Setup Group Rights - SQL-FineBuild/Common GitHub Wiki

Previous Setup Group Membership	Manual Install	Setup User Rights Next

FineBuild can set up the Windows Group Rights needed for SQL Server.

The Group Rights below must be assigned for the server where SQL Server is to be installed. The DBA rights are given so that DBA staff can do their work without the need to have Windows local Administrator access.

Group Policy Management

The Setup Group Rights configuration can be enforced by Group Policy Management.

FineBuild Group Rights Processing

Processing of Group Rights relates to Process Id 1EB in the FineBuild1Preparation script, and is always performed automatically.

Top

Manual Setup Group Rights Processing

The following steps show what you would have to do to setup Group Rights manually. FineBuild does all of this work for you automatically.

Group Rights are assigned using the NTRIGHTS command The relevant syntax is shown below:

NTRIGHTS GroupName +r GroupRight

example:

NTRIGHTS Users +r SeNetworkLogonRight

The Rights below should be granted to the specified Groups:

Group Right	Internal Name	Assignment
Access this computer from the network	SeNetworkLogonRight	(local) Users
Allow log on locally	SeInteractiveLogonRight	(local) Administrators
		(local) Users
		(local) Remote Desktop Users
Allow log on through Terminal Services	SeRemoteInteractiveLogonRight	(local) Administrators
		(local) Remote Desktop Users
Bypass traverse checking	SeChangeNotifyPrivilege	(local) Users
Perform volume maintenance tasks	SeManageVolumePrivilege	DBA Sysadmin Group
		(local) Administrators
Profile single process	SeProfileSingleProcessPrivilege	DBA Sysadmin Group
		DBA Non-Admin Group
		(local) Administrators
Profile system performance	SeSystemProfilePrivilege	DBA Sysadmin Group
		DBA Non-Admin Group
		(local) Administrators
Shut down the system	SeShutdownPrivilege	DBA Sysadmin Group
		(local) Administrators

Previous Setup Group Membership	Top	Setup User Rights Next