SQL Server startup account permission

Question

I install sql server and have a custom domain account to start up , domain\usera

but I found domain\usera is not in the following group . (and my sql server is working fine)

Replace a process level token
Bypass traverse checking
Adjust memory quotas for a process

https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions?view=sql-server-ver15

I just would like to have a look to see if these accounts permission is still a compulsory? ANd what's the usage for each one ?

Answer 1

These are the correct ones:

Act as part of the operating system
Lock Pages in Memory
Perform Volume Maintenance Tasks
Bypass Traverse Checking
Replace A Process Level Token
Adjust Memory Quotas For A Process

Answer 2

Hi @sakuraime ,

Replace a process level token

Replace a process level token setting determines which user accounts can call the CreateProcessAsUser() application programming interface (API) so that one service can start another. An example of a process that uses this user right is Task Scheduler, where the user right is extended to any processes that can be managed by Task Scheduler.

Bypass traverse checking

This policy setting determines which users (or a process that acts on behalf of the user’s account) have permission to navigate an object path in the NTFS file system or in the registry without being checked for the Traverse Folder special access permission. This user right does not allow the user to list the contents of a folder. It only allows the user to traverse folders to access permitted files or subfolders.

Adjust memory quotas for a process

This privilege determines who can change the maximum memory that can be consumed by a process. This privilege is useful for system tuning on a group or user basis.

This user right is defined in the Default Domain Controller Group Policy Object (GPO) and in the local security policy of workstations and servers.

By the way, did your SQL server instance default service account be added in this policy as below screenshot?

---

If the response is helpful, please click "Accept Answer" and upvote it, as this could help other community members looking for similar thread.

Answer 3

***hi guys! just a "noobie" here! could you guys please explain the benefits and point of sql or running ssh on ports and all that good stuff! please and thank you, HIGHLY appreciated **strong text*****