February 10, 2009 at 9:00 am
I have a domain account that runs all my SQL Server and SQL Agent services. This service account is ALWAYS a local Admin on the server. As a best practice, should this account also run the SSIS service, or is that not necessary? When running a job that executes an SSIS package, it's the Agent's credentials and domain permissions that are used, correct? Does the SSIS Service come into play at all?
Thanks,
Randy
February 10, 2009 at 9:45 am
Why a local admin? Most services don't need this.
you want to follow the same advice for service accounts as user accounts. Used the least privileges needed. For SSIS, I'd use a domain account just because I like those, no rights on the domain, but I would use a domain group that has rights to folders needed on the local box.
Why domain? If I move this SSIS package off this instance and run these packages from elsewhere, I want to have the rights to that box. That's thinking with scale out in mind, but if you have too many local path dependencies, use a local group for SSIS packages.
February 10, 2009 at 10:00 am
Its a local Admin by group membership. Our DBA group is local admin for installing software, SQL Server, etc.. Only me and the service account are members of the DBA group. Permissions to network folders for backups, file import/export, etc.. are granted to the DBA group. Most jobs that export files or spreadsheets are run by the service account, the thought being that if my account were disabled, production jobs would still run.
Sounds like the account that runs the SSIS service has no impact on SSIS package permissions to network shares when the package is invoked from a SQL Server Agent job.
Viewing 3 posts - 1 through 2 (of 2 total)
You must be logged in to reply to this topic. Login to reply