Service Account acting strange.

[USF-Nealio]

I recently built a new SQL server here at work, and installed the latest version of the document management product my office employs. Whenever I attempt to start the document management service with a local admin account, it fails with an access denied message. If I grant that account domain admin rights, it starts the service immediately. I'd rather not grant that service account Domain Admin rights, are there any other security Policies that I might be overlooking?

 

[USF-Nealio]

Bump for the day crew.

 

[Demon10000]

If you're using AD in 2008 R2 or higher, I would look at using a managed service account, unless the service will eventually need to run on more than one machine using the same account.

If you're not concerned with the new features and want to use a traditional service account, I would start by creating one in your directory, no on the local box. If your service needs local administrator, then you can add the domain user account into the local administrator group.

You're obviously missing a permission, and it doesn't sound like it's on that box. If starting it as a domain user account doesn't work, then I would fire up procmon and see where it's failing.

You'll need to know what permissions the service requires, and it's something that you should keep documented too. It may be looking for some rights on a file share, or maybe even trying to read something from your directory -- who knows! It all depends on what the service needs.