MindShield
LoginRequest demo
Request demo
Documentation / SQL Server permissions

SQL Server permissions guide

Permissions must support the approved discovery and backup operations while remaining consistent with the database owner’s least-privilege policy.

Last reviewed: July 2026Public product guidance

Apply least privilege

Do not grant broad server roles merely to bypass a setup error. Identify the exact operation that failed, review the SQL Server message and approve only the access required for the intended backup workflow.

Environment-specific approval

Exact permissions can differ according to SQL Server version, authentication method, backup destination and organizational policy. The database owner remains responsible for approving access.

Confirm the service identity

The Windows service commonly runs under the configured service account, including LocalSystem in the current pilot installer. When SQL Server is local, Windows may present that identity differently from a domain or remote-server deployment. Confirm the effective login in SQL Server rather than relying on the Windows Services display alone.

  • Record the MindShieldAgent service account.
  • Confirm whether SQL Server is local, named or remote.
  • Confirm Windows or SQL authentication requirements.
  • Approve access to the backup destination separately from database access.

Validate in stages

  1. Confirm the SQL Server service is running.
  2. Confirm the instance can be discovered.
  3. Test connection and database enumeration.
  4. Run an approved small backup test.
  5. Confirm the output exists and the job is recorded.
  6. Review verification evidence before broad policy rollout.

Diagnose permission errors

Capture the SQL Server error number, effective login, database, operation and destination path. Review SQL Server and Windows event logs. Correct the narrow permission failure and repeat the same test before changing another variable.