SqlSetup: Installing with Service Account Permissions Required

[joshan1120]

SqlSetup: Installing with Service Account Permissions Required

ISSUE DESCRIPTION (this template):
When using PsDscRunAsCredential with SQL2017 I had to add user to domain admins. I am certain it does not need this level of permissions, but I am trying to find the bare perms needed. It used to work fine with sql2014, but sql2017 is failing until I added the service account to domain admins.

The DSC configuration that is using the resource (as detailed as possible)

SqlSetup SqlServerSetup {
			BrowserSvcStartupType = 'Automatic'
			Features = $environmentNode.sqlInstallFeatures
			InstallSharedDir = $roleNode.installSharedDir
			InstallSharedWOWDir = $roleNode.installSharedWowDir
			InstallSQLDataDir = $roleNode.installSqlDataDir
			InstanceName = $environmentNode.sqlInstanceName
			InstanceDir = $roleNode.sqlInstanceDir
			SAPWd = $sqlSaAccountCreds
			SecurityMode =  $roleNode.securityMode
			PsDscRunAsCredential = $SQLServiceCreds
			SourcePath = $roleNode.sourcePath
			SQLBackupDir = $roleNode.sqlBackupDir
			SQLCollation = $roleNode.sqlCollation
			AgtSvcAccount = $SQLServiceCreds
			SQLSvcAccount = $SQLServiceCreds
			SQLSysAdminAccounts = $environmentNode.sqlSysAdminAccounts
			SQLTempDBDir = $roleNode.sqlTempDbDir
			SQLTempDBLogDir = $roleNode.sqlTempDbLogDir
			SQLUserDBDir = $roleNode.sqlUserDbDir
			SQLUserDBLogDir = $roleNode.sqlUserDbLogDir
			UpdateSource = $roleNode.updateSource
			UpdateEnabled = $roleNode.updateEnabled
			SuppressReboot = $False
			ForceReboot = $False
}

Version of the operating system and PowerShell the target node is running

Windows 2016 with PowerShell 5

SQL Server edition and version the target node is running

en_sql_server_2017_developer_x64_dvd_11296168.iso

What SQL Server PowerShell modules, and which version, are present on the target node.

AzureRM.Sql 4.3.0 C:\Program Files\WindowsPowerShell\Modules\AzureRM.Sql\4.3.0\AzureRM.Sql.psd1
SqlServer 20.0 C:\Program Files\WindowsPowerShell\Modules\SqlServer\SqlServer.psd1
SQLASCMDLETS 2.0 C:\Program Files (x86)\Microsoft SQL Server\130\Tools\PowerShell\Modules\SQLASCMDLETS\SQLASCMDLETS.psd1
SQLPS 1.0 C:\Program Files (x86)\Microsoft SQL Server\130\Tools\PowerShell\Modules\SQLPS\SQLPS.psd1
SQLPS 14.0 C:\Program Files (x86)\Microsoft SQL Server\140\Tools\PowerShell\Modules\SQLPS\SQLPS.psd1

Version of the DSC module you're using, or write 'dev' if you're using current dev branch

SqlServerDsc 10.0.0.0 C:\Program Files\WindowsPowerShell\Modules\SqlServerDsc\SqlServerDsc.psd1

[johlju]

The credential PsDscRunAsCredential is used to run the resource, which means installing SQL Server. PsDscRunAsCredential will need local administrator permission on the target node to install SQL Server, and it needs read permission on the path assigned to SourcePath. The resource does not need 'Domain Admins' permission, but if you add the account to that it most likely get local admin rights on the server and any other server in the domain.

What are the error message you are seeing when the account is just local admin on the target node and have read permission to SourcePath?

[joshan1120]

I will try that out, thanks.

[stale]

This issue has been automatically marked as needs more information because it has not had activity from the community in the last 30 days. It will be closed if no further activity occurs within 10 days. If the issue is label with any of the work labels (e.g bug, enhancement, documentation, or tests) the issue will not auto-close.

[stale]

This issue has been automatically marked as stale because it has not had activity from the community in the last 30 days. It will be closed if no further activity occurs within 10 days. If the issue is labelled with any of the work labels (e.g bug, enhancement, documentation, or tests) then the issue will not auto-close.

[stale]

This issue has been automatically closed because it is has not had activity from the community in the last 40 days.