Skip to main content
How can we help?
< All Topics
Print

Service account is local admin

It is advised that the SQL Server service account and SQL Server Agent service account are not a member of the local administrators group. If these accounts are local administrators, jobs running from a SQL Server Agent job will have full administrative access to the server. If the SQL Server service account is local administrator, using xp_cmdshell will grant full administrative access the the server.

To query the Performance Store database for service accounts that are a member of the local administrators group, use:

select s.server_name, s.sql_service_account service_account_name
from dbo.v_servers s
where s.sql_server_service_account_is_member_of_local_admin = 1

union

select s.server_name, s.agent_service_account service_account_name
from dbo.v_servers s
where s.sql_server_agent_service_account_is_member_of_local_admin = 1

The alert will be visible on the Latest stats dashboard.

To exclude specific servers from this alert, see how to use the dbo.team_alert_exclude table in Alerting.

Table of Contents