Search

Service SID not granted required permission during installation by Nancy Hidy Wilson1

Active

3
0
Sign in
to vote
Type: Bug
ID: 778696
Opened: 2/6/2013 2:13:41 PM
Access Restriction: Public
0
Workaround(s)
0
User(s) can reproduce this bug
Certain functionality performed by the SQL Server Service Account post install seems to require a minimum of List Folder access to the root drive of the data folders used by SQL Server. This includes using SSMS to restore a database using a file (the GUI cannot display the path to traverse to the backup file) in versions prior to SQL Server 2012; and in SQL Server 2012 prevents a successful application of SP1 using either the UpdateSource during initial install or running the SP manually after install. In many organizations, the default Everyone and Users groups are removed from the base permissions to conform to the principal of least privileges. And in that same vein, we are using either a Domain User account or the virtual account for the service accounts - which are not in Administrators.

I believe that the installation should grant the minimal List Folder access to the root drive only (not inherited or propated) to the Service SID to ensure successful execution of the tasks performed by this account. It is especially egregious that the SP installation fails due to this configuration.

This may be the same problem reported in Bug 775401; however, I did not see a root cause determined there.
Details (expand)

Product Language

English

Version

SQL Server 2012 - Enterprise Edition

Category

SQL Engine

Operating System

Windows Server 2008 R2 Standard (SP1)

Operating System Language

US English

Steps to Reproduce

1. Ensure that the root drive used for SQL Server data has only access allowed to SYSTEM and Administrators (i.e.remove Everyone and Users).
2. Install SQL Server 2012 Database Engine on Windows Server 2008 R2 using defaults for the service accounts (virtual accounts).
3. Apply SP1 (or use UpdateSource in step 2)

Actual Results

Installation fails during SP1. I will attach a zip of the installation log files from using UpdateSource method.

Expected Results

Successful installation of SP1

Platform

X64

Virtualization

Other (e.g. VM Ware, specify in Description)
File Attachments
File Name Submitted By Submitted On File Size  
20130206_Fail.zip (restricted) 2/6/2013 -
Sign in to post a comment.
Posted by Nancy Hidy Wilson1 on 2/6/2013 at 2:17 PM
"propated" is a typo - should have been "propagated". :-)
Sign in to post a workaround.