Assign SQL service start,stop permission to Non-Administrator Account and SDDL explained

Here we will assign the start/stop permission of MSSQLSERVER to ‘MyUser’ domain user. Assume that computer has been SQL 2012 installed in domain environment. We can easily assign the necessary permission the by Powershell Access Control Module and will check which permissions are changed.Before doing this, we will run sc sdshow mssqlserver and check the initial service permission. See Fig-1.

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Before we break down the above output, let me explain a little about SDDL. It is composed as follows:

owner-string is the prefix starting with “O:”  and is followed by sid-string

group-string is the prefix starting with  “G:”  and is followed by sid-string

dacl-string is the prefix starting with  “D:”  and is followed by [acl-flag-string]  [aces]

sacl-string is the prefix starting with  “S:” and is followed by [acl-flag-string]  [aces]

First of all, let’s break down the long SDDL line into the pairs of parenthesises. We find two parenthesis pairs are prefixed by D: and S:.  So here, there are only dacl and sacl strings. ( we can know this by checking D: and S: against with SDDL syntax shown previously)

For example, from the initial output, the following string is the DACL String:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

And the following string is the SACL String:

S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Now you can run the powershell commands to give start/stop permission of MSSQLSERVER to ‘contosoMyUser’. Download the Powershell Access Control from hereand put under C: and run the following two commands. See Fig-2.

After giving service start/stop permission to domain user ‘MyUser’ , we need to check the service permission again with sc sdshow and it changes as shown in Fig-3.

D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;RPWP;;;S-1-5-21-2647241702-1957647361-952520019-1197)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

We can see that (A;;RPWP;;;S-1-5-21-2647241702-1957647361-952520019-1197) is the extra string from initial service permission. Since it was insert just before S:, we can say that it’s for user’s permission. We will analysis this string in details. Each ACE is in the following form.

(A;;RPWP;;;S-1-5-21-2647241702-1957647361-952520019-1197)

The 1^st slot (ace-type) is ‘A’ which is for Access Allow.

The 2^nd slot (acl-flag) is blank and I will not cover it this blogpost. It is the flags for the SECURITY_DESCRIPTOR structure, context dependent on whether a SACL or DACL is being processed. Check more about it here.