SQL Server 2008 (SSQA.net)

SQL Server 2008 installation issues: Access is denied

In general the installation of SQL Server is straight forward and should not be a problem unless the server is not under hardware/software configuration link here.

As SQL Server 2008 version is designed secured by default and part of security measures within Windows operating systems (2003 & 2008 versions) the installation login needs to be a part of local Administrators group and Domain administrator if the service is broadcast on network or register in any central management server. By default the security practice is to remove some of the default user rights to local administrators group on a Windows operating system. But in the case of installation and prepartion for setting up SQL server on this system, you must add setup account to the local administrators group.

 In spite of such measure there may be occassions that SQL Server 2008 installation process may fail with various error messages as noted below (resolved by me recently):

Access is denied

The above error message is presented when the user privileges are not sufficient on the server and it is a good practice to refer to the 'detail.txt' file for further information, few of the messages that I have observed:

SQLEngine: --SqlServerServiceSCM: Waiting for nt event 'Domain\sqlserverRecComplete$NIIT' to be created

SQLEngine: --SqlServerServiceSCM: Waiting for nt event 'Domain\sqlserverRecComplete$NIIT' or sql process handle to be signaled

Slp: Configuration action failed for feature SQL_Engine_Core_Inst during timing ConfigRC and scenario ConfigRC.

Slp: Access is denied

Slp:    at Microsoft.SqlServer.Configuration.SqlEngine.SqlServerServiceBase.WaitSqlServerStart(Process processSql)

Slp:    at Microsoft.SqlServer.Configuration.SqlEngine.SqlServerServiceSCM.StartSqlServer(String[] parameters)

Slp:    at Microsoft.SqlServer.Configuration.SqlEngine.SqlServerStartup.StartSQLServerForInstall(String sqlCollation, String masterFullPath, Boolean isConfiguringTemplateDBs)

Slp:    at Microsoft.SqlServer.Configuration.SqlEngine.SqlEngineDBStartConfig.ConfigSQLServerSystemDatabases(EffectiveProperties properties, Boolean isConfiguringTemplateDBs, Boolean useInstallInputs)

Majority of above error message may not be meaningfull for normal SQL Server users, but as a System Administrator and DBA the action is to refer whether privielged access is enabled or not and even few times the Enterprise security policies may restrict the user to install the required software on the servers. Due to the nature of behavior by design and followed the above step to add user account to local-Admin group may not resolve the issue, it requires additional rights to continue the setup:

As referred about Enterprise wide security policies it is better to check the privileges to Server's 'local polity object' for Backup files and directories, Debug Programs & Manage auditing and security log names. One of the Technet document refers the following steps to enable such rights:

To add the rights to the local administrator account follow these steps:

1. Log on to the computer as a user who has administrative credentials.
2. Click Start, click Run, type Control admintools , and then click OK.
3. Double-click Local Security Policy.
4. In the Local Security Settings dialog box, click Local Policies, double-click User Rights Assignment, and then double-click Backup Files and Directories.
5. In the Debug programs Properties dialog box, click Add User or Group.
6. In the Select User or Groups dialog box,type the user account being used for setup, and then click OK two times.
7. Repeat the procedure for the other two policies mentioned in the Cause section
8. On the File menu, click Exit to close the Local Security Settings dialog box.

Take another example of upgrading the SQL Server from 2005 to 2008 version with in-place upgrade scenario, at times the following errors will also appear to obstruct the installation of SQL Server 2008 on that server. As a part of installation check setup performs the validity of  Engine_SqlEngineHealthCheck  rule and errors out:

Rule name:Engine_SqlEngineHealthCheck
Rule description: Checks whether the SQL Server service can be restarted; or for a clustered instance, whether the SQL Server resource is online.
Result: Failed
Message/Corrective Action: The SQL Server service cannot be restarted; or for a clustered instance, the SQL Server resource is not online

The problem with above error will be mis-leading if the existing instance is not a part of Windows/SQL cluster and you must refer for following messages too under 'detail.txt' file: 

SQLEngine: : Checking Engine checkpoint 'GetSqlServerProcessHandle_1'
SQLEngine: --SqlServerServiceSCM: Waiting for nt event 'Domain\sqlserverRecComplete$SQL10' to be created
SQLEngine: --SqlServerServiceSCM: Waiting for nt event 'Domain\sqlserverRecComplete$SQL10' or sql process handle to be signaled
SQLEngine: --FacetSqlEngineHealthCheck: Engine_SqlEngineHealthCheck: Error: Access is denied

To proceed further you must check the privileges for that user by using accesschk.exe utility from SysInternals and review Setting Up Windows Services Accounts document too. It is a coincedence that I was able to solve the installation problem after referring to KBA2000257 about the error messages that were presented before.