9

Given a Windows Server 2008 R2 system, where the service accounts use a non-English display language, with SQL Server 2008, the following Transact-SQL statement fails:

CREATE LOGIN [NT AUTHORITY\NETWORK SERVICE] FROM WINDOWS ...

with the following error:

Windows NT user or group 'NT AUTHORITY\NETWORK SERVICE' not found. Check the name again.

(or the same message in the non-English display language for the service accounts, depending on the context).

This same statement succeeds if the service accounts use English as their display language.

The reason seems clear: on, e.g., a German system the display name for this account is NT-AUTORITÄT\NETZWERKDIENST, and the name NT AUTHORITY\NETWORK SERVICE (with a space) is not recognized. Also the non-localized name NT AUTHORITY\NETWORKSERVICE (no space) does not work.

My question: How should I rewrite the above statement so that it works irrespective of the display language? Or am I forced to find out the localized name (in InstallScript in my case)? Then I can use

CREATE LOGIN [NT-AUTORITÄT\NETZWERKDIENST] FROM WINDOWS

which does work...

3
  • Should this be on ServerFault?
    – AllenG
    Jun 27, 2011 at 17:21
  • 1
    @AllenG: normally I'd agree, but I think this is interesting to code monkeys as well as the usual BOFH types.
    – gbn
    Jun 27, 2011 at 17:30
  • Indeed this was useful for a code monkey, as I was wondering why <SERVERNAME>\NETZWERKDIENST wasn't recognized when I attempted to create a login via the configuration dialog, even though I could select this user from the "Search user" dialog. Using NT-AUTORITÄT\NETZWERKDIENST instead solved this issue for me.
    – M463
    Jan 4, 2017 at 15:28

3 Answers 3

5

From what I've tried, and from what I read in a German forum thread entitled "Well-known SID im SQL Server nutzen", this is not possible. Apparently unfortunately SQL Server's CREATE LOGIN was designed to accept only a localized name in DOMAIN\username format.

A hint, from that same thread, is to look at section "Localized Service Names" in "Setting Up Windows Service Accounts" for the localized names that need to be used in a CREATE LOGIN statement.

The only alternative is to try and find out the system language of the Windows system running SQL Server, then use the "Localized Service Names" table to find the localized service account name, and use that to create a working CREATE LOGIN statement.

5

This works for me on SQL Server 2008R2:

IF (SELECT COUNT(*)  FROM sys.server_principals WHERE sid=0x010100000000000514000000)=0  
    BEGIN
        DECLARE @cmd VARCHAR(200)
        SET @cmd = N'CREATE LOGIN [' + SUSER_SNAME(0x010100000000000514000000) + '] FROM WINDOWS'
        EXEC (@cmd)
        PRINT 'Created network service server login from SID'
    END
ELSE
        PRINT 'Network service account found from SID, server login not created'

Can anybody verify this on a non-English Windows - German, Italian?

5
  • Thanks! I'll try to test this next week. Why the special error handling? Why use EXEC? Or is that just how you tested it to see if it works? Aug 8, 2014 at 5:51
  • It's a little longer than strictly necessary, just to verify awhether the new login was created. It makes it easier to see for yourself. When you run it without having the Network Service login, it will create it. When you run it the second time, it will echo back that it was not necessary. It was meant for an InstallShield project, and in an out-of-your hands situation remotely and automated, having more logging info helps if something goes wrong. Aug 11, 2014 at 0:17
  • This worked for me. I'm using a french Windows. But from where did you get the sid ? I want to do the same for NT AUTHORITY\LOCAL SERVICE
    – ihebiheb
    Jan 26, 2015 at 15:31
  • I know it's an old question. I don't remember where I got the SID. I think it was some serious googlefu. Jan 17, 2018 at 8:14
  • @ihebiheb I don't know, but looking at dba.stackexchange.com/a/175277 it seems one should be able to use SID_BINARY(N'S-1-5-19'), where I looked up the SID for 'local service' on Well-known security identifiers in Windows operating systems. Or use the resulting 0x010100000000000513000000... :-) Aug 8, 2019 at 13:03
3

You should be able to change the language so that this works.

SET LANGUAGE us_english
CREATE LOGIN [NT AUTHORITY\NETWORK SERVICE] FROM WINDOWS ...

I work on servers with Swiss German locale with us_english for SQL Server and we've never had to do this kind of thing. So I'm guessing that SQL Server takes it's cue from it's own language settings.

HTH

1
  • 1
    Thanks for the quick response! However, I just tested this, and it doesn't work for me. Same error as reported in my question. Jun 28, 2011 at 9:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.