Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm installing a 2008 instance on a Server 2003 machine which is already running SQL 2005.

I need to set up domain groups for the security setup step:

http://msdn.microsoft.com/en-us/library/ms179530.aspx

On Windows Server 2003, specify domain groups for SQL Server services. All resource permissions are controlled by domain-level groups that include SQL Server service accounts as group members.

Much more info on this here:

http://support.microsoft.com/kb/910708

I've had problems with being able to add the windows service accounts to the groups at install time. The security admins had to make my account a domain admin - which they were hesitant to do.

The account under which SQL Server Setup is running must have permissions to add accounts to the domain groups.

Is there a specific security setting which would allow my account to add accounts to a group?

UPDATE: I'm looking for specific instructions. I have a global group called domain\servicegroup - what do I tell the security folks to do. I'd love to figure it out myself, but I don't have access to this stuff.

share|improve this question

2 Answers 2

up vote 1 down vote accepted

That's a good question. Your security admins do not have to actually make you a domain administrator - they just have to delegate the correct permissions for the OU the group belongs to in Active Directory. I've included a link to a good article below. The security admins can delegate specific permissions to you, or a DBA group, to be able to manage the groups without having to grant you access to entire directory. They may need to create a new OU for SQL Server groups and accounts, but that may be helpful to you in the long run anyway.

http://www.windowsecurity.com/articles/Implementing-Active-Directory-Delegation-Administration.html

share|improve this answer
    
I've told them that, but they cannot figure out how to do it! –  Sam Mar 15 '10 at 23:59

You don't have to be a domain administrator you just need to have someone who IS a domain administrator add the service account into the already created domain groups that you are specifying in the install. The SQL installer will check the group membership to make sure the account is in there and if not it will try to add it, which a non-DA cannot do.

share|improve this answer
    
They'd done that, but I get an error. –  Sam Mar 16 '10 at 17:26
    
Ugh that sucks, what's the error? The details should be under the C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Log on the node you're installing from. –  Jason Cumberland Mar 17 '10 at 17:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.