Wednesday, September 26, 2018

Check whether user running Sql Server engine has enough privileges

SQL Server installation automatically grants privileges to the user that runs MSSQL engine.
But, if you change the user that runs the engine AFTER the installation is complete, these permissions are not applied automatically. So it is important to remember to set these privileges.
Here is a script that helps you to determine which privileges you need to give. Depending of your SQL Server configuration, some may not be needed.
DECLARE @Res TABLE ( [output] NVARCHAR(255) );

INSERT INTO @Res
EXEC xp_cmdshell 'WHOAMI';
SELECT 'MSSQL engine runs with user ' + output
FROM @Res
WHERE output IS NOT NULL

DELETE FROM @Res
INSERT INTO @Res
EXEC xp_cmdshell 'WHOAMI /PRIV';

SELECT
 rp.PrivilegeName,
 RTRIM(LTRIM(REPLACE(r.output, rp.PrivilegeName, ''))) AS PrivilegeStatus
FROM @Res r
INNER JOIN
(
 VALUES
 ( 'SeAssignPrimaryTokenPrivilege' ),
 ( 'SeChangeNotifyPrivilege' ),
 ( 'SeIncreaseQuotaPrivilege' ),
 ( 'SeLockMemoryPrivilege' )
) rp ( PrivilegeName ) ON r.output LIKE '%' + rp.PrivilegeName + '%'
To add these privileges, go to Server Manager / Tools / Local Security Policy (or run secpol.msc).
Under Security Settings / Local Policies / User Rights Assignment, you can find the privileges mentioned above. Open each one that is disabled, and add the MSSQL engine user.
A reboot of server may be required for changes to take effect.

Resources:

No comments:

Post a Comment