services.exe D:\MSSQL\MSSQL17.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE ACCESS DENIED

Question

services.exe D:\MSSQL\MSSQL17.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE ACCESS DENIED

Iain Barnetson 106

I've been getting failed installs with SQL Server Developer Standard Edition on Windows 2025 Standard edition, error has been:

services.exe	1000	QueryOpen	D:\MSSQL\MSSQL17.MSSQLSERVER\MSSQL\Binn\sqlceip.exe	ACCESS DENIED
services.exe	1000	QueryOpen	D:\MSSQL\MSSQL17.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE	ACCESS DENIED

I ended up granting local admin rights to the service account I'm using for the SQL Server, whcih allowed the install to complete but still had the same error on sqlceip.exe. I'm logged in to the server the install is running on, as a Domain Admin.

The detail file from the setup bootstrap files shows these errors, see below.

Any idea why this is happening?

 2026-07-26 13:54:31 Slp: Prompting user if they want to retry this action due to the following failure:
(01) 2026-07-26 13:54:31 Slp: ----------------------------------------
(01) 2026-07-26 13:54:31 Slp: The following is an exception stack listing the exceptions in outermost to innermost order
(01) 2026-07-26 13:54:31 Slp: Inner exceptions are being indented
(01) 2026-07-26 13:54:31 Slp: 
(01) 2026-07-26 13:54:31 Slp: Exception type: Microsoft.SqlServer.Configuration.Sco.ScoException
(01) 2026-07-26 13:54:31 Slp:     Message: 
(01) 2026-07-26 13:54:31 Slp:         Attempted to perform an unauthorized operation.
(01) 2026-07-26 13:54:31 Slp:     HResult : 0x84bb0001
(01) 2026-07-26 13:54:31 Slp:         FacilityCode : 1211 (4bb)
(01) 2026-07-26 13:54:31 Slp:         ErrorCode : 1 (0001)
(01) 2026-07-26 13:54:31 Slp:     Data: 
(01) 2026-07-26 13:54:31 Slp:       DisableRetry = true
(01) 2026-07-26 13:54:31 Slp:     Inner exception type: System.UnauthorizedAccessException
(01) 2026-07-26 13:54:31 Slp:         Message: 
(01) 2026-07-26 13:54:31 Slp:                 Attempted to perform an unauthorized operation.
(01) 2026-07-26 13:54:31 Slp:         HResult : 0x80070005
(01) 2026-07-26 13:54:31 Slp:         Stack: 
(01) 2026-07-26 13:54:31 Slp:                 at Microsoft.SqlServer.Configuration.Sco.Service.StartService(String[] startParams)
(01) 2026-07-26 13:54:31 Slp: ----------------------------------------
(01) 2026-07-26 13:54:33 Slp: User has chosen to retry this action
(01) 2026-07-26 13:54:33 Slp: Sco: Attempting to close service handle for service SQLSERVERAGENT
(01) 2026-07-26 13:54:33 Slp: Sco: Attempting to close SC Manager
(01) 2026-07-26 13:54:33 Slp: Sco: Attempting to open SC Manager
(01) 2026-07-26 13:54:33 Slp: Sco: Attempting to open service handle for service SQLSERVERAGENT
(01) 2026-07-26 13:54:33 Slp: Prompting user if they want to retry this action due to the following failure:
(01) 2026-07-26 13:54:33 Slp: ----------------------------------------
(01) 2026-07-26 13:54:33 Slp: The following is an exception stack listing the exceptions in outermost to innermost order
(01) 2026-07-26 13:54:33 Slp: Inner exceptions are being indented
(01) 2026-07-26 13:54:33 Slp: 
(01) 2026-07-26 13:54:33 Slp: Exception type: Microsoft.SqlServer.Configuration.Sco.ScoException
(01) 2026-07-26 13:54:33 Slp:     Message: 
(01) 2026-07-26 13:54:33 Slp:         Attempted to perform an unauthorized operation.
(01) 2026-07-26 13:54:33 Slp:     HResult : 0x84bb0001
(01) 2026-07-26 13:54:33 Slp:         FacilityCode : 1211 (4bb)
(01) 2026-07-26 13:54:33 Slp:         ErrorCode : 1 (0001)
(01) 2026-07-26 13:54:33 Slp:     Data: 
(01) 2026-07-26 13:54:33 Slp:       DisableRetry = true
(01) 2026-07-26 13:54:33 Slp:     Inner exception type: System.UnauthorizedAccessException
(01) 2026-07-26 13:54:33 Slp:         Message: 
(01) 2026-07-26 13:54:33 Slp:                 Attempted to perform an unauthorized operation.
(01) 2026-07-26 13:54:33 Slp:         HResult : 0x80070005
(01) 2026-07-26 13:54:33 Slp:         Stack: 
(01) 2026-07-26 13:54:33 Slp:                 at Microsoft.SqlServer.Configuration.Sco.Service.StartService(String[] startParams)
(01) 2026-07-26 13:54:33 Slp: ----------------------------------------
(01) 2026-07-26 13:54:33 Slp: User has chosen to retry this action
(01) 2026-07-26 13:54:33 Slp: Sco: Attempting to close service handle for service SQLSERVERAGENT
(01) 2026-07-26 13:54:33 Slp: Sco: Attempting to close SC Manager
(01) 2026-07-26 13:54:33 Slp: Sco: Attempting to open SC Manager
(01) 2026-07-26 13:54:33 Slp: Sco: Attempting to open service handle for service SQLSERVERAGENT
(01) 2026-07-26 13:54:33 Slp: Prompting user if they want to retry this action due to the following failure:
(01) 2026-07-26 13:54:33 Slp: ----------------------------------------
(01) 2026-07-26 13:54:33 Slp: The following is an exception stack listing the exceptions in outermost to innermost order
(01) 2026-07-26 13:54:33 Slp: Inner exceptions are being indented
(01) 2026-07-26 13:54:33 Slp: 
(01) 2026-07-26 13:54:33 Slp: Exception type: Microsoft.SqlServer.Configuration.Sco.ScoException
(01) 2026-07-26 13:54:33 Slp:     Message: 
(01) 2026-07-26 13:54:33 Slp:         Attempted to perform an unauthorized operation.
(01) 2026-07-26 13:54:33 Slp:     HResult : 0x84bb0001
(01) 2026-07-26 13:54:33 Slp:         FacilityCode : 1211 (4bb)
(01) 2026-07-26 13:54:33 Slp:         ErrorCode : 1 (0001)
(01) 2026-07-26 13:54:33 Slp:     Data: 
(01) 2026-07-26 13:54:33 Slp:       DisableRetry = true
(01) 2026-07-26 13:54:33 Slp:     Inner exception type: System.UnauthorizedAccessException
(01) 2026-07-26 13:54:33 Slp:         Message: 
(01) 2026-07-26 13:54:33 Slp:                 Attempted to perform an unauthorized operation.
(01) 2026-07-26 13:54:33 Slp:         HResult : 0x80070005
(01) 2026-07-26 13:54:33 Slp:         Stack: 
(01) 2026-07-26 13:54:33 Slp:                 at Microsoft.SqlServer.Configuration.Sco.Service.StartService(String[] startParams)
(01) 2026-07-26 13:54:33 Slp: ----------------------------------------
(01) 2026-07-26 13:54:34 Slp: User has chosen to cancel this action

Erland Sommarskog 136.4K Reputation points MVP Volunteer Moderator

2026-07-26T17:16:51.8033333+00:00

Since this is a server-operating system, I take it that this is in a corporate environment and something private at home?

I get the feeling that this is related to something in your environment. When you say that "granting local admin rights to the service account I'm using for the SQL Server", does this mean that you are not using the default account NT Service\MSSQLSERVER, but a domain account?

What anti-malware do you have?

Would it be possible to share the full detail.txt?
Iain Barnetson 106 Reputation points

2026-07-26T18:25:10.48+00:00

@Erland Sommarskog Yes, it's a 'Home' environment, a Microsoft Windows 11 Pro workstation, 128Gb RAM, 14 Cores, with a Hyper-V domain, it's in that I have the server hosting sql server, which has 12gb RAM & 4 Cores, using domain user account as login for SQL Services: I had 3 logins for each of the services server, agent & ssis but have just completed the install with using jsut the one login for all 3 services. I'd be happy to share Details file but it's 3.5Mb and exceeds the limit for attachments, I've tried splitting it and uploading part 1 & 2 sepreeately.. I've only got the Windows anti-malware, and I've tried switching that off, with no benefit.file_part1.txt
Iain Barnetson 106 Reputation points

2026-07-26T18:25:33.7766667+00:00

file_part2.txt
Erland Sommarskog 136.4K Reputation points MVP Volunteer Moderator

2026-07-26T18:46:27.1033333+00:00

Can you also share summary.txt? (I should have asked about that one from the start, sorry about that.)
Iain Barnetson 106 Reputation points

2026-07-27T08:14:10.1966667+00:00

@Erland Sommarskog Summary.txt Unfortunately I've only got the summary from an earlier attempt, attached, but the result & error was exactly the same.

2 answers

Your answer

Erland Sommarskog 136.4K Reputation points MVP Volunteer Moderator

2026-07-26T17:16:51.8033333+00:00

Since this is a server-operating system, I take it that this is in a corporate environment and something private at home?

I get the feeling that this is related to something in your environment. When you say that "granting local admin rights to the service account I'm using for the SQL Server", does this mean that you are not using the default account NT Service\MSSQLSERVER, but a domain account?

What anti-malware do you have?

Would it be possible to share the full detail.txt?
Iain Barnetson 106 Reputation points

2026-07-26T18:25:10.48+00:00

@Erland Sommarskog Yes, it's a 'Home' environment, a Microsoft Windows 11 Pro workstation, 128Gb RAM, 14 Cores, with a Hyper-V domain, it's in that I have the server hosting sql server, which has 12gb RAM & 4 Cores, using domain user account as login for SQL Services: I had 3 logins for each of the services server, agent & ssis but have just completed the install with using jsut the one login for all 3 services. I'd be happy to share Details file but it's 3.5Mb and exceeds the limit for attachments, I've tried splitting it and uploading part 1 & 2 sepreeately.. I've only got the Windows anti-malware, and I've tried switching that off, with no benefit.file_part1.txt
Iain Barnetson 106 Reputation points

2026-07-26T18:25:33.7766667+00:00

file_part2.txt
Erland Sommarskog 136.4K Reputation points MVP Volunteer Moderator

2026-07-26T18:46:27.1033333+00:00

Can you also share summary.txt? (I should have asked about that one from the start, sorry about that.)
Iain Barnetson 106 Reputation points

2026-07-27T08:14:10.1966667+00:00

@Erland Sommarskog Summary.txt Unfortunately I've only got the summary from an earlier attempt, attached, but the result & error was exactly the same.

Answer 1

Erland Sommarskog 136.4K MVP Volunteer Moderator

Again, this is quite obviously something in your environment. I asked if this was in a corporate context, because in that case your IT department might have set up some funny group policy or similar that you were unaware of. Since this is your home environment, you are your own IT department.

The error suggests one of:

The install process does not have permission to start services.
The service account for the service does not have the permission to log on as a service.

The text of the message makes me more think of the first alternative, but since the install service was able to start a few more services, and you were able to get these started by changing to a domain account, it has to be the second one.

There does not seem to be a way to set the service accounts for the telemetry services, but it will always be NT Service\SSISTELEMETRY170 and NT Service\SQLTELEMETRY. But since these accounts now have been created, you could manually grant these accounts the required permissions.

Normally, you should not have to do that, but this is something that SQL Server Setup takes care of. Why this did not happen in your case, I don't know.

Iain Barnetson 106 Reputation points

2026-08-13T16:20:05.89+00:00
@Erland Sommarskog Thank you for taking the time to respond to my post, sorry I'm only acknowledging it now. Since then, having gone around in circles, removing Hyper-V, reinstalling it, rebuilding the virtual domain and sql servers, I've still not been able to resolve the issue or prove the cause.

On my Dell XPS laptop, in Hyper-V, using the same Windows version and source iso, same Sql Server version and source iso, I can build the domain and sql servers with no problems. This is only happening on my Dell Precision Tower 5810. I've had a virtual Hyper-V domain on my Precision Tower 5810 for several years, rebuilding every now and again, and never had an issue untill now.

I suspect it's caused by upgrading from Windows 10 to Windows 11, which was an in place upgrade.

The only errors I have found are related to secure boot certificates, which only started recently. That is the only issue I can find, I realise it maybe a Red Herring. But, I'm intending doing a fresh install of Windows server 2022, replacing Windows 11. Hopefully that'll get me passed the issue.

Updated Secure Boot certificates are available on this device but have not yet been applied to the firmware. Review the published guidance to complete the update and maintain full protection. This device signature information is included here. DeviceAttributes: FirmwareManufacturer:Dell Inc.;FirmwareVersion:A34;OEMManufacturerName:Dell Inc.;OEMModelSKU:0617;OSArchitecture:amd64; BucketId: f92500b9cf92a3fdbb5d06156f0ef7935851d4493e6322e9a9c2aaa5ade2b83a BucketConfidenceLevel: High Confidence UpdateType: Windows UEFI CA 2023 (DB), Option ROM CA 2023 (DB), 3P UEFI CA 2023 (DB), KEK 2023, Boot Manager (2023 A PK-signed Key Exchange Key (KEK) cannot be found for this device. Check with the device manufacturer for proper key provisioning. This device signature information is included here. DeviceAttributes: FirmwareManufacturer:Dell Inc.;FirmwareVersion:A34;OEMManufacturerName:Dell Inc.;OEMModelSKU:0617;OSArchitecture:amd64;
Erland Sommarskog 136.4K Reputation points MVP Volunteer Moderator

2026-08-13T20:56:16.0866667+00:00

It's not apparent to me that the VM host would matter. Then again, I've never worked with Hyper-V; I stick to VMware.

Answer 2

The failure matches a permissions problem on the SQL Server service account, not the interactive account running Setup. The documented symptom is that SQL Server services fail to start with Error 5: Access is denied when the configured SQL Server service account does not have sufficient privileges on the SQL Server installation folder.

For this case, focus on the service account used by SQL Server Agent and verify its effective access on:

D:\MSSQL\MSSQL17.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE
D:\MSSQL\MSSQL17.MSSQLSERVER\MSSQL\Binn\sqlceip.exe
the parent D:\MSSQL\MSSQL17.MSSQLSERVER\MSSQL\Binn folder

Use this path to confirm and fix it:

Open SQL Server Configuration Manager or Services and note the account configured for the SQL Server service and SQL Server Agent service.
In File Explorer, right-click the SQL Server binary folder or the specific executable, select Properties > Security > Advanced.
Open Effective Access.
Select the SQL Server service account or SQL Server Agent service account.
Select View Effective Access.
If access is denied because of an explicit or inherited Deny entry, remove that Deny permission.
Restart the SQL Server service or rerun Setup.

Important: granting the service account local administrator rights is a workaround, not the targeted fix. The documented guidance is to resolve the file-system permission issue on the SQL Server installation folder and remove conflicting Deny permissions.

There is also a separate documented setup failure where SQL Server Setup expects administrators to have read/write access on all subkeys under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

If Setup still fails after fixing file permissions, check that registry path. If the relevant administrator or setup account lacks the required access there, grant the needed permissions. Risk: registry permission changes can affect system behavior, so change only the required keys and permissions.

If the setup account has had default user rights removed by policy, Setup can also fail. In that case, add the setup account to these local security policies:

Backup Files and Directories
Debug Programs
Manage auditing and security log

The fact that installation completed after adding local admin rights strongly indicates the root cause is missing access for the service account or setup account on the SQL binaries or required registry locations.