Accounts for SQLServer service vs SQLServerAgent service

I've just changed the account under which SQL Server starts on my
development server. The new account has admin rights, and a corresponding
Exchange email account - so I can now receive alerts at various points.
I've restarted the server, and the SQL Server service seems to be running
OK.
However, I cant get the SQLServerAgent service running. It comes up with the
following error:
Service Control Failure:
An error 1069 - (The service did not start due to a logon failure) occured
while performing this service operation on th SQLServerAgent service.
To be honest, I'm not sure if the Agent service was running previously, so
the change in account details might be a red herring.
To get it working, I changed the account from a Windows account, to the
System Account - under this setup, the Agent started fine, but then I found
the SQL Mail test failed.
Now the SQLServer service uses the Windows Account, but the SQLServerAgent
service uses the System Account, and... touch wood... they both appear to be
working...
I'm just curious if my setup is correct, ie. is this a common scenario or
should both services be under the same (Windows?) account? It seems a little
odd to use differing accounts.
Thanks
ChrisIdeally, from a security perspective, you should use 2 different domain
accounts. Then you can audit what each one is doing.
The SQLServerAgent account, did it have log on locally rights, and if the
server is a domain controller, it needs more than just a Domain User rights.
Regards
--
Mike Epprecht
Epprecht Consulting (PTY) LTD
Johannesburg, South Africa
Mobile: +27-82-552-0268
Specialist SQL Server Solutions and Consulting
"CJM" <cjmwork@.yahoo.co.uk> wrote in message
news:%23BvtlNJcDHA.2632@.TK2MSFTNGP12.phx.gbl...
> I've just changed the account under which SQL Server starts on my
> development server. The new account has admin rights, and a corresponding
> Exchange email account - so I can now receive alerts at various points.
> I've restarted the server, and the SQL Server service seems to be running
> OK.
> However, I cant get the SQLServerAgent service running. It comes up with
the
> following error:
> Service Control Failure:
> An error 1069 - (The service did not start due to a logon failure) occured
> while performing this service operation on th SQLServerAgent service.
> To be honest, I'm not sure if the Agent service was running previously, so
> the change in account details might be a red herring.
> To get it working, I changed the account from a Windows account, to the
> System Account - under this setup, the Agent started fine, but then I
found
> the SQL Mail test failed.
> Now the SQLServer service uses the Windows Account, but the SQLServerAgent
> service uses the System Account, and... touch wood... they both appear to
be
> working...
> I'm just curious if my setup is correct, ie. is this a common scenario or
> should both services be under the same (Windows?) account? It seems a
little
> odd to use differing accounts.
> Thanks
> Chris
>
>|||"Mike Epprecht" <mike@.epprecht.net> wrote in message
news:uTBJHTJcDHA.1128@.tk2msftngp13.phx.gbl...
> Ideally, from a security perspective, you should use 2 different domain
> accounts. Then you can audit what each one is doing.
How do you mean?
> The SQLServerAgent account, did it have log on locally rights, and if the
> server is a domain controller, it needs more than just a Domain User
rights.
SQL Server has its own domain account, with admin rights.
The SQL Server Agent uses the 'System Account'
CJM|||Hi Chris,
Form your description, I understand that SQL Server has its own domain
account, with admin rights and the SQL Server Agent uses the 'System
Account' on your computer. Currently, the SQL Mail test failed in the SQL
Server Agent Properties. If I have misunderstood, please feel free to let
me know.
Based on my knowledge, when the SQLServer service uses the Windows Account
and the SQLServerAgent service uses the System Account, the two services
could start as normal. But if you want to use SQL Mail successfully with
SQL Server Agent, you need to have a domain account for SQL Server Agent
service. SQL Mail could not work fine using System Account with SQL Server
Agent.
Also, I found some related information below:
Troubleshooting MSSQLServer or SQLServerAgent Services User Accounts
http://doc.ddart.net/mssql/sql2000/html/trblsql/tr_servdatabse_3c37.htm
Hope it helps
Regards,
Michael Shao
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.