April 27, 2012 at 2:26 am
Hi all,
We have a rather long naming convention for service accounts .
I decided to try out my computer (So Windows 7)
SQL Server service is: MSSQL IT-10101-SqlServ
Since its so long the "User Login Pre Windows 2000" is only - MSSQL IT-10999-SqlSe
If i look in configuration manager it shows the Pre 2000 user name, It connected on install. But since i restarted my machine the account fails. though i know its active (i can login to the account)
Any one know of any issues with naming conventions for services?
Any one know why its showing the pre 2000 account in config mng?
Hope someone can help
April 27, 2012 at 8:11 am
Fixed:
Right.. so fixing it has come up with a few queries for me.
The fix and things to note:
1: Dont create service accounts with more than 20 chars in the name I found the same problem with using @ etc in accounts. It will work when you do the initial install. But fail forever after.
2: Change the accounts only in SSCM
When trying to change the account i got the error:
The Service did not start to due to logon failure [0x8007042d]
First change the service to logon with a system account. apply and start the service (i did this just to confirm its working and i dont have another underlying issue)
Here is where i dont understand. I added the service accounts into the Local Security Policy for "Logon As a Service" (which i thought you only had to do for SQL Server 2005 Service accounts) then when i reset the service acount again It works.
If i look at any other machines ive set up. That still use the orginal service accounts i installed them DO NOT have the accounts in the Loca Security Policy.
Does anyonek now why this fxies the probelm, Just want to make sure ive not done some nasty work around instead of a full fix.
Thanks
April 27, 2012 at 9:48 am
So I'm confused. Did you use SSCM or do the steps listed?
You should use Configuration Manager as is handles the security needed if you change accounts.
Every version needs to accounts to have the Log On as a Service right. In some versions it's granted to a group, which the service account is a member.
Follow me on Twitter: http://www.twitter.com/way0utwest
Forum Etiquette: How to post data/code on a forum to get the best help
My Blog: www.voiceofthedba.com
May 1, 2012 at 6:25 am
Hi Steve,
So i only used the config manger.
I think i got confused by the fact that I can put in a account with say a 22 char length name when i installed sql and it worked. As soon as i restarted the machine it fails. I guess it could be because it isnt in the login as Service list (just checked a working box and it has all the service accounts in there)..
Thanks and sorry for the confusion!
May 1, 2012 at 8:31 am
No worries, and thanks for the update.
I do know there is some length limit which causes issues, and is silly, IMHO. That should be allowed.
Follow me on Twitter: http://www.twitter.com/way0utwest
Forum Etiquette: How to post data/code on a forum to get the best help
My Blog: www.voiceofthedba.com
May 2, 2012 at 5:24 am
From memory, the 20 character limit is usually when you're running a Hybrid (NT4 and Post Win2K) Active Directory. I've not come across anyone using an AD infrastructure (ie Windows 2003 & above) that did not have *some* legacy requirement 🙂
As far as the Local Security Policy / User Rights Assignment goes, although your account may not be explicitly defined with the 'Logon as a Service' right, it will be a member of a local (or domain) group that does have this right. Either that, or the right is granted to NT SERVICE\MSSQL$<instanceName>, which would effectively accomplish the same thing.
[font="Courier New"]sqlmunkee[/font]
[font="Courier New"]Bringing joy and happiness via SQL Server since 1998[/font]
Viewing 6 posts - 1 through 5 (of 5 total)
You must be logged in to reply to this topic. Login to reply