Setup User Rights - SQL-FineBuild/Common GitHub Wiki

Previous Setup Group Rights	Manual Install	Setup Kerberos Next

FineBuild can set up the Windows User Rights needed for SQL Server.

The User Rights below must be assigned for the server where SQL Server is to be installed.

DBA Account rights are given so that DBA staff can do their work without the need to have Windows local Administrator access.
Service Account rights are explained more fully at Setting Up Windows Service Accounts in Books Online.

Group Policy Management

The Setup User Rights configuration can be enforced by Group Policy Management.

Processing of User Rights relates to Process Id 1EC in the FineBuild1Preparation script, and is always performed automatically.

The following steps show what you would have to do to setup User Rights manually. FineBuild does all of this work for you automatically.

User Rights are assigned using the NTRIGHTS command The relevant syntax is shown below:

NTRIGHTS UserName +r UserRight

The Rights below should be granted to the specified Users:

User Right	Internal Name	Assignment
Act as part of the operating system	SeTcbPrivilege	SQL Service Accounts
Adjust memory quotas for a process	SeIncreaseQuotaPrivilege	LOCAL SERVICE
		NETWORK SERVICE
		SQL Service Accounts
Create global objects	SeCreateGlobalPrivilege	SQL Service Accounts
Impersonate a client after authentication	SeImpersonatePrivilege	LOCAL SERVICE
		NETWORK SERVICE
		SQL Service Accounts
Lock pages in memory	SeLockMemoryPrivilege	SQL Service Accounts
Log on as a batch job	SeBatchLogonRight	SQL Service Accounts
		SQL Server Proxy Accounts
Log on as a service	SeServiceLogonRight	NETWORK SERVICE
		SQL Service Accounts
Perform volume maintenance tasks	SeManageVolumePrivilege	SQL Service Accounts
Replace a process level token	SeAssignPrimaryTokenPrivilege	LOCAL SERVICE
		NETWORK SERVICE
		SQL Service Accounts

Previous Setup Group Rights	Top	Setup Kerberos Next