Re: PKZip issue

Thank you for your suggestions. I am a member of the user group and my
coworker who solved this was at the meeting on Wed.

Here is how we ended up solving the issue. Hope it helps someone else.

"I was finally able to get PKZIPC to work as a non-SQL administrator on
FENSQLMLMD04, but it's a bit of a hack. Thanks for all your
suggestions and help. Kudos to Jerry for the final idea...

Tim, since you gave terminal services rights to US\US_SQLCmdshell,
pkzipc worked whenever I remoted in to the server as US_SQLCmdshell.
But as soon as I logged off, it stopped working. Same problem between
pkzipc version 8 and version 6 (except that 6 hangs), same problem on
the other sql server.

I think the problem is that pkzipc is looking in the HKCU registry key,
just to see if it exists. If it does, pkzipc reads the user's
environment information from another registry key,
HKLM....\ProfileList\... and then looks like it sets up the command
prompt environment variables. But if HKCU doesn't exist, it drops out
or hangs.

Maybe that's a standard Win32API thing whenever a command shell program
is launched? I don't think so, because I can run other commands like
"xcopy" fine. Anyway, when I'm not logged in as US_SQLCmdshell, the
HKCU key doesn't exist so pkzipc drops out at that point before it ever
loads the user's environment information.

So Jerry suggested that we use a "dummy" or "benign" Windows service
that is running as US\US_SQLCmdshell in order to keep it logged in.
Brilliant -- now it works! "

Jim Youmans
St Louis Missouri


Dan Guzman wrote:
In SQL 2000, the SQL Agent Proxy account is used as the OS security context
for non-sysadmin users. This is configurable from Enterprise Manager under
SQL Agent-->Properties-->Job System. When the 'Only users with Sysadmin
privileges..' is unchecked, you can specify the Windows account to be used
as the security context for non-sysadmin users. It's best to specify a
minimally privileged account.

I see you are located in St. Louis, You might consider joining our local
SQL Server User Group (http://www.stlssug.org/index.html) if you haven't
already done so. We also have a BI special interest group.

--
Hope this helps.

Dan Guzman
SQL Server MVP

"Jim" <jdyoumans@xxxxxxxxx> wrote in message
news:1158185320.259108.169510@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
I have command line PKZip (pkzipc.exe) installed on my SQL Server 2000.
I want to use it to zip up some text files that I receive and process
on a daily basis to save space. I want to schedule it to run as a job.
The problem is that when I run the job as a standard user, it just does
not work. No error messages or anything. If I make the job owned by
SA, it is fine.

My only thought is that when I am signed in as a SA, my account on the
box is in the Admin group. When I sign in as a standard user, I am not
sure what account it uses to hit the file system. I would assume it
would use the xp_cmdshelluser account I have set up but I am not sure.

Has anyone seen this before? It has me stumped.

Any ideas??

Thanks!

Jim Youmans
St Louis, Missouri


.

Relevant Pages

  • User rights assignment in XP Pro
    ... Unfortunately the only account ... administrator account as a limited user (even if they have ... been added to the Power User group, ... On my Win2k Pro machine the assignment of policies is very accessible ...
    (microsoft.public.windowsxp.security_admin)
  • Re: User rights assignment in XP Pro
    ... Unfortunately the only account ... > administrator account as a limited user (even if they have ... > been added to the Power User group, ... but will be the central unit on a wireless network by ...
    (microsoft.public.windowsxp.security_admin)
  • Re: only admin can start application
    ... Or a way to allow limited accounts to ... A limited Account? ... >>to the Power User group to fix the problem. ... >>>admin account I wanted to share the game for my kids. ...
    (microsoft.public.windowsxp.security_admin)
  • RE: Security between multiple instances
    ... Make sure that the account / nt user group doesn't have access to the ... Verify the account that IIS is using to access the first ... There is not tool to block access from specific applications like IIS. ...
    (microsoft.public.sqlserver.security)
  • Renaming Domain Groups
    ... In SQL Server 2005, when you create a user group that is linked to a domain ... group, and you then rename the domain account on the domain controller, SQL ... Server does not rename the local SQL user group. ...
    (microsoft.public.sqlserver.security)