patternsqlMinor
What happens if agent job owner account is deactivated in Active directory?
Viewed 0 times
ownerdirectoryactivewhatdeactivatedagentaccounthappensjob
Problem
We have a number of jobs owned by a DBA.
The DBA is now leaving the company so their account will be deactivated in Active Directory.
What affect will this have on the agent jobs?
The DBA is now leaving the company so their account will be deactivated in Active Directory.
What affect will this have on the agent jobs?
Solution
Let us say we are talking about Windows login which part of AD and was owner of a job. Below is more detailed answer with couple of scenarios.
In above scenario the job will "still run". The reason is since job was added as administrator in SQL Server there is entry of this owner with SID in sys.server_principal which SQL Server knows, and since the login was member of sysadmin role no "impersonization" will be done and hence job will succeed.
In this scenario the job will fail which is pretty much obvious
In this case job will fail because since owner is not sysadmin impersonization will be done and SQL Server will look for this account in Windows AD, since the account was removed the job will fail.
For SQL Server admin login like SA, even if SA is disabled and is owner of some job when you run the job it would succeed.
Tibor Karaszi has more detailed explanation on this.
- The login was removed from AD but not from SQL Server( someone forgot to remove it) and the login is member of sysadmin fixed server role
In above scenario the job will "still run". The reason is since job was added as administrator in SQL Server there is entry of this owner with SID in sys.server_principal which SQL Server knows, and since the login was member of sysadmin role no "impersonization" will be done and hence job will succeed.
- The login was removed from AD and from SQL Server.
In this scenario the job will fail which is pretty much obvious
- The login was removed from AD but not from SQL Server( someone forgot to remove it) and the login is NOT member of sysadmin fixed server role.
In this case job will fail because since owner is not sysadmin impersonization will be done and SQL Server will look for this account in Windows AD, since the account was removed the job will fail.
For SQL Server admin login like SA, even if SA is disabled and is owner of some job when you run the job it would succeed.
Tibor Karaszi has more detailed explanation on this.
Context
StackExchange Database Administrators Q#237293, answer score: 3
Revisions (0)
No revisions yet.