1

I'm doing March 2019 update on SharePoint 2016 servers this weekend. The Service account that we have (for eg spfarm) is sysadmin on the SQL Server. According to the MS doc, the account also needs to have 'db_owner' permission on all SP databases, but it does not have that. Do you think I should add the db_owner permission for spfarm account before doing the update? Thank you – Kalai

Improve this question

1 Answer 1

Reset to default
0

That is not necessary. The SYSADMIN role allows the account to perform every action within the SQL instance without granting any other explicit permissions.

Improve this answer
8
  • Thank you for the response. One more question. Do I have to use spfarm (this has SYSYADMIN, DBCREATOR,SECURITYADMIN roles) account to run the .exe file and spadmin(this has DBCREATOR and SECURITYADMIN server roles)to run the configuration wizard?
    – Kalai k
    May 9, 2019 at 16:16
  • This answer depends on how the Farm was set up. Normally the „Farm“ Account is the one which runs central Administration. This account shouldnt be used to manage the farm. But it also doesnt need sysadmin in SQL and no local admin rights. So your Farm is actually Not set up perfectly best practise. As you have a separate Admin account: give it sysadmin to SQL and perform update with that. Revert sysadmin afterwards if you want or need to.
    – MHeld
    May 9, 2019 at 16:56
  • 1
    Your farm has a bad practice config. No service account should be used to manage a farm. In addition, no service account of any sort needs Local Admin rights (unless you're running C2WTS which most farms do not need and if you do, you should use a separate service account for that service only).
    – user6024
    May 9, 2019 at 18:00
  • 1
    Thank you. Will let you all know how it goes after the update.
    – Kalai k
    May 10, 2019 at 13:02
  • 1
    Update went good without any issues. Thank you for all your jelp!
    – Kalai k
    May 13, 2019 at 17:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.