1. Forum
  2. Usenet
  3. ALT.COMP.OS.WINDOWS-10

  • Virual accounts unavailable in directory permissions

    From Anton Shepelev@21:1/5 to All on Fri Jan 17 18:10:42 2025
    Hello, all

    While migrating a machine with many MSSQL instances, I have
    found that I cannot reinstante the permissions for the
    directories with databases for each instance.

    On the original machine, each directory had permissions for
    the user, under which the correspoinding instance was
    started: NT ServiceSQL$<instance_name> . These are called
    virtual accounts:

    https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions#VA_Desc

    and are meant to facilitate administration. I my case
    however, they are a problem, because neither on the original
    machine, nor on the one we are migraing to, can we add any
    of those virtual accounts to directory permissions. Virtual
    accounts are not listed under either of
    Service Accounts,
    Built-in security principals,
    or Users.
    Where in the system are they? Somewhere they must be, for
    Windows services for MSSQL instances are started under
    those accounts.

    --
    () ascii ribbon campaign -- against html e-mail
    /\ www.asciiribbon.org -- against proprietary attachments

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Anton Shepelev@21:1/5 to All on Mon Jan 20 15:16:13 2025
    I wrote:

    While migrating a machine with many MSSQL instances, I
    have found that I cannot reinstante the permissions for
    the directories with databases for each instance.

    On the original machine, each directory had permissions
    for the user, under which the correspoinding instance was
    started: NT Service\MSSQL$<instance_name> . These are
    called virtual accounts:

    https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions#VA_Desc

    and are meant to facilitate administration. I my case
    however, they are a problem, because neither on the
    original machine, nor on the one we are migraing to, can
    we add any of those virtual accounts to directory
    permissions. Virtual accounts are not listed under either
    of
    Service Accounts,
    Built-in security principals,
    or Users.
    Where in the system are they? Somewhere they must be, for
    Windows services for MSSQL instances are started under
    those accounts.

    The trick is to type them in by hand, having set the correct
    filters, that is:

    Select this object types: Built-in security principals
    From this location : he current machine

    --
    () ascii ribbon campaign -- against html e-mail
    /\ www.asciiribbon.org -- against proprietary attachments

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)