August 5, 2021 at 2:40 am
When installing SQL, be careful on the Server Configuration\Services Account page when you select the "Grant Perform Volume Maintenance Task..." option. Even if you have selected an Active directory account for the services to run under, the right is actually assigned the SQL Server Managed Account NT SERVICE\MSSQLSERVER and NOT to the account you have provided.
I only picked this up because I went back to assign Lock Pages in Memory and happened to notice the discrepancy. I'm not sure if it's the same on other installers, but I can't recall off hand when this option was added to the installer.
Has anyone else picked up on this?
Leo
Nothing in life is ever so complicated that with a little work it can't be made more complicated.
August 5, 2021 at 8:24 am
That is right and by design.
NT SERVICE\MSSQLSERVER actually is the AD account you assign to run the service.
So it is saying find the service account used for the service MSSQLSERVER from services.msc and pass that account for authentication/permission control.
This is so you can change the service account in SQL Configuration Manager and not have to go and change it in multiple locations.
The same is true for NT SERVICE\SQLSERVERAGENT, you will see that the actual service accounts don’t get a direct mapping at the instance level also, they are there as the NT SERVICE principals to again ensure you can change the actual accounts in the manager and everything just works.
Viewing 2 posts - 1 through 1 (of 1 total)
You must be logged in to reply to this topic. Login to reply