SQL Services Accounts and Permissions

SQL Services Accounts

All SQL services will use a restricted non privileged domain or local account, user accounts are not allowed to run SQL Services.  SQL Service accounts will not be granted local logon privileges or will not allow interactive logon privilege.  Run each separate SQL Server service under a different Windows domain account.   A separate Service account should be created for the SQL Server Agent and SQL Server services.  All SQL Server logins will be documented and have owners identified.  This includes SQL Logins, Windows Logins, service accounts and sa (sysadmin) logins. 

What are the Permissions required for SQL Server Service Account

Grant the SQL Server service accounts the following rights (below rights are assigned by default):

• Grant    Log on as a service 
• Grant    Act as part of the operating system
• Grant    Log on as a batch job
• Grant    Replace a process-level token
• Grant    Bypass traverse checking
• Grant    Adjust memory quotas for a process 
• Grant    Permission to start SQL Server Active Directory Helper
• Grant    Permission to start SQL Writer
• Grant    Permission to read the Remote Procedure Call service
• Deny    Log on locally (if using a local account)

What are the Permissions required for SQL Server Agent Service Account 

A separate Service account should be created for the SQL Server Agent and SQL Server services.   

Grant the SQL Server Agent service accounts the following rights (below rights are assigned by default):

• Log on as a service
• Log on as a batch job
• Replace a process-level token
• Bypass traverse checking
• Adjust memory quotas for a process

Integration Service Account Permissions

Grant the Integration Services service accounts the following rights (below rights are assigned by default):

• Log on as a service
• Permission to write to the application event log
• Bypass traverse checking
• Create global objects
• Impersonate a client after authentication 

Job Account Permissions

Each job role should utilize a domain service account created solely for that role. It shall only be granted the minimum permissions necessary to perform that job or job step.  i.e. SQL Server Agent Account.