Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I ran Brent Ozar's sp_blitz script, and one of the things it's complaining about is that my SQL Server Agent account has sysadmin permission. I removed the sysadmin permission, but then the agent wouldn't start. (See image below). There's nothing of note in the event log. When I restore the sysadmin permission the agent starts with no difficulty.

enter image description here

My account is a managed service account. None of the other managed service accounts I use (one for running reporting services, and one for running the SQL service) have sysadmin permission.

Is the sysadmin permission actually necessary? If not, what are the minimum permissions this account needs?

share|improve this question
1  
For those not familiar with sp_Blitz, the check the OP is talking about is brentozar.com/blitz/security-sysadmins. It checks for members of the sysadmin fixed server role as a notification. There is nothing necessarily wrong with people having sysadmin access but knowing who can drop a database is good information and possibly something to look into why they have that access. –  Wind Raven Feb 18 at 20:58
1  
This is why you have to know what changes you are making before just randomly making system changes no matter what script is recommending making the change. –  mrdenny Feb 19 at 4:07
1  
@mrdenny It was just a test box, so no harm done :) –  Mansfield Feb 19 at 13:17

2 Answers 2

up vote 5 down vote accepted

Per BOL: Configuring Windows Service Accounts and Permissions

SQL Server Agent Login and Privileges
The per-service SID of the SQL Server Agent service is provisioned as a Database Engine login. The per-service SID login is a member of the sysadmin fixed server role.

share|improve this answer
1  
Note that it should in no way be a Windows or Domain administrator; only a SQL Server sysadmin. –  Anti-weakpasswords Feb 19 at 5:31

Further to Shawn's answer, the Books Online topic titled Select an Account for the SQL Server Agent Service also says:

The account that the SQL Server Agent service runs as must be a member of the following SQL Server roles:

  • The account must be a member of the sysadmin fixed server role.

  • To use multiserver job processing, the account must be a member of the msdb database role TargetServersRole on the master server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.