0

I have a fresh standard installation of DB2 11.5 on Windows server 2016. According to documentation, i need the to have SYSADM or SYSCTRL to create a new Database.

The documentation for "sysadm_group - System administration authority group name configuration parameter" states.

SYSADM authority is determined by the security facilities used in a specific operating environment.

  • For the Windows operating system, this parameter can be set to local or domain group. Group names must adhere to the length limits specified in SQL and XML limits. The following users have SYSADM authority if "NULL" is specified for sysadm_group database manager configuration parameter:
    • Members of the local Administrators group
    • Members of the Administrators group at the Domain Controller if DB2_GRP_LOOKUP is not set or set to DOMAIN
    • Members of DB2ADMNS group if Extended Security feature is enabled.
    • The location of the DB2ADMNS group was decided during installation
    • The LocalSystem account

The parameter is empty and my account is in the DB2ADMN group which was automatically created during the install and also in the local admin group. Extended Security is enabled on that instance. Since my account used to be in these group through another group I added my account explicitly to both groups. Either way, db2 still thinks I don't have enough permissions to create a database.

I checked db2diag but there are no entries logged.

Is there anything that I missed or that I can check to see what's going on?

3
  • "Members of DB2ADMNS group if Extended Security feature is enabled" -- so, did you enable extended security during installation? – mustaccio Jan 8 at 18:45
  • Yes the flag is set. Forgot to mention that in the question. – Peter Schuetze Jan 8 at 19:37
  • Try kicking up DIAGLEVEL to 4 and see if anything useful comes up in the diagnostic log. Is your computer in a domain? Is your account a domain account? What is DB2_GRP_LOOKUP set to? Which account is the Db2 service running under? – mustaccio Jan 8 at 21:10
2

I had some chats with IBM and the issue is kind of simple. The db2 service is running as a local account (db2admin) just as a default installation would do. My account is a domain account and is in the local administrator group. The local account is not able to verify my domain account and therefore I am denied admin permission.

Solutions:

  1. use a local account for connecting to the database
  2. run db2 service under the local system account
  3. run db2 service under domain account

I changed the setup to local system account. Waiting on IBM for letting me know what the security impact (risk) is.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.