HealthService SysAdmin Role Check Monitor

Microsoft.SQLServer.RunAs.2017.Addendum.OLEDB.CheckForSysadmin.Monitor (UnitMonitor)

Knowledge Base article:

Summary

This monitor checks to see if the NT SERVICE\Healthservice exists as a login on the SQL server AND has the System Administrator role to the SQL instance. This monitor should be enabled if you plan to grant sysadmin for the HealthService for monitoring.

Configuration

This monitor uses the System.OleDbProbe and runs the query: select count(*) from syslogins where sysadmin = 1 AND Name = 'NT SERVICE\HealthService'

The expected value is "1"

Resolutions

You need to grant SysAdmin role permissions to the NT SERVICE\HealthService, or disable this monitor.

External

https://blogs.technet.microsoft.com/kevinholman/2016/08/25/sql-mp-run-as-accounts-no-longer-required-2/

Element properties:

TargetMicrosoft.SQLServer.Windows.DBEngine
Parent MonitorSystem.Health.ConfigurationState
CategoryCustom
EnabledFalse
Alert GenerateFalse
Alert Auto ResolveFalse
Monitor TypeMicrosoft.SQLServer.RunAs.2017.Addendum.OLEDB.CheckForSysadmin.MonitorType
RemotableTrue
AccessibilityPublic
RunAsDefault

Source Code:

<UnitMonitor ID="Microsoft.SQLServer.RunAs.2017.Addendum.OLEDB.CheckForSysadmin.Monitor" Accessibility="Public" Enabled="false" Target="SQL2017Disc!Microsoft.SQLServer.Windows.DBEngine" ParentMonitorID="Health!System.Health.ConfigurationState" Remotable="true" Priority="Normal" TypeID="Microsoft.SQLServer.RunAs.2017.Addendum.OLEDB.CheckForSysadmin.MonitorType" ConfirmDelivery="false">
<Category>Custom</Category>
<OperationalStates>
<OperationalState ID="OK" MonitorTypeStateID="QueryResultGood" HealthState="Success"/>
<OperationalState ID="Error" MonitorTypeStateID="QueryResultBad" HealthState="Warning"/>
</OperationalStates>
<Configuration>
<IntervalSeconds>14453</IntervalSeconds>
<ConnectionString>$Target/Property[Type="SQL2017Lib!Microsoft.SQLServer.Core.DBEngine"]/ConnectionString$</ConnectionString>
</Configuration>
</UnitMonitor>