Home / server / Questions / 122666
Accepted
Sam
Asked: 2010-03-16 08:08:41 +0800 CST

Can't add service account to domain group during SQL cluster install

  • 772

I'm installing a 2008 instance on a Server 2003 machine which is already running SQL 2005.

I need to set up domain groups for the security setup step:

http://msdn.microsoft.com/en-us/library/ms179530.aspx

On Windows Server 2003, specify domain groups for SQL Server services. All resource permissions are controlled by domain-level groups that include SQL Server service accounts as group members.

Much more info on this here:

http://support.microsoft.com/kb/910708

I've had problems with being able to add the windows service accounts to the groups at install time. The security admins had to make my account a domain admin - which they were hesitant to do.

The account under which SQL Server Setup is running must have permissions to add accounts to the domain groups.

Is there a specific security setting which would allow my account to add accounts to a group?

UPDATE: I'm looking for specific instructions. I have a global group called domain\servicegroup - what do I tell the security folks to do. I'd love to figure it out myself, but I don't have access to this stuff.

windows sql-server windows-server-2003 security

2 Answers

  1. You don't have to be a domain administrator you just need to have someone who IS a domain administrator add the service account into the already created domain groups that you are specifying in the install. The SQL installer will check the group membership to make sure the account is in there and if not it will try to add it, which a non-DA cannot do.

    • 2
  2. Best Answer

    That's a good question. Your security admins do not have to actually make you a domain administrator - they just have to delegate the correct permissions for the OU the group belongs to in Active Directory. I've included a link to a good article below. The security admins can delegate specific permissions to you, or a DBA group, to be able to manage the groups without having to grant you access to entire directory. They may need to create a new OU for SQL Server groups and accounts, but that may be helpful to you in the long run anyway.

    http://www.windowsecurity.com/articles/Implementing-Active-Directory-Delegation-Administration.html

    • 1