Unable to startup Netbackup Admin Console

Ran into something today on a new Netbackup Master server I was setting up. I could not startup the Admin Console on the Master server itself. I have the Netbackup client service running as a service account. If I switched the Netbackup Client service to run as Local System, the Admin Console started to work again.

Solution was to add my domain service account into the Debug Programs User Rights Assignment in the Local Security Policy applet.

How to give access to SQL 2005 Activity Monitor

To view the Activity Monitor the user needs VIEW SERVER STATE permission on a SQL Server 2005 server.

Permission to KILL a process default to the members of the sysadmin and processadmin fixed database roles, and are not transferable.

References: http://msdn.microsoft.com/en-us/library/ms175518(SQL.90,printer).aspx

Permissions and User Rights for IIS 6.0

Reference: http://support.microsoft.com/kb/812614

Netbackup Service account user rights

To use a domain account as a service account to run the Netbackup Client Service and Netbackup Remote Manager and Monitor Service, these are the user rights required:

• Act as part of the operating system
• Create a token object
• Debug Programs???
• Logon as a service
• Replace a process level token

Reference: http://seer.entsupport.symantec.com/docs/270086.htm

Microsoft Office Sharepoint 2007 service accounts

This is about the "best" reference article I could find on MOSS 2007 service accounts, but IMO, that's not saying much... :-)

Reference: http://technet.microsoft.com/en-us/library/cc263445.aspx

User rights for IIS Service Account

Windows user rights

Access this computer from the network

• Administrators
• ASPNET
• IUSR_MachineName
• IWAM_MachineName
• Users

Adjust memory quotas for a process

• Administrators
• IWAM_MachineName
• Local service
• Network service

Bypass traverse checking

• IIS_WPG
  

Allow log on locally (see Note)

• Administrators
• IUSR_MachineName

Deny logon locally

• ASPNET

Impersonate a client after authentication

• Administrators
• ASPNET
• IIS_WPG
• Service

Log on as a batch job

• ASPNET
• IIS_WPG
• IUSR_MachineName
• IWAM_MachineName
• Local service

Logon as a service

• ASPNET
• Network service

Replace a process level token

• IWAM_MachineName
• Local service
• Network service

Note: If the Users group and the Everyone group must be removed from the Bypass traverse checking permissions, add the IIS_WPG group to permit IIS to function as expected.

Reference: http://support.microsoft.com/kb/812614
http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/3648346f-e4f5-474b-86c7-5a86e85fa1ff.mspx?pf=true

Minimum rights required to run a scheduled task

Assumptions:

• Applies to Windows 2003 server
• Service account is not a member of the local administrators group
• Batch job runs as non-interactive process

Required for service account:

• RX permissions to c:\windows\system32\Cmd.exe
• Any share and NTFS permissions it needs to access files or data
• "Logon as a service" configured in the security policy editor (run gpedit.msc -> computer configuration -> windows settings -> security settings -> local policies -> user rights assignment -> Log on as a service)
• "Log on as a batch job" configured similarly using gpedit.msc

Reference: http://support.microsoft.com/kb/867466/en-us