Security Compliance

Patch Manager SQL account permissions

This article lists the requirements for the Microsoft® SQL Server® accounts and account permissions used in Patch Manager.

First published date

11/19/2018 8:51 PM

Last published date

11/19/2018 8:51 PM

Overview

This article lists the requirements for the Microsoft^® SQL Server^® accounts used in Solarwinds Patch Manager and account permissions required for both Local and remote.

Product section

Patch Manager

Resolution

When you install Solarwinds Patch Manager, the Patch Manager database(Called Eminentware) can be installed on a local server (Same server as Patch manager application server) Or remote SQL Server. In both configurations, Patch Manager requires service and reporting accounts for Eminentware DB access.

Service account (Local / domain)

The Service account creates Patch Manager database called Eminentware on the SQL server and maintains communications between the Patch Manager Application server and the database.

If you created Patch Manager database on a local SQL server i.e running on same server as Patch manager Application server, you can select a specific service account or accept the default local windows account (starts with .\EWxxxxx) that Patch manager offers you to create. These accounts are created when you run Patch Manager configuration wizard.

Service account requirements: If you decide to create Patch Manager database on a remote SQL server, the service account must be a domain account with access to a remote Patch Manager database, local windows or SQL SA accounts not supported.

Reporting account

The Reporting account is used to run Patch Manager reports. It is created when Patch Manager creates the Eminentware database, the name of the account is called ewreportuser and it is attached to the DB on SQL server. Patch Manager uses this account to run reports. You cannot change this account or define an alternative account.

SQL Account membership & Permissions

The service account(local/domain) must be a member of the SysAdmin group in SQL Server during the installation and upgrade only. This requirement allows the service account to create and modify the Patch Manager database schemas.

Also, the service account does NOT require ongoing SysAdmin permissions in SQL Server. After the service account creates the Patch Manager database, the account becomes the database owner (DBO), which waives any requirements for elevated SQL permissions. This allows the service account to maintain a connection to the remote SQL server.

The service account may require SysAdmin permissions for upgrade activities. For example, the service account requires SysAdmin permissions if the upgrade requires changes to the database instance that stores the Patch Manager database. These requirements are documented for each version in the Patch Manager release notes.

(Optional) Mixed-mode Authentication

Patch Manager does not require mixed mode authentication on the remote SQL database server. The reporting account is a least-privilege account that only requires permission to connect and execute SELECT statements. Since it does not require SysAdmin permissions.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.