4

Consider a SQL Server whose service account is a Managed Service Account in Active Directory. When this MSA is added to a security group, this group membership is not immediately going to take effect if SQL Server is already running as the MSA. (Restarting the SQL Service should have the effect of the MSA "logging on" again, and gaining the access of its new security group membership.)

Is there a way to safely "refresh" the service account's group membership without restarting the SQL Server?

1 Answer 1

2

You can use klist purge to do this. See How do you force an update to a user's group membership in Windows 7? and Viewing and Purging Cached Kerberos Tickets.

I would test this a lot before doing it in production, and avoid doing it in production unless absolutely critical. If a restart of SQL Server is completely impossible, a safer workaround would be to temporarily assign permissions to the necessary resource directly to the service account. This would provide the access without a restart, and not require anything out of the ordinary that might cause further issues. You would simply need to remove the temporary permission after the next service restart.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.