Category: Security
Item: SQL Agent jobs owned by non SA account
Users leave the organization.
When login is disabled, deleted or Active Directory is not available – the job may stop working.
The best practices recommend you set all job owners to SA account.
Note: You might have a different approach, such as creating an account or login specifically for SQL Agent jobs.
How to verify The Owner Of All SQL Server Agent Jobs
You may use the query below to check the jobs and their owners.
SELECT sj.name AS [Job Name],
sj.[description] AS [Job Description],
SUSER_SNAME(sj.owner_sid) AS [Job Owner],
sj.date_created AS [Date Created],
sj.[enabled] AS [Job Enabled],
sc.name AS [Category Name]
FROM msdb.dbo.sysjobs AS sj WITH (NOLOCK)
INNER JOIN msdb.dbo.syscategories AS sc WITH (NOLOCK)
ON sj.category_id = sc.category_id
ORDER BY sj.name OPTION (RECOMPILE);
How to change SQL Server Agent Jobs Ownership?
- Using SSMS, click on Agent SERVER.
- Expand “Jobs,” and right-click the Job Name and select properties;
- Change the property owner to SA.
One Response
Actually, it’s not best practice for the sa account to own jobs. That causes problems with SSIS jobs and the use of proxy accounts. You should test out creating a dummy SQL account–probably one without logon privileges and with at most a SQLAgentUserRole role–to own your jobs.