Service SID and setup account for DB engine service

Question

SQL supports service isolation of access control through granting permissions to the service SID. However, we also can give the privileges to service account. Which one of the service
SID  and service account has higher priority? If we give the conflicting permissions to service SID and service account, which one will work?

Answer 1

Hi smileahpu,
In short, for account rights/privileges, there are two general types Allow and Deny. The "Allow" rights/privileges are combined, and the "Deny" rights/privileges are exclused. The DENY(SE_DENY) rights override the corresponding account
rights. In this case, either the service account or the service sid is denied on a right, the service is denied on the right.
To be more detailed, we need to go through the following topics:
How does system validate a process's privileges while accessing securable objects
How does per-service SID work while accessing securable objects
How does Access Control work
How a process accesses securable objects:
The system uses an access token to identify the user when a thread(or a process) interacts with a securable object or tries to perform a system task that requires privileges.
An access token is an object that describes the security context of a process or thread.
Access token contains lots of information. Two of them are:
•The security identifier (SID) for the user's account
•A list of the privileges held by either the user or the user's groups
Please review the following article for more information:
http://msdn.microsoft.com/en-us/library/windows/desktop/aa374909(v=vs.85).aspx
How does per-service SID work while accessing securable objects
For a service without per-Service SID enable, we can image the security context is just from the user(service account). With per-Service SID enabled, we can make a security context that is not just a user, but a user AND a particular process.
Actually, the per-Service SID's SID and privilege are included the access token directly.
By checking with Windbg, we can see the service SID was included.
0:072> !token
Thread is not impersonating. Using process token...
TS Session ID: 0
User: S-1-5-21-3485830563-343820118-176642512-1008
User Groups:
 00 S-1-5-21-3485830563-343820118-176642512-513
    Attributes - Mandatory Default Enabled
 01 S-1-1-0
    Attributes - Mandatory Default Enabled
 02 S-1-5-21-3485830563-343820118-176642512-1009
    Attributes - Mandatory Default Enabled
 03 S-1-5-32-545
    Attributes - Mandatory Default Enabled
 04 S-1-5-6
    Attributes - Mandatory Default Enabled
 05 S-1-2-1
    Attributes - Mandatory Default Enabled
 06 S-1-5-11
    Attributes - Mandatory Default Enabled
 07 S-1-5-15
    Attributes - Mandatory Default Enabled
 08 S-1-5-113
    Attributes - Mandatory Default Enabled
 09 S-1-5-80-3880718306-3832830129-1677859214-2598158968-1052248003 < -- service SID
    Attributes - Default Enabled Owner
 10 S-1-5-5-0-274023807
    Attributes - Mandatory Default Enabled Owner LogonId
 11 S-1-2-0
    Attributes - Mandatory Default Enabled
 12 S-1-5-64-10
    Attributes - Mandatory Default Enabled
 13 S-1-16-12288
    Attributes - GroupIntegrity GroupIntegrityEnabled
Primary Group: S-1-5-21-3485830563-343820118-176642512-513
Privs:
 00 0x000000003 SeAssignPrimaryTokenPrivilege     Attributes -
 01 0x000000005 SeIncreaseQuotaPrivilege          Attributes -
 02 0x000000013 SeShutdownPrivilege               Attributes -
 03 0x000000017 SeChangeNotifyPrivilege           Attributes - Enabled Default
 04 0x000000019 SeUndockPrivilege                 Attributes -
 05 0x00000001d SeImpersonatePrivilege            Attributes - Enabled Default
 06 0x00000001e SeCreateGlobalPrivilege           Attributes - Enabled Default
 07 0x000000021 SeIncreaseWorkingSetPrivilege     Attributes -
 08 0x000000022 SeTimeZonePrivilege               Attributes -
Auth ID: 0:105545a6
Impersonation Level: Anonymous
TokenType: Primary
Is restricted token: no.
SandBoxInert: 0
Elevation Type: 1 (Default)
Mandatory Policy: TOKEN_MANDATORY_POLICY_VALID_MASK
Integrity Level: S-1-16-12288
Process Trust Level: (null)
Token Virtualized: Disabled
UIAccess: 0
IsAppContainer: 0
Device Groups:
How does Access Control work
Please check from the following article for more information:
http://technet.microsoft.com/en-us/library/cc740104(v=ws.10).aspx
In addition, the following articles are helpful for understanding the concepts discussed in this reply:
http://msdn.microsoft.com/en-us/library/windows/desktop/bb545671(v=vs.85).aspx
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684880(v=vs.85).aspx
http://technet.microsoft.com/en-us/library/cc781716(v=ws.10).aspx
http://blogs.technet.com/b/voy/archive/2007/03/22/per-service-sid.aspx
Thanks,
Jinchun Chen