I ran Brent Ozar's sp_blitz script, and one of the things it's complaining about is that my SQL Server Agent account has sysadmin permission. I removed the sysadmin permission, but then the agent wouldn't start. (See image below). There's nothing of note in the event log. When I restore the sysadmin permission the agent starts with no difficulty.

enter image description here

My account is a managed service account. None of the other managed service accounts I use (one for running reporting services, and one for running the SQL service) have sysadmin permission.

Is the sysadmin permission actually necessary? If not, what are the minimum permissions this account needs?

  • 1
    For those not familiar with sp_Blitz, the check the OP is talking about is brentozar.com/blitz/security-sysadmins. It checks for members of the sysadmin fixed server role as a notification. There is nothing necessarily wrong with people having sysadmin access but knowing who can drop a database is good information and possibly something to look into why they have that access. Feb 18, 2014 at 20:58
  • 2
    This is why you have to know what changes you are making before just randomly making system changes no matter what script is recommending making the change.
    – mrdenny
    Feb 19, 2014 at 4:07
  • 1
    @mrdenny It was just a test box, so no harm done :)
    – Mansfield
    Feb 19, 2014 at 13:17

2 Answers 2


Per BOL: Configuring Windows Service Accounts and Permissions

SQL Server Agent Login and Privileges
The per-service SID of the SQL Server Agent service is provisioned as a Database Engine login. The per-service SID login is a member of the sysadmin fixed server role.

  • 1
    Note that it should in no way be a Windows or Domain administrator; only a SQL Server sysadmin. Feb 19, 2014 at 5:31

Further to Shawn's answer, the Books Online topic titled Select an Account for the SQL Server Agent Service also says:

The account that the SQL Server Agent service runs as must be a member of the following SQL Server roles:

  • The account must be a member of the sysadmin fixed server role.

  • To use multiserver job processing, the account must be a member of the msdb database role TargetServersRole on the master server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.