0

I am using Microsoft SQL Server 2014 on a Windows Server 2012 R2 Datacenter machine. Having run into issues doing a particular task, I am trying to investigate if the service account that is running the SQL Server Windows Service has access to certain files. I did an out-of-the-box installation of SQL Server, and the service account running that service is NT SERVICE\MSSQLSERVER (there is also NT SERVICE\SQLSERVERAGENT for Integration Services).

How do I check what files this account has access to? I'm fine with checking on a file-by-file basis.

One way I thought to do this was to run cmd.exe as another user and start doing dirs. When I Shift-Right Click C:\Windows\System32\cmd.exe and select Run as a different user, I attempt to enter the full account name, including the domain, but I get this error: The name provided is not a properly formed account name. It's because of the space in the domain. If I omit the domain, it defaults to the domain that the computer is part of, which is not NT SERVICE. This is assuming that the password is to be left blank.

How do I login as a user whose domain has a space?

  • "How do I login as a user whose domain has a space?" - You don't. "How do I check what files this account has access to?" Simply check the ACL on the folder which contain the files in question. If the Service account isn't listed then you can assume they don't have access to the folder. – Ramhound Nov 9 '16 at 21:25
0

You can't login with the NT Service\MSSQLSERVER account or the NT SERVICE\SQLSERVERAGENT account. They are special accounts just for the service that have a SID to allow permissions to be set, but Windows knows they are not real accounts so won't let you login with them.

You can examine what permissions those accounts have access to using the Sysinternals tool AccessChk and scanning a drive.

An example command is:

accesschk64.exe -s -d -w "NT Service\MSSQLSERVER" C:\*.*

This will search the C drive recursively showing all folders the account has write access to. Use accesschk64.exe /? for a full list of options.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.