Friday, June 17, 2011

Run SSMS under a different domain account, or a SQL Server service account

Do you want a way to log in to your workstation, yet connect to your SQL Server instances using different domain accounts, too?  I do this ALL the time.

At work, I have several types of logins I use often: my "normal" account, my "admin" account, and SQL Server service accounts.

I have higher access using my admin account than my normal account, but for security reasons I like to minimize the time I use it. SQL Server service accounts are a good way of controlling exactly who (or what) can run SQL processes, and sometimes I want to log in as that service account to verify what it can see and do.  It's also handy when I want to verify that an instance it's connecting to on a different server (i.e., using a linked server) has read-only rights on the separate server (db_datareader).

I use these commands CONSTANTLY in my workplace:
"runas /profile /user:domain\adminaccount ssms.exe"
"runas /profile /user:domain\sqlserverserviceaccount ssms.exe"

The runas command asks for the password to the account, then attempts to launch the executable.

I had to blot out a lot for security reasons, but I think you'll get the idea.

Running under my normal login account:

I need to run SSMS and connect with a higher-privileged account:

I want to log in as my SQL Server service account: