LocalSystem account does not start SQLAgent

All,
Running SQL 2000 SP4 on a Windows 2003 server. I'm having some trouble
getting SQL Agent service to start using the LocalSystem account. The
MSSQLSERVER starts ok with the account? After setup I removed the builtin
admin's group - something I do on all my installs, but I ha to add it back
to get the LocalSystem to start the service. Anybody have any idea why this
is happening?
Thanks
Mike Gasperino
Sr. Software Developer
office: 919-807-2310
Helpdesk: (919)807-2300
doa.helpdesk@.ncmail.net
****************************************
************************************
E-mail correspondence to and from this address may be subject to the North
Carolina Public Records Law "NCGS.Ch.132" and may be disclosed to third
parties
****************************************
************************************See reply in microsoft.public.sqlserver.setup
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Mike" <announ@.tkd.net> wrote in message
news:uJUJULbmFHA.3536@.TK2MSFTNGP10.phx.gbl...
> All,
> Running SQL 2000 SP4 on a Windows 2003 server. I'm having some trouble
> getting SQL Agent service to start using the LocalSystem account. The
> MSSQLSERVER starts ok with the account? After setup I removed the builtin
> admin's group - something I do on all my installs, but I ha to add it back
> to get the LocalSystem to start the service. Anybody have any idea why
> this
> is happening?
> Thanks
>
> --
> Mike Gasperino
> Sr. Software Developer
> office: 919-807-2310
> Helpdesk: (919)807-2300
> doa.helpdesk@.ncmail.net
> ****************************************
**********************************
**
> E-mail correspondence to and from this address may be subject to the North
> Carolina Public Records Law "NCGS.Ch.132" and may be disclosed to third
> parties
> ****************************************
**********************************
**
>

Localsystem account access deny

Hi All,

I have a SQL server, as I use a domain account to log on to SQL server and Sql server agent, all maintanence plans work good, since I changed from a domain into Localsystem account to log on to SQL server, and Sql server agent, all maintanence plans didn't work any more, then I tried only keep Localsystem account at SQl server , using a domain log on to Sql server agent, but it's still failed to maintanence plans. The error in job history is"Executed as user: candyl. sqlmaint.exe failed. [SQLSTATE 42000] (Error 22029). The step failed.". And the message at Sql server log is :"BackupDiskFile::CreateMedia: Backup device 'D:\Database Backups\Noon Backup\ESMDEV_db_200406141548.BAK' failed to create. Operating system error = 5(Access is denied.)". It looks like permission problem, but for Localsystem account which should has full permission, right? I tried may ways and searched from knowledge base , still couldn't find the related solution.
Anyone can give me some advices?

Thanks.Help please!!!!!|||Does the user candyl have NT permission to create files in the destination directory?|||If users have been set up permission at server box, they can create the directiory.|||1. Does the user 'candyl' has the admin rights on the SQL Server?
2. Try this: 1) log on to your server under the 'candyl' login abd try to create any (dummy) file under the 'D:\Database Backups\Noon Backup\' directory. Was it successful?

LocalSystem (i.e. machine account) authenticating to a SQL server as anonymous

Hi All,
We have a customer who is using our application and is expiriencing a
behavior we haven't seen in the field yet. Our application is a WMI Event
Provider (so it is part of the WMI service which is running as the
LocalSystem account) running on a Windows 2003 Server (Standard Edition)
that needs to open an ODBC connection (using NT Authentication, NOT SQL
authentication) to a SQL Server running on a different Server (non-domain
controller, W2K Standard Edition SP4, SQL2000 Standard edition). In this
setup, we have customers add the machine account as an SQL user and then
within the specific database, have them give the machine account select,
update and delete authority on the specific table we need access to and
everything works great. Trouble at this particular customer is that on the
SQL server, we see an anonymous user login instead of the machine account
login (that we normally see). Does anyone have any theories as to why this
is happening? Thank you very much for your valuable time.Anthony LaMark
www.eXcSoftware.comIf there is an anonymous login in SQL Server, it is because someone added
it. It would not get there automatically. It is possible that the customer
was getting connection errors similar to the following:
Login failed for user NT Authority\Anonymous'. Not associated with a
trusted connection.
so they added the NT Authority\Anonymous login.
If this is the case they may be running into a kerberos authentication
problem.
If this is the case then the SQL Server may not have a valid Service
Principal name asscociated with it. You can use the setspn utility to
create one. The following article describes how to use the setspn utility:
HOW TO: Troubleshoot Kerberos-Related Issues in IIS
http://support.microsoft.com/defaul...kb;en-us;326985
I realize that you may not be having IIS problems but the steps would be
the same to resolve any kerberos problem.
Rand
This posting is provided "as is" with no warranties and confers no rights.

LocalAdmins, LocalSystem, and the sysadmin role

During SQL Server 2005 installation, several logins are added to the
sysadmin role including:
- local administrator group (BUILTIN\Administrators),
- Local System (NT AUTHORITY\SYSTEM), and
- sa.
A common hardening practice is to later remove the local administrator group
from the sysadmin role, thereby separating server administration from DBMS
administration. However, I don't recall ever seeing the recommendation to
also remove the LocalSystem account from the sysadmin role.
Has anyone seen recommendations to remove BOTH local administrators and
LocalSystem from the sysadmin role for hardening purposes, and - if this
were to be done - what are the consequences?
Thanks in advance (and apologies for re-posting in hopes of a response),
DrewHello Drew,
Yes, generally we remove local administrator group from sysadmin role which
actually prevent accessing sql server who is having system admini privilages
on the server.
Now personally I prefer not to remove Local System as I was facing problem
while using the full-text search. Please refer the following Microsoft
article.
http://support.microsoft.com/kb/317746
Hope this will help you.
Regards,
MB
"DHamre" <dhamre@.comcast.net> wrote in message
news:%23Au%23cyMMHHA.3424@.TK2MSFTNGP02.phx.gbl...
> During SQL Server 2005 installation, several logins are added to the
> sysadmin role including:
> - local administrator group (BUILTIN\Administrators),
> - Local System (NT AUTHORITY\SYSTEM), and
> - sa.
> A common hardening practice is to later remove the local administrator
> group from the sysadmin role, thereby separating server administration
> from DBMS administration. However, I don't recall ever seeing the
> recommendation to also remove the LocalSystem account from the sysadmin
> role.
> Has anyone seen recommendations to remove BOTH local administrators and
> LocalSystem from the sysadmin role for hardening purposes, and - if this
> were to be done - what are the consequences?
> Thanks in advance (and apologies for re-posting in hopes of a response),
> Drew
>