Symptoms
Consider the following scenario:
As part of tightening security, you remove some of the default user rights to local administrators group on a Windows operating system. In prepartion for setting up SQL server on this system, you add setup account to the local administrators group.
In this scenario, if you either install or upgrade to SQL Server 2008, the installation process may fail with various error messages as noted below.
Scenario 1: For a new installation, the setup program will fail with the following error message
Access is denied
Additionally, you may notice error messages similar to the following in the Detail.txt file
2009-01-02 13:00:17 SQLEngine: –SqlServerServiceSCM: Waiting for nt event ‘Global\sqlserverRecComplete$NIIT’ to be created
2009-01-02 13:00:20 SQLEngine: –SqlServerServiceSCM: Waiting for nt event ‘Global\sqlserverRecComplete$NIIT’ or sql process handle to be signaled
2009-01-02 13:00:20 Slp: Configuration action failed for feature SQL_Engine_Core_Inst during timing ConfigRC and scenario ConfigRC.
2009-01-02 13:00:20 Slp: Access is denied
2009-01-02 13:00:20 Slp: Configuration action failed for feature SQL_Engine_Core_Inst during timing ConfigRC and scenario ConfigRC.
2009-01-02 13:00:20 Slp: System.ComponentModel.Win32Exception: Access is denied
2009-01-02 13:00:20 Slp: at System.Diagnostics.ProcessManager.OpenProcess(Int32 processId, Int32 access, Boolean throwIfExited)
2009-01-02 13:00:20 Slp: at System.Diagnostics.Process.GetProcessHandle(Int32 access, Boolean throwIfExited)
2009-01-02 13:00:20 Slp: at System.Diagnostics.Process.OpenProcessHandle()
2009-01-02 13:00:20 Slp: at System.Diagnostics.Process.get_Handle()
2009-01-02 13:00:20 Slp: at Microsoft.SqlServer.Configuration.SqlEngine.SqlServerServiceBase.WaitSqlServerStart(Process processSql)
2009-01-02 13:00:20 Slp: at Microsoft.SqlServer.Configuration.SqlEngine.SqlServerServiceSCM.StartSqlServer(String[] parameters)
2009-01-02 13:00:20 Slp: at Microsoft.SqlServer.Configuration.SqlEngine.SqlServerStartup.StartSQLServerForInstall(String sqlCollation, String masterFullPath, Boolean isConfiguringTemplateDBs)
2009-01-02 13:00:20 Slp: at Microsoft.SqlServer.Configuration.SqlEngine.SqlEngineDBStartConfig.ConfigSQLServerSystemDatabases(EffectiveProperties properties, Boolean isConfiguringTemplateDBs, Boolean useInstallInputs)
2009-01-02 13:00:20 Slp: at Microsoft.SqlServer.Configuration.SqlEngine.SqlEngineDBStartConfig.DoCommonDBStartConfig(ConfigActionTiming timing)
2009-01-02 13:00:20 Slp: at Microsoft.SqlServer.Configuration.SqlEngine.SqlEngineDBStartConfig.Install(ConfigActionTiming timing, Dictionary`2 actionData, PublicConfigurationBase spcb)
2009-01-02 13:00:20 Slp: at Microsoft.SqlServer.Configuration.SqlConfigBase.PrivateConfigurationBase.Execute(ConfigActionScenario scenario, ConfigActionTiming timing, Dictionary`2 actionData, PublicConfigurationBase spcbCurrent)
2009-01-02 13:00:20 Slp: at Microsoft.SqlServer.Configuration.SqlConfigBase.SqlFeatureConfigBase.Execute(ConfigActionScenario scenario, ConfigActionTiming timing, Dictionary`2 actionData, PublicConfigurationBase spcbCurrent)
2009-01-02 13:00:20 Slp: at Microsoft.SqlServer.Configuration.SqlConfigBase.SlpConfigAction.ExecuteAction(String actionId)
2009-01-02 13:00:20 Slp: at Microsoft.SqlServer.Configuration.SqlConfigBase.SlpConfigAction.Execute(String actionId, TextWriter errorStream)
2009-01-02 13:00:20 Slp: Exception: System.ComponentModel.Win32Exception.
2009-01-02 13:00:20 Slp: Source: System.
2009-01-02 13:00:20 Slp: Message: Access is denied.
Scenario 2: Upgrades to SQL Server 2008 will report the following error message on Engine_SqlEngineHealthCheck rule:
Rule name:Engine_SqlEngineHealthCheck
Rule description: Checks whether the SQL Server service can be restarted; or for a clustered instance, whether the SQL Server resource is online.
Result: Failed
Message/Corrective Action: The SQL Server service cannot be restarted; or for a clustered instance, the SQL Server resource is not online
Additionally, you may notice error messages similar to the following in the Detail.txt file
2009-05-27 17:50:20 SQLEngine: : Checking Engine checkpoint ‘GetSqlServerProcessHandle_1′
2009-05-27 17:50:20 SQLEngine: –SqlServerServiceSCM: Waiting for nt event ‘Global\sqlserverRecComplete$SQL10′ to be created
2009-05-27 17:50:22 SQLEngine: –SqlServerServiceSCM: Waiting for nt event ‘Global\sqlserverRecComplete$SQL10′ or sql process handle to be signaled
2009-05-27 17:50:22 SQLEngine: –FacetSqlEngineHealthCheck: Engine_SqlEngineHealthCheck: Error: Access is denied
Resolution
This behavior is by design. In addition to adding the user account that is running the setup as a local administrator as documented in How to: Install SQL Server 2008 (Setup), the setup user account requires the following additional rights for the setup to complete successfully.
Local Policy Object Display Name
User Right
Backup files and directories
SeBackupPrivilege
Debug Programs
SeDebugPrivilege
Manage auditing and security log
SeSecurityPrivilege