Minimum Windows Rights Required for SQL Backup Agent

Category: Security & data protection
Date: 13 Jul 2009
Product: SQL Backup
Versions: 4,5,6

What are the minimum local windows rights that the account running SQL Backup Agent Service requires?

User rights and privileges:
________________________
· Log On As A Service right
· Logon to SQL Server with sufficient priviliges for database backup if SQL Backup Agent is not using a SQL account (see sqbsetlogin)
· If the SQL Backup Agent startup account is a Windows Domain account, access to query an Active Directory server in that domain (version 5 only)
- If backups are performed using Windows accounts in other domains, the SQB service account will need to query AD in those domains as well.
· SQL Server requires that the user running that command be a member of the SQL Server sysadmin fixed server role. This is a requirement of SQL Server's Virtual Device Interface (VDI) subsystem, which SQL Backup leverages to gain access to the SQL Server backup data stream.

From the SQL Server VDI documentation:
"The system objects used to implement the virtual device set are secured with an access control list. This list permits access to all processes running under the account used by the primary client. Access is also permitted to processes running under the account used by Microsoft® SQL Server, as recorded in the system services configuration.
The server connection for SQL Server that is used to issue the BACKUP or RESTORE commands must be logged in with the sysadmin fixed server role. For more information, see Microsoft SQL Server Books Online.
The CreateEx (and Create) calls modify the security DACL on the process handle in the client process. Because of this any other modification of the process handle must be serialized with invocation of CreateEx."

Filesystem:
_________
· Read/write access to the local/network paths where the backup files will be stored
· Read/Write access to %allusersprofile%\Application Data\Red Gate\SQL Backup\Data\<instance>\data.sdf (cached backup history file in version 5)

Registry:
_______

Note that some of these keys do not exist, depending on your SQL Server and SQL Backup configurations:

Read/write HKEY_LOCAL_MACHINE\SOFTWARE\Red Gate\SQL Backup\BackupSettingsGlobal\<instance>
Read/write HKEY_LOCAL_MACHINE\SOFTWARE\Red Gate\SQL Backup\BackupSettings\<instance>
Read/write HKEY_LOCAL_MACHINE\SOFTWARE\Red Gate\SQL Backup\BackupSettingsGlobal\<instance>
Read/write HKEY_LOCAL_MACHINE\SOFTWARE\Red Gate\SQL Backup\BackupSettings\<instance>
Read HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Network\LanMan
Read HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>
Read HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>
Read/write HKEY_LOCAL_MACHINE\SOFTWARE\Red Gate\SQL Backup\
Read/write HKEY_LOCAL_MACHINE\SOFTWARE\Red Gate\SQL Backup\Layout
Read/write HKEY_LOCAL_MACHINE\SOFTWARE\Red Gate\SQL Backup\BackupSettings
Read/write HKEY_LOCAL_MACHINE\SOFTWARE\Red Gate\SQLBackup\BackupSettings
Read/write HKEY_LOCAL_MACHINE\SOFTWARE\Red Gate\SQL Backup\BackupSettingsGlobal
Read/write HKEY_LOCAL_MACHINE\SOFTWARE\Red Gate\SqlBackup\BackupSettingsGlobal
Read/write HKEY_LOCAL_MACHINE\SOFTWARE\Red Gate\SQL Backup\InstalledInstances
Read HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server
Read HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer
Read HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\80\Tools\SQLEW\
Read HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Read/write HKEY_LOCAL_MACHINE\SOFTWARE\Red Gate\SQL Backup\InstalledInstances
Read/write HKEY_LOCAL_MACHINE\SOFTWARE\Red Gate\Licensing

Computer Security Policy
_____________________
· 'Query Service' rights to the SQL Backup Agent Service (SQLBackupAgent) and the SQL Server Service (MSSQLSVC)
· 'Start Service' rights to the SQL Backup Agent Service in cases where the service is found not to be running
If this is necessary because of a 'locked-down' installation of Windows Server, the Security Configuration and analysis tool can be used to set the Service rights for the SQL Backup Agent startup account.

For Windows 2000, please reference: http://support.microsoft.com/kb/288129
For Windows 2003, please reference: http://support.microsoft.com/kb/325349/en-us