Log On As A Service Group Policy setting disabling the default SQL Service startup
j-man
Member Posts: 143
This is going to show my ignorance about Group Policy. It appears as if once you assign a domain account the 'Log On As A Service' right in 'Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment' all services that are configured to use the default service will not start upon startup. So by configuring this policy, it now disables local services starting? I would have thought they would not have been affected.
I have always created an AD account for the SQL services but I've never had the need to mess with this particular scenario.
This may come in handy to those trudging through the MSPress 70-462 book and wonder why everything stops working after the GP edits. Just disable that local policy, restart the SQL server two times and continue on.
If you want to test
Here is how I tested:
Network- DC, SQL-A
A domain user was created and was added to the Enterprise Admins, Domain Admins and Schema Admins groups. Configure networking so they are all in the same domain, and I created an OU which contained the SQL-A account.
I then installed several instances on SQL-A (Default instance name and InstanceName=B) using defaults with the domain user I created above as the SQLSysAdmin. Then log in as the user which was created above.
Restart member server several times and open SQL Server Configuration Manager to make sure both SQLServer services started. They did.
I then created a new Domain user in AD and a new Group Policy that I assigned to the SQL Server OU which contained SQL-A. The policy was edited by assigning the domain account created the 'Log On As A Service' right ('Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment').
SQL-A was restarted and the SQL Server Services for both instances started like they should. Restarted a second time, neither of the SQL Server Services started.
Edited the GP to disable the policy. Restarted SQL-A, neither services started but after the next restart, they started like they should.
I have always created an AD account for the SQL services but I've never had the need to mess with this particular scenario.
This may come in handy to those trudging through the MSPress 70-462 book and wonder why everything stops working after the GP edits. Just disable that local policy, restart the SQL server two times and continue on.
If you want to test
Here is how I tested:
Network- DC, SQL-A
A domain user was created and was added to the Enterprise Admins, Domain Admins and Schema Admins groups. Configure networking so they are all in the same domain, and I created an OU which contained the SQL-A account.
I then installed several instances on SQL-A (Default instance name and InstanceName=B) using defaults with the domain user I created above as the SQLSysAdmin. Then log in as the user which was created above.
Restart member server several times and open SQL Server Configuration Manager to make sure both SQLServer services started. They did.
I then created a new Domain user in AD and a new Group Policy that I assigned to the SQL Server OU which contained SQL-A. The policy was edited by assigning the domain account created the 'Log On As A Service' right ('Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment').
SQL-A was restarted and the SQL Server Services for both instances started like they should. Restarted a second time, neither of the SQL Server Services started.
Edited the GP to disable the policy. Restarted SQL-A, neither services started but after the next restart, they started like they should.