gary.rumble (10/27/2016)
I'm afraid I don't remember all of the steps I took. There were many failed attempts to get this working.The MSA (Managed Service Account) was created on the Domain Controller.
In SSMS:
use master;
GO
CREATE LOGIN [MyDomain\MyMSA$] FROM WINDOWS;
GO
USE msdb;
GO
CREATE USER [MyDomain\MyMSA$]FROM LOGIN [MyDomain\MyMSA$];
GO
ALTER ROLE DatabaseMailUserRoleADD MEMBER [MyDomain\MyMSA$];
GO
Prior to doing that, I got an error about the user accessing objects in msdb.
Okay...first I'm not sure it's fully supported to use MSAs on 2008R2 or earlier. But some people have managed to get it working
If that's all you added above, don't think that's going to work too well for you.
If SQL Server was running under other accounts, you would typically want to change them using SQL Server Configuration Manager as it will handle some of the additional access needed. You want to verify that they are correct in Configuration Manager. If it's already running under the correct MSA, I'd still hit apply on that just to make sure. It should just have the account with the dollar sign (and no password or the dots in there for the password). You will also want to add the MSA to sysadmins server role on SQL.
Rights and ACLs on the server could be a issue so this has the list of rights and ACLs needed by the different services:
https://msdn.microsoft.com/en-us/library/ms143504(v=sql.105).aspx
I'm not sure if you need to change the groups or not on that server and when I just searched on that the MS docs just say it's not supported on 2008. But on a 2008 install, you should have groups for the services you installed...something like SQLServerMSSQLUser$ServerName$MSSQLSERVER(Or Instance name)...you'll see the other groups with similar names, just the part before the server name is different for the different services. AgentUser is for SQL Agent, MSASUser for Analysis Services, ReportServerUser for Reporting Services. Those are created during the installation. The accounts you put in for the services are members of those respective groups. But like I said, I don't know if you need to add the managed service account to those groups. I would think it wouldn't hurt but not sure. The benefit would be that it should take care of the other rights and ACLs from the link above.
Hope that helps some -
Sue