password is incorrect.

6. Choose OK.
7. Choose Close.

   The new account assignment takes effect the next time the service is started.

If you have difficulty starting SQL Server or SQL Executive under a particular user account, you can:

• Use User Manager to verify that the account has the log on as a service right on the computer and is a member of the Administrators group on the computer. (Both of these must be assigned within the security context of the local computer, not the domain.)
• Use the Services application in the Control Panel to re-enter the user account password. If the password is incorrect or has changed (for example, if it expired and was changed by a user), the service cannot be started until the correct password is entered.

  If necessary, change the account's password using User Manager, and then enter that password for the service, using the Services application in the Control Panel.

If you still have difficulty starting SQL Server or SQL Executive under a particular user account, one way to troubleshoot is to assign that account to another service¾for example, the Spooler service¾and verify that the service can be successfully started. If not, it is probable that the account is not properly configured or cannot be validated by the domain controller (for example, if no domain controller is available).

For more information about assigning a user account to SQL Executive, see Microsoft SQL Server Setup.