Sometimes in the interviews I observe that users are able to answer all the theoretical questions correct but when it is about doing practical they fail. A while ago, when I was helping a large organization with interview, suddenly their DBA reported that one of their server has installation error. We found this as a great opportunity to test a new candidate and gave him problem to solve. He was successfully able to solve the problem.
Question: How will you fix the installation failure error setup account privileges error in SQL Server?
When I clicked on “failed” hyperlink, here is the message.
Here is the text of the message.
Rule Check Result
Rule “Setup account privileges” failed.
The account that is running SQL Server Setup does not have one or all of the following rights: the right to back up files and directories, the right to manage auditing and the security log and the right to debug programs. To continue, use an account with both of these rights. For more information, see https://docs.microsoft.com/en-us/previous-versions/ms813696(v=msdn.10), https://docs.microsoft.com/en-us/previous-versions/ms813959(v=msdn.10) and https://docs.microsoft.com/en-us/previous-versions/ms813847(v=msdn.10).
I always look at setup logs to see the exact issue. I opened “SystemConfigurationCheck_Report.htm” and below is the failure.
Then I looked into “Detail.txt” and searched for “HasSecurityBackupAndDebugPrivilegesCheck” as shown in above screenshot. Failure is listed below.
(09) 2016-01-28 19:58:11 Slp: Initializing rule : Setup account privileges
(09) 2016-01-28 19:58:11 Slp: Rule is will be executed : True
(09) 2016-01-28 19:58:11 Slp: Init rule target object: Microsoft.SqlServer.Configuration.SetupExtension.FacetPrivilegeCheck
(09) 2016-01-28 19:58:11 Slp: Rule ‘HasSecurityBackupAndDebugPrivilegesCheck’ Result: Running process has SeSecurity privilege, has SeBackup privilege and does not have SeDebug privilege.
(09) 2016-01-28 19:58:11 Slp: Evaluating rule : HasSecurityBackupAndDebugPrivilegesCheck
(09) 2016-01-28 19:58:11 Slp: Rule running on machine: PINALVM1
(09) 2016-01-28 19:58:11 Slp: Rule evaluation done : Failed
As highlighted above, the account which was running setup was missing second one.
SeSecurity: Manage auditing and the security log
SeDebug: Debug Programs
SeBackup: Back up files and directories
To see the “Local Security Policy”, we can go to Start > Run > SecPol.msc or open it from Administrative Tools.
“Debug programs” doesn’t have any user. By default, “Administrators” group is part of it which was removed by me during some hardening. Once I added default account, I have to restart the computer to get forward from that error.
Reference: Pinal Dave (https://blog.sqlauthority.com)