It has always been my understanding that if I run something from Query
Ananlyzer, it was run under the account that Im logged into it as? And that
if I run that same code in a job, it would be run under the account that SQL
Server Agent was run as? So heres what happened while logged into QA as a
Domain Admin:
1. I tried to Restore a db from a backup and it said "Access is denied" in
the Error Log.
2. I assigned Full Control to the SQL Server Agent account (not a Domain
Admin) on the folder that contains the backup.
3. Now, still logged into QA as the Domain Admin, the Restore works.
Why would this be? Do Restores actually run under the account that the Agent
runs under?
SQL2K SP3
TIA, ChrisR
> Why would this be? Do Restores actually run under the account that the Agent
> runs under?
No, it uses the account that SQL Server uses. Which are probably the same, which in turn explains
what you experienced-
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
http://www.sqlug.se/
"ChrisR" <bla@.noemail.com> wrote in message news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...
> It has always been my understanding that if I run something from Query
> Ananlyzer, it was run under the account that Im logged into it as? And that
> if I run that same code in a job, it would be run under the account that SQL
> Server Agent was run as? So heres what happened while logged into QA as a
> Domain Admin:
> 1. I tried to Restore a db from a backup and it said "Access is denied" in
> the Error Log.
> 2. I assigned Full Control to the SQL Server Agent account (not a Domain
> Admin) on the folder that contains the backup.
> 3. Now, still logged into QA as the Domain Admin, the Restore works.
>
> Why would this be? Do Restores actually run under the account that the Agent
> runs under?
> --
> SQL2K SP3
> TIA, ChrisR
>
|||Tibor you are correct, SQL Server and the Agent are the same account. But
why would it use either of those accounts and not who I'm logged into QA as?
When else does this occur? Is this just a Restore thing?
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:Oc$BTVnJFHA.1392@.TK2MSFTNGP10.phx.gbl...[vbcol=seagreen]
Agent
> No, it uses the account that SQL Server uses. Which are probably the same,
which in turn explains
> what you experienced-
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> http://www.sqlug.se/
>
> "ChrisR" <bla@.noemail.com> wrote in message
news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...[vbcol=seagreen]
that[vbcol=seagreen]
SQL[vbcol=seagreen]
a[vbcol=seagreen]
in[vbcol=seagreen]
Agent
>
|||Think of it from a technical viewpoint. It is SQL Server who reads the file to restore. For SQL
Server to open the file in *your* account, something we call "delegation" is needed. Delegation is
supported in Windows, with some configuration first. The application (SQL Server in this case) need
to be programmed for it, though. SQL Server supports delegation for some operations (linked
servers).
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
http://www.sqlug.se/
"ChrisR" <bla@.noemail.com> wrote in message news:%232PndSoJFHA.1948@.TK2MSFTNGP14.phx.gbl...
> Tibor you are correct, SQL Server and the Agent are the same account. But
> why would it use either of those accounts and not who I'm logged into QA as?
> When else does this occur? Is this just a Restore thing?
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
> message news:Oc$BTVnJFHA.1392@.TK2MSFTNGP10.phx.gbl...
> Agent
> which in turn explains
> news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...
> that
> SQL
> a
> in
> Agent
>
|||So then what other operations would use the SQL Server account, not my
account, from QA?
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:u6rnXyoJFHA.2356@.TK2MSFTNGP14.phx.gbl...
> Think of it from a technical viewpoint. It is SQL Server who reads the
file to restore. For SQL
> Server to open the file in *your* account, something we call "delegation"
is needed. Delegation is
> supported in Windows, with some configuration first. The application (SQL
Server in this case) need
> to be programmed for it, though. SQL Server supports delegation for some
operations (linked
> servers).
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> http://www.sqlug.se/
>
> "ChrisR" <bla@.noemail.com> wrote in message
news:%232PndSoJFHA.1948@.TK2MSFTNGP14.phx.gbl...[vbcol=seagreen]
But[vbcol=seagreen]
as?[vbcol=seagreen]
in[vbcol=seagreen]
the[vbcol=seagreen]
same,[vbcol=seagreen]
Query[vbcol=seagreen]
And[vbcol=seagreen]
that[vbcol=seagreen]
as[vbcol=seagreen]
denied"[vbcol=seagreen]
Domain[vbcol=seagreen]
the
>
|||The only time, AFAIK, SQL Server uses delegation is for linked servers. For all other operations,
the service account is used (regardless of whether the client application is QA, SQL Server Agent, a
web app etc.)..
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
http://www.sqlug.se/
"ChrisR" <bla@.noemail.com> wrote in message news:uqfKO2oJFHA.3960@.TK2MSFTNGP09.phx.gbl...
> So then what other operations would use the SQL Server account, not my
> account, from QA?
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
> message news:u6rnXyoJFHA.2356@.TK2MSFTNGP14.phx.gbl...
> file to restore. For SQL
> is needed. Delegation is
> Server in this case) need
> operations (linked
> news:%232PndSoJFHA.1948@.TK2MSFTNGP14.phx.gbl...
> But
> as?
> in
> the
> same,
> Query
> And
> that
> as
> denied"
> Domain
> the
>
Showing posts with label permissions. Show all posts
Showing posts with label permissions. Show all posts
Wednesday, March 21, 2012
odd permissions problems
It has always been my understanding that if I run something from Query
Ananlyzer, it was run under the account that Im logged into it as? And that
if I run that same code in a job, it would be run under the account that SQL
Server Agent was run as? So heres what happened while logged into QA as a
Domain Admin:
1. I tried to Restore a db from a backup and it said "Access is denied" in
the Error Log.
2. I assigned Full Control to the SQL Server Agent account (not a Domain
Admin) on the folder that contains the backup.
3. Now, still logged into QA as the Domain Admin, the Restore works.
Why would this be? Do Restores actually run under the account that the Agent
runs under?
SQL2K SP3
TIA, ChrisR> Why would this be? Do Restores actually run under the account that the Agentn">
> runs under?
No, it uses the account that SQL Server uses. Which are probably the same, w
hich in turn explains
what you experienced-
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
http://www.sqlug.se/
"ChrisR" <bla@.noemail.com> wrote in message news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...[vbc
ol=seagreen]
> It has always been my understanding that if I run something from Query
> Ananlyzer, it was run under the account that Im logged into it as? And tha
t
> if I run that same code in a job, it would be run under the account that S
QL
> Server Agent was run as? So heres what happened while logged into QA as a
> Domain Admin:
> 1. I tried to Restore a db from a backup and it said "Access is denied" in
> the Error Log.
> 2. I assigned Full Control to the SQL Server Agent account (not a Domain
> Admin) on the folder that contains the backup.
> 3. Now, still logged into QA as the Domain Admin, the Restore works.
>
> Why would this be? Do Restores actually run under the account that the Age
nt
> runs under?
> --
> SQL2K SP3
> TIA, ChrisR
>[/vbcol]|||Tibor you are correct, SQL Server and the Agent are the same account. But
why would it use either of those accounts and not who I'm logged into QA as?
When else does this occur? Is this just a Restore thing?
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:Oc$BTVnJFHA.1392@.TK2MSFTNGP10.phx.gbl...
Agent[vbcol=seagreen]
> No, it uses the account that SQL Server uses. Which are probably the same,
which in turn explains
> what you experienced-
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> http://www.sqlug.se/
>
> "ChrisR" <bla@.noemail.com> wrote in message
news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...
that[vbcol=seagreen]
SQL[vbcol=seagreen]
a[vbcol=seagreen]
in[vbcol=seagreen]
Agent[vbcol=seagreen]
>|||Think of it from a technical viewpoint. It is SQL Server who reads the file
to restore. For SQL
Server to open the file in *your* account, something we call "delegation" is
needed. Delegation is
supported in Windows, with some configuration first. The application (SQL Se
rver in this case) need
to be programmed for it, though. SQL Server supports delegation for some ope
rations (linked
servers).
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
http://www.sqlug.se/
"ChrisR" <bla@.noemail.com> wrote in message news:%232PndSoJFHA.1948@.TK2MSFTNGP14.phx.gbl...[
vbcol=seagreen]
> Tibor you are correct, SQL Server and the Agent are the same account. But
> why would it use either of those accounts and not who I'm logged into QA a
s?
> When else does this occur? Is this just a Restore thing?
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote i
n
> message news:Oc$BTVnJFHA.1392@.TK2MSFTNGP10.phx.gbl...
> Agent
> which in turn explains
> news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...
> that
> SQL
> a
> in
> Agent
>[/vbcol]|||So then what other operations would use the SQL Server account, not my
account, from QA?
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:u6rnXyoJFHA.2356@.TK2MSFTNGP14.phx.gbl...
> Think of it from a technical viewpoint. It is SQL Server who reads the
file to restore. For SQL
> Server to open the file in *your* account, something we call "delegation"
is needed. Delegation is
> supported in Windows, with some configuration first. The application (SQL
Server in this case) need
> to be programmed for it, though. SQL Server supports delegation for some
operations (linked
> servers).
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> http://www.sqlug.se/
>
> "ChrisR" <bla@.noemail.com> wrote in message
news:%232PndSoJFHA.1948@.TK2MSFTNGP14.phx.gbl...
But[vbcol=seagreen]
as?[vbcol=seagreen]
in[vbcol=seagreen]
the[vbcol=seagreen]
same,[vbcol=seagreen]
Query[vbcol=seagreen]
And[vbcol=seagreen]
that[vbcol=seagreen]
as[vbcol=seagreen]
denied"[vbcol=seagreen]
Domain[vbcol=seagreen]
the[vbcol=seagreen]
>|||The only time, AFAIK, SQL Server uses delegation is for linked servers. For
all other operations,
the service account is used (regardless of whether the client application is
QA, SQL Server Agent, a
web app etc.)..
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
http://www.sqlug.se/
"ChrisR" <bla@.noemail.com> wrote in message news:uqfKO2oJFHA.3960@.TK2MSFTNGP09.phx.gbl...[vb
col=seagreen]
> So then what other operations would use the SQL Server account, not my
> account, from QA?
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote i
n
> message news:u6rnXyoJFHA.2356@.TK2MSFTNGP14.phx.gbl...
> file to restore. For SQL
> is needed. Delegation is
> Server in this case) need
> operations (linked
> news:%232PndSoJFHA.1948@.TK2MSFTNGP14.phx.gbl...
> But
> as?
> in
> the
> same,
> Query
> And
> that
> as
> denied"
> Domain
> the
>[/vbcol]
Ananlyzer, it was run under the account that Im logged into it as? And that
if I run that same code in a job, it would be run under the account that SQL
Server Agent was run as? So heres what happened while logged into QA as a
Domain Admin:
1. I tried to Restore a db from a backup and it said "Access is denied" in
the Error Log.
2. I assigned Full Control to the SQL Server Agent account (not a Domain
Admin) on the folder that contains the backup.
3. Now, still logged into QA as the Domain Admin, the Restore works.
Why would this be? Do Restores actually run under the account that the Agent
runs under?
SQL2K SP3
TIA, ChrisR> Why would this be? Do Restores actually run under the account that the Agentn">
> runs under?
No, it uses the account that SQL Server uses. Which are probably the same, w
hich in turn explains
what you experienced-
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
http://www.sqlug.se/
"ChrisR" <bla@.noemail.com> wrote in message news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...[vbc
ol=seagreen]
> It has always been my understanding that if I run something from Query
> Ananlyzer, it was run under the account that Im logged into it as? And tha
t
> if I run that same code in a job, it would be run under the account that S
QL
> Server Agent was run as? So heres what happened while logged into QA as a
> Domain Admin:
> 1. I tried to Restore a db from a backup and it said "Access is denied" in
> the Error Log.
> 2. I assigned Full Control to the SQL Server Agent account (not a Domain
> Admin) on the folder that contains the backup.
> 3. Now, still logged into QA as the Domain Admin, the Restore works.
>
> Why would this be? Do Restores actually run under the account that the Age
nt
> runs under?
> --
> SQL2K SP3
> TIA, ChrisR
>[/vbcol]|||Tibor you are correct, SQL Server and the Agent are the same account. But
why would it use either of those accounts and not who I'm logged into QA as?
When else does this occur? Is this just a Restore thing?
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:Oc$BTVnJFHA.1392@.TK2MSFTNGP10.phx.gbl...
Agent[vbcol=seagreen]
> No, it uses the account that SQL Server uses. Which are probably the same,
which in turn explains
> what you experienced-
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> http://www.sqlug.se/
>
> "ChrisR" <bla@.noemail.com> wrote in message
news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...
that[vbcol=seagreen]
SQL[vbcol=seagreen]
a[vbcol=seagreen]
in[vbcol=seagreen]
Agent[vbcol=seagreen]
>|||Think of it from a technical viewpoint. It is SQL Server who reads the file
to restore. For SQL
Server to open the file in *your* account, something we call "delegation" is
needed. Delegation is
supported in Windows, with some configuration first. The application (SQL Se
rver in this case) need
to be programmed for it, though. SQL Server supports delegation for some ope
rations (linked
servers).
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
http://www.sqlug.se/
"ChrisR" <bla@.noemail.com> wrote in message news:%232PndSoJFHA.1948@.TK2MSFTNGP14.phx.gbl...[
vbcol=seagreen]
> Tibor you are correct, SQL Server and the Agent are the same account. But
> why would it use either of those accounts and not who I'm logged into QA a
s?
> When else does this occur? Is this just a Restore thing?
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote i
n
> message news:Oc$BTVnJFHA.1392@.TK2MSFTNGP10.phx.gbl...
> Agent
> which in turn explains
> news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...
> that
> SQL
> a
> in
> Agent
>[/vbcol]|||So then what other operations would use the SQL Server account, not my
account, from QA?
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:u6rnXyoJFHA.2356@.TK2MSFTNGP14.phx.gbl...
> Think of it from a technical viewpoint. It is SQL Server who reads the
file to restore. For SQL
> Server to open the file in *your* account, something we call "delegation"
is needed. Delegation is
> supported in Windows, with some configuration first. The application (SQL
Server in this case) need
> to be programmed for it, though. SQL Server supports delegation for some
operations (linked
> servers).
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> http://www.sqlug.se/
>
> "ChrisR" <bla@.noemail.com> wrote in message
news:%232PndSoJFHA.1948@.TK2MSFTNGP14.phx.gbl...
But[vbcol=seagreen]
as?[vbcol=seagreen]
in[vbcol=seagreen]
the[vbcol=seagreen]
same,[vbcol=seagreen]
Query[vbcol=seagreen]
And[vbcol=seagreen]
that[vbcol=seagreen]
as[vbcol=seagreen]
denied"[vbcol=seagreen]
Domain[vbcol=seagreen]
the[vbcol=seagreen]
>|||The only time, AFAIK, SQL Server uses delegation is for linked servers. For
all other operations,
the service account is used (regardless of whether the client application is
QA, SQL Server Agent, a
web app etc.)..
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
http://www.sqlug.se/
"ChrisR" <bla@.noemail.com> wrote in message news:uqfKO2oJFHA.3960@.TK2MSFTNGP09.phx.gbl...[vb
col=seagreen]
> So then what other operations would use the SQL Server account, not my
> account, from QA?
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote i
n
> message news:u6rnXyoJFHA.2356@.TK2MSFTNGP14.phx.gbl...
> file to restore. For SQL
> is needed. Delegation is
> Server in this case) need
> operations (linked
> news:%232PndSoJFHA.1948@.TK2MSFTNGP14.phx.gbl...
> But
> as?
> in
> the
> same,
> Query
> And
> that
> as
> denied"
> Domain
> the
>[/vbcol]
odd permissions problems
It has always been my understanding that if I run something from Query
Ananlyzer, it was run under the account that Im logged into it as? And that
if I run that same code in a job, it would be run under the account that SQL
Server Agent was run as? So heres what happened while logged into QA as a
Domain Admin:
1. I tried to Restore a db from a backup and it said "Access is denied" in
the Error Log.
2. I assigned Full Control to the SQL Server Agent account (not a Domain
Admin) on the folder that contains the backup.
3. Now, still logged into QA as the Domain Admin, the Restore works.
Why would this be? Do Restores actually run under the account that the Agent
runs under?
--
SQL2K SP3
TIA, ChrisR> Why would this be? Do Restores actually run under the account that the Agent
> runs under?
No, it uses the account that SQL Server uses. Which are probably the same, which in turn explains
what you experienced-
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
http://www.sqlug.se/
"ChrisR" <bla@.noemail.com> wrote in message news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...
> It has always been my understanding that if I run something from Query
> Ananlyzer, it was run under the account that Im logged into it as? And that
> if I run that same code in a job, it would be run under the account that SQL
> Server Agent was run as? So heres what happened while logged into QA as a
> Domain Admin:
> 1. I tried to Restore a db from a backup and it said "Access is denied" in
> the Error Log.
> 2. I assigned Full Control to the SQL Server Agent account (not a Domain
> Admin) on the folder that contains the backup.
> 3. Now, still logged into QA as the Domain Admin, the Restore works.
>
> Why would this be? Do Restores actually run under the account that the Agent
> runs under?
> --
> SQL2K SP3
> TIA, ChrisR
>|||Tibor you are correct, SQL Server and the Agent are the same account. But
why would it use either of those accounts and not who I'm logged into QA as?
When else does this occur? Is this just a Restore thing?
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:Oc$BTVnJFHA.1392@.TK2MSFTNGP10.phx.gbl...
> > Why would this be? Do Restores actually run under the account that the
Agent
> > runs under?
> No, it uses the account that SQL Server uses. Which are probably the same,
which in turn explains
> what you experienced-
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> http://www.sqlug.se/
>
> "ChrisR" <bla@.noemail.com> wrote in message
news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...
> > It has always been my understanding that if I run something from Query
> > Ananlyzer, it was run under the account that Im logged into it as? And
that
> > if I run that same code in a job, it would be run under the account that
SQL
> > Server Agent was run as? So heres what happened while logged into QA as
a
> > Domain Admin:
> >
> > 1. I tried to Restore a db from a backup and it said "Access is denied"
in
> > the Error Log.
> > 2. I assigned Full Control to the SQL Server Agent account (not a Domain
> > Admin) on the folder that contains the backup.
> > 3. Now, still logged into QA as the Domain Admin, the Restore works.
> >
> >
> > Why would this be? Do Restores actually run under the account that the
Agent
> > runs under?
> >
> > --
> > SQL2K SP3
> >
> > TIA, ChrisR
> >
> >
>|||Think of it from a technical viewpoint. It is SQL Server who reads the file to restore. For SQL
Server to open the file in *your* account, something we call "delegation" is needed. Delegation is
supported in Windows, with some configuration first. The application (SQL Server in this case) need
to be programmed for it, though. SQL Server supports delegation for some operations (linked
servers).
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
http://www.sqlug.se/
"ChrisR" <bla@.noemail.com> wrote in message news:%232PndSoJFHA.1948@.TK2MSFTNGP14.phx.gbl...
> Tibor you are correct, SQL Server and the Agent are the same account. But
> why would it use either of those accounts and not who I'm logged into QA as?
> When else does this occur? Is this just a Restore thing?
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
> message news:Oc$BTVnJFHA.1392@.TK2MSFTNGP10.phx.gbl...
>> > Why would this be? Do Restores actually run under the account that the
> Agent
>> > runs under?
>> No, it uses the account that SQL Server uses. Which are probably the same,
> which in turn explains
>> what you experienced-
>> --
>> Tibor Karaszi, SQL Server MVP
>> http://www.karaszi.com/sqlserver/default.asp
>> http://www.solidqualitylearning.com/
>> http://www.sqlug.se/
>>
>> "ChrisR" <bla@.noemail.com> wrote in message
> news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...
>> > It has always been my understanding that if I run something from Query
>> > Ananlyzer, it was run under the account that Im logged into it as? And
> that
>> > if I run that same code in a job, it would be run under the account that
> SQL
>> > Server Agent was run as? So heres what happened while logged into QA as
> a
>> > Domain Admin:
>> >
>> > 1. I tried to Restore a db from a backup and it said "Access is denied"
> in
>> > the Error Log.
>> > 2. I assigned Full Control to the SQL Server Agent account (not a Domain
>> > Admin) on the folder that contains the backup.
>> > 3. Now, still logged into QA as the Domain Admin, the Restore works.
>> >
>> >
>> > Why would this be? Do Restores actually run under the account that the
> Agent
>> > runs under?
>> >
>> > --
>> > SQL2K SP3
>> >
>> > TIA, ChrisR
>> >
>> >
>>
>|||So then what other operations would use the SQL Server account, not my
account, from QA?
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:u6rnXyoJFHA.2356@.TK2MSFTNGP14.phx.gbl...
> Think of it from a technical viewpoint. It is SQL Server who reads the
file to restore. For SQL
> Server to open the file in *your* account, something we call "delegation"
is needed. Delegation is
> supported in Windows, with some configuration first. The application (SQL
Server in this case) need
> to be programmed for it, though. SQL Server supports delegation for some
operations (linked
> servers).
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> http://www.sqlug.se/
>
> "ChrisR" <bla@.noemail.com> wrote in message
news:%232PndSoJFHA.1948@.TK2MSFTNGP14.phx.gbl...
> > Tibor you are correct, SQL Server and the Agent are the same account.
But
> > why would it use either of those accounts and not who I'm logged into QA
as?
> > When else does this occur? Is this just a Restore thing?
> >
> >
> >
> > "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote
in
> > message news:Oc$BTVnJFHA.1392@.TK2MSFTNGP10.phx.gbl...
> >> > Why would this be? Do Restores actually run under the account that
the
> > Agent
> >> > runs under?
> >>
> >> No, it uses the account that SQL Server uses. Which are probably the
same,
> > which in turn explains
> >> what you experienced-
> >>
> >> --
> >> Tibor Karaszi, SQL Server MVP
> >> http://www.karaszi.com/sqlserver/default.asp
> >> http://www.solidqualitylearning.com/
> >> http://www.sqlug.se/
> >>
> >>
> >> "ChrisR" <bla@.noemail.com> wrote in message
> > news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...
> >> > It has always been my understanding that if I run something from
Query
> >> > Ananlyzer, it was run under the account that Im logged into it as?
And
> > that
> >> > if I run that same code in a job, it would be run under the account
that
> > SQL
> >> > Server Agent was run as? So heres what happened while logged into QA
as
> > a
> >> > Domain Admin:
> >> >
> >> > 1. I tried to Restore a db from a backup and it said "Access is
denied"
> > in
> >> > the Error Log.
> >> > 2. I assigned Full Control to the SQL Server Agent account (not a
Domain
> >> > Admin) on the folder that contains the backup.
> >> > 3. Now, still logged into QA as the Domain Admin, the Restore works.
> >> >
> >> >
> >> > Why would this be? Do Restores actually run under the account that
the
> > Agent
> >> > runs under?
> >> >
> >> > --
> >> > SQL2K SP3
> >> >
> >> > TIA, ChrisR
> >> >
> >> >
> >>
> >>
> >
> >
>|||The only time, AFAIK, SQL Server uses delegation is for linked servers. For all other operations,
the service account is used (regardless of whether the client application is QA, SQL Server Agent, a
web app etc.)..
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
http://www.sqlug.se/
"ChrisR" <bla@.noemail.com> wrote in message news:uqfKO2oJFHA.3960@.TK2MSFTNGP09.phx.gbl...
> So then what other operations would use the SQL Server account, not my
> account, from QA?
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
> message news:u6rnXyoJFHA.2356@.TK2MSFTNGP14.phx.gbl...
>> Think of it from a technical viewpoint. It is SQL Server who reads the
> file to restore. For SQL
>> Server to open the file in *your* account, something we call "delegation"
> is needed. Delegation is
>> supported in Windows, with some configuration first. The application (SQL
> Server in this case) need
>> to be programmed for it, though. SQL Server supports delegation for some
> operations (linked
>> servers).
>> --
>> Tibor Karaszi, SQL Server MVP
>> http://www.karaszi.com/sqlserver/default.asp
>> http://www.solidqualitylearning.com/
>> http://www.sqlug.se/
>>
>> "ChrisR" <bla@.noemail.com> wrote in message
> news:%232PndSoJFHA.1948@.TK2MSFTNGP14.phx.gbl...
>> > Tibor you are correct, SQL Server and the Agent are the same account.
> But
>> > why would it use either of those accounts and not who I'm logged into QA
> as?
>> > When else does this occur? Is this just a Restore thing?
>> >
>> >
>> >
>> > "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote
> in
>> > message news:Oc$BTVnJFHA.1392@.TK2MSFTNGP10.phx.gbl...
>> >> > Why would this be? Do Restores actually run under the account that
> the
>> > Agent
>> >> > runs under?
>> >>
>> >> No, it uses the account that SQL Server uses. Which are probably the
> same,
>> > which in turn explains
>> >> what you experienced-
>> >>
>> >> --
>> >> Tibor Karaszi, SQL Server MVP
>> >> http://www.karaszi.com/sqlserver/default.asp
>> >> http://www.solidqualitylearning.com/
>> >> http://www.sqlug.se/
>> >>
>> >>
>> >> "ChrisR" <bla@.noemail.com> wrote in message
>> > news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...
>> >> > It has always been my understanding that if I run something from
> Query
>> >> > Ananlyzer, it was run under the account that Im logged into it as?
> And
>> > that
>> >> > if I run that same code in a job, it would be run under the account
> that
>> > SQL
>> >> > Server Agent was run as? So heres what happened while logged into QA
> as
>> > a
>> >> > Domain Admin:
>> >> >
>> >> > 1. I tried to Restore a db from a backup and it said "Access is
> denied"
>> > in
>> >> > the Error Log.
>> >> > 2. I assigned Full Control to the SQL Server Agent account (not a
> Domain
>> >> > Admin) on the folder that contains the backup.
>> >> > 3. Now, still logged into QA as the Domain Admin, the Restore works.
>> >> >
>> >> >
>> >> > Why would this be? Do Restores actually run under the account that
> the
>> > Agent
>> >> > runs under?
>> >> >
>> >> > --
>> >> > SQL2K SP3
>> >> >
>> >> > TIA, ChrisR
>> >> >
>> >> >
>> >>
>> >>
>> >
>> >
>>
>
Ananlyzer, it was run under the account that Im logged into it as? And that
if I run that same code in a job, it would be run under the account that SQL
Server Agent was run as? So heres what happened while logged into QA as a
Domain Admin:
1. I tried to Restore a db from a backup and it said "Access is denied" in
the Error Log.
2. I assigned Full Control to the SQL Server Agent account (not a Domain
Admin) on the folder that contains the backup.
3. Now, still logged into QA as the Domain Admin, the Restore works.
Why would this be? Do Restores actually run under the account that the Agent
runs under?
--
SQL2K SP3
TIA, ChrisR> Why would this be? Do Restores actually run under the account that the Agent
> runs under?
No, it uses the account that SQL Server uses. Which are probably the same, which in turn explains
what you experienced-
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
http://www.sqlug.se/
"ChrisR" <bla@.noemail.com> wrote in message news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...
> It has always been my understanding that if I run something from Query
> Ananlyzer, it was run under the account that Im logged into it as? And that
> if I run that same code in a job, it would be run under the account that SQL
> Server Agent was run as? So heres what happened while logged into QA as a
> Domain Admin:
> 1. I tried to Restore a db from a backup and it said "Access is denied" in
> the Error Log.
> 2. I assigned Full Control to the SQL Server Agent account (not a Domain
> Admin) on the folder that contains the backup.
> 3. Now, still logged into QA as the Domain Admin, the Restore works.
>
> Why would this be? Do Restores actually run under the account that the Agent
> runs under?
> --
> SQL2K SP3
> TIA, ChrisR
>|||Tibor you are correct, SQL Server and the Agent are the same account. But
why would it use either of those accounts and not who I'm logged into QA as?
When else does this occur? Is this just a Restore thing?
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:Oc$BTVnJFHA.1392@.TK2MSFTNGP10.phx.gbl...
> > Why would this be? Do Restores actually run under the account that the
Agent
> > runs under?
> No, it uses the account that SQL Server uses. Which are probably the same,
which in turn explains
> what you experienced-
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> http://www.sqlug.se/
>
> "ChrisR" <bla@.noemail.com> wrote in message
news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...
> > It has always been my understanding that if I run something from Query
> > Ananlyzer, it was run under the account that Im logged into it as? And
that
> > if I run that same code in a job, it would be run under the account that
SQL
> > Server Agent was run as? So heres what happened while logged into QA as
a
> > Domain Admin:
> >
> > 1. I tried to Restore a db from a backup and it said "Access is denied"
in
> > the Error Log.
> > 2. I assigned Full Control to the SQL Server Agent account (not a Domain
> > Admin) on the folder that contains the backup.
> > 3. Now, still logged into QA as the Domain Admin, the Restore works.
> >
> >
> > Why would this be? Do Restores actually run under the account that the
Agent
> > runs under?
> >
> > --
> > SQL2K SP3
> >
> > TIA, ChrisR
> >
> >
>|||Think of it from a technical viewpoint. It is SQL Server who reads the file to restore. For SQL
Server to open the file in *your* account, something we call "delegation" is needed. Delegation is
supported in Windows, with some configuration first. The application (SQL Server in this case) need
to be programmed for it, though. SQL Server supports delegation for some operations (linked
servers).
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
http://www.sqlug.se/
"ChrisR" <bla@.noemail.com> wrote in message news:%232PndSoJFHA.1948@.TK2MSFTNGP14.phx.gbl...
> Tibor you are correct, SQL Server and the Agent are the same account. But
> why would it use either of those accounts and not who I'm logged into QA as?
> When else does this occur? Is this just a Restore thing?
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
> message news:Oc$BTVnJFHA.1392@.TK2MSFTNGP10.phx.gbl...
>> > Why would this be? Do Restores actually run under the account that the
> Agent
>> > runs under?
>> No, it uses the account that SQL Server uses. Which are probably the same,
> which in turn explains
>> what you experienced-
>> --
>> Tibor Karaszi, SQL Server MVP
>> http://www.karaszi.com/sqlserver/default.asp
>> http://www.solidqualitylearning.com/
>> http://www.sqlug.se/
>>
>> "ChrisR" <bla@.noemail.com> wrote in message
> news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...
>> > It has always been my understanding that if I run something from Query
>> > Ananlyzer, it was run under the account that Im logged into it as? And
> that
>> > if I run that same code in a job, it would be run under the account that
> SQL
>> > Server Agent was run as? So heres what happened while logged into QA as
> a
>> > Domain Admin:
>> >
>> > 1. I tried to Restore a db from a backup and it said "Access is denied"
> in
>> > the Error Log.
>> > 2. I assigned Full Control to the SQL Server Agent account (not a Domain
>> > Admin) on the folder that contains the backup.
>> > 3. Now, still logged into QA as the Domain Admin, the Restore works.
>> >
>> >
>> > Why would this be? Do Restores actually run under the account that the
> Agent
>> > runs under?
>> >
>> > --
>> > SQL2K SP3
>> >
>> > TIA, ChrisR
>> >
>> >
>>
>|||So then what other operations would use the SQL Server account, not my
account, from QA?
"Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
message news:u6rnXyoJFHA.2356@.TK2MSFTNGP14.phx.gbl...
> Think of it from a technical viewpoint. It is SQL Server who reads the
file to restore. For SQL
> Server to open the file in *your* account, something we call "delegation"
is needed. Delegation is
> supported in Windows, with some configuration first. The application (SQL
Server in this case) need
> to be programmed for it, though. SQL Server supports delegation for some
operations (linked
> servers).
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
> http://www.sqlug.se/
>
> "ChrisR" <bla@.noemail.com> wrote in message
news:%232PndSoJFHA.1948@.TK2MSFTNGP14.phx.gbl...
> > Tibor you are correct, SQL Server and the Agent are the same account.
But
> > why would it use either of those accounts and not who I'm logged into QA
as?
> > When else does this occur? Is this just a Restore thing?
> >
> >
> >
> > "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote
in
> > message news:Oc$BTVnJFHA.1392@.TK2MSFTNGP10.phx.gbl...
> >> > Why would this be? Do Restores actually run under the account that
the
> > Agent
> >> > runs under?
> >>
> >> No, it uses the account that SQL Server uses. Which are probably the
same,
> > which in turn explains
> >> what you experienced-
> >>
> >> --
> >> Tibor Karaszi, SQL Server MVP
> >> http://www.karaszi.com/sqlserver/default.asp
> >> http://www.solidqualitylearning.com/
> >> http://www.sqlug.se/
> >>
> >>
> >> "ChrisR" <bla@.noemail.com> wrote in message
> > news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...
> >> > It has always been my understanding that if I run something from
Query
> >> > Ananlyzer, it was run under the account that Im logged into it as?
And
> > that
> >> > if I run that same code in a job, it would be run under the account
that
> > SQL
> >> > Server Agent was run as? So heres what happened while logged into QA
as
> > a
> >> > Domain Admin:
> >> >
> >> > 1. I tried to Restore a db from a backup and it said "Access is
denied"
> > in
> >> > the Error Log.
> >> > 2. I assigned Full Control to the SQL Server Agent account (not a
Domain
> >> > Admin) on the folder that contains the backup.
> >> > 3. Now, still logged into QA as the Domain Admin, the Restore works.
> >> >
> >> >
> >> > Why would this be? Do Restores actually run under the account that
the
> > Agent
> >> > runs under?
> >> >
> >> > --
> >> > SQL2K SP3
> >> >
> >> > TIA, ChrisR
> >> >
> >> >
> >>
> >>
> >
> >
>|||The only time, AFAIK, SQL Server uses delegation is for linked servers. For all other operations,
the service account is used (regardless of whether the client application is QA, SQL Server Agent, a
web app etc.)..
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
http://www.sqlug.se/
"ChrisR" <bla@.noemail.com> wrote in message news:uqfKO2oJFHA.3960@.TK2MSFTNGP09.phx.gbl...
> So then what other operations would use the SQL Server account, not my
> account, from QA?
>
> "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote in
> message news:u6rnXyoJFHA.2356@.TK2MSFTNGP14.phx.gbl...
>> Think of it from a technical viewpoint. It is SQL Server who reads the
> file to restore. For SQL
>> Server to open the file in *your* account, something we call "delegation"
> is needed. Delegation is
>> supported in Windows, with some configuration first. The application (SQL
> Server in this case) need
>> to be programmed for it, though. SQL Server supports delegation for some
> operations (linked
>> servers).
>> --
>> Tibor Karaszi, SQL Server MVP
>> http://www.karaszi.com/sqlserver/default.asp
>> http://www.solidqualitylearning.com/
>> http://www.sqlug.se/
>>
>> "ChrisR" <bla@.noemail.com> wrote in message
> news:%232PndSoJFHA.1948@.TK2MSFTNGP14.phx.gbl...
>> > Tibor you are correct, SQL Server and the Agent are the same account.
> But
>> > why would it use either of those accounts and not who I'm logged into QA
> as?
>> > When else does this occur? Is this just a Restore thing?
>> >
>> >
>> >
>> > "Tibor Karaszi" <tibor_please.no.email_karaszi@.hotmail.nomail.com> wrote
> in
>> > message news:Oc$BTVnJFHA.1392@.TK2MSFTNGP10.phx.gbl...
>> >> > Why would this be? Do Restores actually run under the account that
> the
>> > Agent
>> >> > runs under?
>> >>
>> >> No, it uses the account that SQL Server uses. Which are probably the
> same,
>> > which in turn explains
>> >> what you experienced-
>> >>
>> >> --
>> >> Tibor Karaszi, SQL Server MVP
>> >> http://www.karaszi.com/sqlserver/default.asp
>> >> http://www.solidqualitylearning.com/
>> >> http://www.sqlug.se/
>> >>
>> >>
>> >> "ChrisR" <bla@.noemail.com> wrote in message
>> > news:OlC4FamJFHA.220@.TK2MSFTNGP10.phx.gbl...
>> >> > It has always been my understanding that if I run something from
> Query
>> >> > Ananlyzer, it was run under the account that Im logged into it as?
> And
>> > that
>> >> > if I run that same code in a job, it would be run under the account
> that
>> > SQL
>> >> > Server Agent was run as? So heres what happened while logged into QA
> as
>> > a
>> >> > Domain Admin:
>> >> >
>> >> > 1. I tried to Restore a db from a backup and it said "Access is
> denied"
>> > in
>> >> > the Error Log.
>> >> > 2. I assigned Full Control to the SQL Server Agent account (not a
> Domain
>> >> > Admin) on the folder that contains the backup.
>> >> > 3. Now, still logged into QA as the Domain Admin, the Restore works.
>> >> >
>> >> >
>> >> > Why would this be? Do Restores actually run under the account that
> the
>> > Agent
>> >> > runs under?
>> >> >
>> >> > --
>> >> > SQL2K SP3
>> >> >
>> >> > TIA, ChrisR
>> >> >
>> >> >
>> >>
>> >>
>> >
>> >
>>
>
Saturday, February 25, 2012
ODBC Permissions from Custom Data Processing Extension
Hi
I am trying to create a custom data processing extension that queries a Sybase database (ie odbc), then on the basis of this data queries a SQL Server database. However, when I get to querying the Sybase database, the method instantly crashed with a SecurityException "Request Failed." exception being thrown. I have so far being guessing that this is due to Permissions.
I have tried to create a OdbcPermission Permission Set which I have assigned to the relevant code group, and also have put a OdbcPermission attribute at the start of the method which is to access the Sybase database, but to no avail.
Does anybody have any idea what I can do to resolve this problem?
Thanks
Jan
*****************************************
* This message was posted via http://www.sqlmonster.com
*
* Report spam or abuse by clicking the following URL:
* http://www.sqlmonster.com/Uwe/Abuse.aspx?aid=72424bb9b1394d278da3c0fb33e5c352
*****************************************Almost certain that it is a Permissions issue now, as I set it to FullTrust and it made a connection to the Sybase database.
Can anybody tell me how to set up the permissions for connecting to an ODBC database for use in a custom assembly?
Would be much appreciated!
*****************************************
* A copy of the whole thread can be found at:
* http://www.sqlmonster.com/Uwe/Forum.aspx/sql-server-reporting/4587
*
* Report spam or abuse by clicking the following URL:
* http://www.sqlmonster.com/Uwe/Abuse.aspx?aid=b41e9858e9da41d88067b4f8fb5cabe6
*****************************************|||Hi Jan,
the ODBCPermission class is intended for future use when the .NET Framework
Data Provider for ODBC is enabled for partial trust scenarios. The .NET
Framework Data Provider for ODBC currently requires FullTrust permission. At
present, using the OdbcPermission class has no effect. You may also want to
check this MSDN article:
Code access security and ADO.NET
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/html/cpconcodeaccesssecurityadonet.asp
HTH, Robert
--
This posting is provided "AS IS" with no warranties, and confers no rights.
"Jan Bodey via SQLMonster.com" <forum@.SQLMonster.com> wrote in message
news:b41e9858e9da41d88067b4f8fb5cabe6@.SQLMonster.com...
> Almost certain that it is a Permissions issue now, as I set it to
FullTrust and it made a connection to the Sybase database.
> Can anybody tell me how to set up the permissions for connecting to an
ODBC database for use in a custom assembly?
> Would be much appreciated!
> *****************************************
> * A copy of the whole thread can be found at:
> * http://www.sqlmonster.com/Uwe/Forum.aspx/sql-server-reporting/4587
> *
> * Report spam or abuse by clicking the following URL:
> *
http://www.sqlmonster.com/Uwe/Abuse.aspx?aid=b41e9858e9da41d88067b4f8fb5cabe6
> *****************************************
I am trying to create a custom data processing extension that queries a Sybase database (ie odbc), then on the basis of this data queries a SQL Server database. However, when I get to querying the Sybase database, the method instantly crashed with a SecurityException "Request Failed." exception being thrown. I have so far being guessing that this is due to Permissions.
I have tried to create a OdbcPermission Permission Set which I have assigned to the relevant code group, and also have put a OdbcPermission attribute at the start of the method which is to access the Sybase database, but to no avail.
Does anybody have any idea what I can do to resolve this problem?
Thanks
Jan
*****************************************
* This message was posted via http://www.sqlmonster.com
*
* Report spam or abuse by clicking the following URL:
* http://www.sqlmonster.com/Uwe/Abuse.aspx?aid=72424bb9b1394d278da3c0fb33e5c352
*****************************************Almost certain that it is a Permissions issue now, as I set it to FullTrust and it made a connection to the Sybase database.
Can anybody tell me how to set up the permissions for connecting to an ODBC database for use in a custom assembly?
Would be much appreciated!
*****************************************
* A copy of the whole thread can be found at:
* http://www.sqlmonster.com/Uwe/Forum.aspx/sql-server-reporting/4587
*
* Report spam or abuse by clicking the following URL:
* http://www.sqlmonster.com/Uwe/Abuse.aspx?aid=b41e9858e9da41d88067b4f8fb5cabe6
*****************************************|||Hi Jan,
the ODBCPermission class is intended for future use when the .NET Framework
Data Provider for ODBC is enabled for partial trust scenarios. The .NET
Framework Data Provider for ODBC currently requires FullTrust permission. At
present, using the OdbcPermission class has no effect. You may also want to
check this MSDN article:
Code access security and ADO.NET
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/html/cpconcodeaccesssecurityadonet.asp
HTH, Robert
--
This posting is provided "AS IS" with no warranties, and confers no rights.
"Jan Bodey via SQLMonster.com" <forum@.SQLMonster.com> wrote in message
news:b41e9858e9da41d88067b4f8fb5cabe6@.SQLMonster.com...
> Almost certain that it is a Permissions issue now, as I set it to
FullTrust and it made a connection to the Sybase database.
> Can anybody tell me how to set up the permissions for connecting to an
ODBC database for use in a custom assembly?
> Would be much appreciated!
> *****************************************
> * A copy of the whole thread can be found at:
> * http://www.sqlmonster.com/Uwe/Forum.aspx/sql-server-reporting/4587
> *
> * Report spam or abuse by clicking the following URL:
> *
http://www.sqlmonster.com/Uwe/Abuse.aspx?aid=b41e9858e9da41d88067b4f8fb5cabe6
> *****************************************
Subscribe to:
Posts (Atom)