Post reply

SQLAgentCmdExec Permissions

  • February 3, 2004 at 1:02 pm

    #83383

    Does anyone know what permissions are required for the SQLAgentCmdExec account used to run SQL Agent jobs owned by non-sysadmins. I checked the MS web site and all I found is that it needs the "Logon as a batch job permissions". I would need to submit a request to the team that does the domain administration and I would like to use a domain account for the proxy account since some of the jobs may need network access.

    Any help appreciated.

    Thanks.

  • February 3, 2004 at 4:34 pm

    #492687

    If you want to run jobs owned by someone else, then I believe you need sysadmin permissions. From BOL (sp_startjob)

    Execute permissions default to the public role in the msdb database. A user who can execute this procedure and is a member of the sysadmin fixed role can start any job. A user who is not a member of the sysadmin role can use sp_start_job to start only the jobs he/she owns.

  • February 3, 2004 at 7:49 pm

    #492693

    Steve:

    Let me clarify. I meant to keep all non-essential jobs owned by an account that is not part of the sysadmin role for security reasons. However, for jobs to be owned by a user other than sysadmin, the SQL Agent Proxy account must be setup. Other wise the jobs would not run. The permissions at the windows OS level for this account is what I am referring to.

    Thanks.

     

  • February 4, 2004 at 12:53 am

    #492710

    Hi, if you want jobs to be run under an account different from sa, you can find almost everything you need in BOL. But, if this account is an Windows account (domain\user) then the account of SQL Agent service needs 'access this computer from the network' on the domain controller. If not, it cannot verify the account and the job will fail. Erik

Viewing 4 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic. Login to reply