Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're creating a Domain account to run our Merge Agent under, and we're trying to determine what NT permissions it requires. I can't seem to find a definitive list anywhere. Our replication configuration is:

Publisher: SQL 2008
Subscriber: SQL 2005
Replication Type: Merge
Subscription Type: Pull
Snapshot location: Network share on publisher

It works when we run the Merge Agent as my account, but that has administrative permissions on both the Publisher and Subscriber, as well as a host of other machines on the network. We'd like to exercise the Principle of Least Privilege, so I'm looking for the minimum privileges necessary. Thanks in advance for the help!

UPDATE: Well, for now we've followed mrdenny's advice and gave the account Full Control and DBO access. I'd still be interested in the minimum privileges necessary. I can't imagine that we're the first people to need this...

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

I know I'm late to the party....

The Windows account under which the agent runs is used when it makes connections to the Subscriber. This account must at minimum be a member of the db_owner fixed database role in the subscription database.

The account that is used to connect to the Publisher and Distributor must: -Be a member of the PAL. -Be a login associated with a user in the publication database. -Be a login associated with a user in the distribution database. The user can be the Guest user. -Have read permissions on the snapshot share.

These are the minimums. See http://msdn.microsoft.com/en-us/library/ms151868.aspx

share|improve this answer
1  
+100! I looked all over for an article exactly like the one you referenced. Thanks so much! –  GuyBehindtheGuy Feb 23 '10 at 14:44
add comment

The only Windows rights that it should need is full control of the folder which will be the snapshot location. Within SQL it'll need to be at least DBO in the databases which are being replicated (possibly sysadmin, not really sure).

share|improve this answer
    
Obviously full control and sysadmin privileges will work. I could also make the account an administrator on the machine. I'm looking for the minimum privileges necessary. I've edited the question to indicate that. –  GuyBehindtheGuy Feb 2 '10 at 14:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.