SQL Server installation fails if the Setup account does not have certain user rights

Consider the following scenario. To tighten security, you remove some default user rights to the local administrators group on a Windows operating system. In preparation for setting up Microsoft SQL Server on this system, you add the Setup account to the local administrators group.

In this scenario, if you either install or upgrade to Microsoft SQL Server, the installation process may fail, and you receive various error messages as noted in the following sections.

Scenario 1: For a new installation, the Setup program fails, and you receive the following error message:

Access is denied

Additionally, you may notice error messages that resemble the following in the Detail.txt file

2009-01-02 13:00:17 SQLEngine: --SqlServerServiceSCM: Waiting for nt event 'Global\sqlserverRecComplete$NIIT' to be created

2009-01-02 13:00:20 SQLEngine: --SqlServerServiceSCM: Waiting for nt event 'Global\sqlserverRecComplete$NIIT' or sql process handle to be signaled

2009-01-02 13:00:20 Slp: Configuration action failed for feature SQL_Engine_Core_Inst during timing ConfigRC and scenario ConfigRC.

2009-01-02 13:00:20 Slp: Access is denied

2009-01-02 13:00:20 Slp: Configuration action failed for feature SQL_Engine_Core_Inst during timing ConfigRC and scenario ConfigRC.

2009-01-02 13:00:20 Slp: System.ComponentModel.Win32Exception: Access is denied

2009-01-02 13:00:20 Slp:    at System.Diagnostics.ProcessManager.OpenProcess(Int32 processId, Int32 access, Boolean throwIfExited)

2009-01-02 13:00:20 Slp:    at System.Diagnostics.Process.GetProcessHandle(Int32 access, Boolean throwIfExited)

2009-01-02 13:00:20 Slp:    at System.Diagnostics.Process.OpenProcessHandle()

2009-01-02 13:00:20 Slp:    at System.Diagnostics.Process.get_Handle()

2009-01-02 13:00:20 Slp:    at Microsoft.SqlServer.Configuration.SqlEngine.SqlServerServiceBase.WaitSqlServerStart(Process processSql)

2009-01-02 13:00:20 Slp:    at Microsoft.SqlServer.Configuration.SqlEngine.SqlServerServiceSCM.StartSqlServer(String[] parameters)

2009-01-02 13:00:20 Slp:    at Microsoft.SqlServer.Configuration.SqlEngine.SqlServerStartup.StartSQLServerForInstall(String sqlCollation, String masterFullPath, Boolean isConfiguringTemplateDBs)

2009-01-02 13:00:20 Slp:    at Microsoft.SqlServer.Configuration.SqlEngine.SqlEngineDBStartConfig.ConfigSQLServerSystemDatabases(EffectiveProperties properties, Boolean isConfiguringTemplateDBs, Boolean useInstallInputs)

2009-01-02 13:00:20 Slp:    at Microsoft.SqlServer.Configuration.SqlEngine.SqlEngineDBStartConfig.DoCommonDBStartConfig(ConfigActionTiming timing)

2009-01-02 13:00:20 Slp:    at Microsoft.SqlServer.Configuration.SqlEngine.SqlEngineDBStartConfig.Install(ConfigActionTiming timing, Dictionary`2 actionData, PublicConfigurationBase spcb)

2009-01-02 13:00:20 Slp:    at Microsoft.SqlServer.Configuration.SqlConfigBase.PrivateConfigurationBase.Execute(ConfigActionScenario scenario, ConfigActionTiming timing, Dictionary`2 actionData, PublicConfigurationBase spcbCurrent)

2009-01-02 13:00:20 Slp:    at Microsoft.SqlServer.Configuration.SqlConfigBase.SqlFeatureConfigBase.Execute(ConfigActionScenario scenario, ConfigActionTiming timing, Dictionary`2 actionData, PublicConfigurationBase spcbCurrent)

2009-01-02 13:00:20 Slp:    at Microsoft.SqlServer.Configuration.SqlConfigBase.SlpConfigAction.ExecuteAction(String actionId)

2009-01-02 13:00:20 Slp:    at Microsoft.SqlServer.Configuration.SqlConfigBase.SlpConfigAction.Execute(String actionId, TextWriter errorStream)

2009-01-02 13:00:20 Slp: Exception: System.ComponentModel.Win32Exception.

2009-01-02 13:00:20 Slp: Source: System.

2009-01-02 13:00:20 Slp: Message: Access is denied.

Scenario 2: Upgrades to SQL Server 2008 will report the following error message on the Engine_SqlEngineHealthCheck rule:

Rule name:Engine_SqlEngineHealthCheck
Rule description: Checks whether the SQL Server service can be restarted; or for a clustered instance, whether the SQL Server resource is online.
Result: Failed
Message/Corrective Action: The SQL Server service cannot be restarted; or for a clustered instance, the SQL Server resource is not online

Additionally, you may notice error messages that resemble the following in the Detail.txt file

2009-05-27 17:50:20 SQLEngine: : Checking Engine checkpoint 'GetSqlServerProcessHandle_1'
2009-05-27 17:50:20 SQLEngine: --SqlServerServiceSCM: Waiting for nt event 'Global\sqlserverRecComplete$SQL10' to be created
2009-05-27 17:50:22 SQLEngine: --SqlServerServiceSCM: Waiting for nt event 'Global\sqlserverRecComplete$SQL10' or sql process handle to be signaled
2009-05-27 17:50:22 SQLEngine: --FacetSqlEngineHealthCheck: Engine_SqlEngineHealthCheck: Error: Access is denied

Scenario3: A new installation of Microsoft SQL Server 2012 or Microsoft SQL Server 2008 R2 fails

You see the following error message when you try to install a new instance of SQL Server 2012 or SQL Server 2008 R2:

Rule "Setup account privileges" failed.
The account that is running SQL Server Setup does not have one or all of the following rights: the right to back up files and directories, the right to manage auditing and the security log and the right to debug programs. To continue, use an account with both of these rights.

Back to the top | Give Feedback

This behavior is by design. In addition to adding the user account that is running the Setup as a local administrator, the Setup user account requires the following default user rights for the Setup to be completed successfully:

Note For more information about the permissions that are required to install SQL Server, refer to the "Prerequisites" section on the following MSDN websites:

How to: Install SQL Server 2008 (Setup)

Back to the top | Give Feedback

To add the rights to the local administrator account, follow these steps:

1. Log on to the computer as a user who has administrative credentials.
2. Click Start, click Run, type Control admintools, and then click OK.
3. Double-click Local Security Policy.
4. In the Local Security Settings dialog box, click Local Policies, double-click User Rights Assignment, and then double-click Backup Files and Directories.
5. In the Backup Files and Directories Properties dialog box, click Add User or Group.
6. In the Select User or Groups dialog box, type the user account that is being used for setup, and then click OK two times.
7. Repeat the procedure for the other two policies that are mentioned in the "Cause" section.
8. On the File menu, click Exit to close the Local Security Settings dialog box.

Back to the top | Give Feedback

• To check the list of privileges that are currently associated with the account that is used for Setup, you can use the AccessChk.exe tool. To downloaded this tool, visit the following location:

http://technet.microsoft.com/en-us/sysinternals/bb664922.aspx

Usage:  accesschk.exe - a <setup account> *

For example:

c:\tools\accesschk.exe -a testdc\setupaccount *

Sample output:

       SeSecurityPrivilege
        SeBackupPrivilege
        SeRestorePrivilege
        SeSystemtimePrivilege
        SeShutdownPrivilege
        SeRemoteShutdownPrivilege
        SeTakeOwnershipPrivilege
        SeDebugPrivilege
        SeSystemEnvironmentPrivilege
        SeSystemProfilePrivilege
        SeProfileSingleProcessPrivilege
        SeIncreaseBasePriorityPrivilege
        SeLoadDriverPrivilege
        SeCreatePagefilePrivilege
        SeIncreaseQuotaPrivilege
        SeChangeNotifyPrivilege
        SeUndockPrivilege
        SeManageVolumePrivilege
        SeImpersonatePrivilege
        SeCreateGlobalPrivilege
        SeTimeZonePrivilege
        SeCreateSymbolicLinkPrivilege
        SeInteractiveLogonRight
        SeNetworkLogonRight
        SeBatchLogonRight
        SeRemoteInteractiveLogonRight

• Setting Up Windows Services Accounts

Back to the top | Give Feedback