2

I'm installing a 2008 instance on a Server 2003 machine which is already running SQL 2005.

I need to set up domain groups for the security setup step:

http://msdn.microsoft.com/en-us/library/ms179530.aspx

On Windows Server 2003, specify domain groups for SQL Server services. All resource permissions are controlled by domain-level groups that include SQL Server service accounts as group members.

Much more info on this here:

http://support.microsoft.com/kb/910708

I've had problems with being able to add the windows service accounts to the groups at install time. The security admins had to make my account a domain admin - which they were hesitant to do.

The account under which SQL Server Setup is running must have permissions to add accounts to the domain groups.

Is there a specific security setting which would allow my account to add accounts to a group?

UPDATE: I'm looking for specific instructions. I have a global group called domain\servicegroup - what do I tell the security folks to do. I'd love to figure it out myself, but I don't have access to this stuff.

Improve this question

2 Answers 2

Reset to default
1

That's a good question. Your security admins do not have to actually make you a domain administrator - they just have to delegate the correct permissions for the OU the group belongs to in Active Directory. I've included a link to a good article below. The security admins can delegate specific permissions to you, or a DBA group, to be able to manage the groups without having to grant you access to entire directory. They may need to create a new OU for SQL Server groups and accounts, but that may be helpful to you in the long run anyway.

http://www.windowsecurity.com/articles/Implementing-Active-Directory-Delegation-Administration.html

Improve this answer
1
  • I've told them that, but they cannot figure out how to do it!
    – Sam
    Mar 15, 2010 at 23:59
2

You don't have to be a domain administrator you just need to have someone who IS a domain administrator add the service account into the already created domain groups that you are specifying in the install. The SQL installer will check the group membership to make sure the account is in there and if not it will try to add it, which a non-DA cannot do.

Improve this answer
2
  • They'd done that, but I get an error.
    – Sam
    Mar 16, 2010 at 17:26
  • Ugh that sucks, what's the error? The details should be under the C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Log on the node you're installing from.
    – Jason Cumberland
    Mar 17, 2010 at 17:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .