Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It only takes a minute to sign up.
Sign up to join this community
Consider a SQL Server whose service account is a Managed Service Account in Active Directory. When this MSA is added to a security group, this group membership is not immediately going to take effect if SQL Server is already running as the MSA. (Restarting the SQL Service should have the effect of the MSA "logging on" again, and gaining the access of its new security group membership.)
Is there a way to safely "refresh" the service account's group membership without restarting the SQL Server?
You can use klist purge to do this. See How do you force an update to a user's group membership in Windows 7? and Viewing and Purging Cached Kerberos Tickets.
I would test this a lot before doing it in production, and avoid doing it in production unless absolutely critical. If a restart of SQL Server is completely impossible, a safer workaround would be to temporarily assign permissions to the necessary resource directly to the service account. This would provide the access without a restart, and not require anything out of the ordinary that might cause further issues. You would simply need to remove the temporary permission after the next service restart.
