xp_regwrite and RegCreateKeyEx

[acorum]

I am trying to write to the registry via query analyzer
with an sql server extended stored procedure (xp_regwrite)
which, on all other on a different domain server, works
without incident. However, on all servers on one
particular domain, the following error results:

Server: Msg 22002, Level 16, State 1, Line 0
RegCreateKeyEx() returned error 5, 'Access is
denied.

I know that RegCreateKey is a windows api that xp_regwrite
employs.

The service accounts are domain accounts that are members
of the server machine's Windows local administrators fixes
server role, and still this doesn't work.

This error occurs when connected via query analyzer either
as the windows authenticated user that sql server and sql
agent run under or as sa logged into sqlserver. In either
case, I am executing this Furthermore, this behavior is
the same regardless of whether I am logged on the host Sql
Server machine machine (windows login, now) under my own
personal account or the sql server's service acount, or
whether I am doing this from on the actual server machine
or from some other machine via query analyzer.

If I log onto windows on the same server via the service
accounts and run regedit, I have no problem writing to the
registry, but xp_regwrite doesn't work when I run it via
query analyzer.

If I explicitly grant full control to the service accunt
via regedt32, to the key I am trying to add string values
to,
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client\Co
nnectTo, things work.

When I look this error up on support.microsoft.com or
google or anywhere else, I get the same remedy: make the
service account a member of the local machine's
administrators role. However, again, the service accounts
are already a member of the local administrators role and
shouldn't need specific assigned permissions on these
registry keys. Again, these work on all machines on
another domain that are configured the same with respect
to the service accounts, sql server versions, service
packs and OS service packs.

Any ideas?

Thanks in advance

[Dan Guzman]

Post by acorum
If I log onto windows on the same server via the service
accounts and run regedit, I have no problem writing to the
registry, but xp_regwrite doesn't work when I run it via
query analyzer.

Did you try to write to the same key using both methods? I would expect the
same error with either technique as long as you're using the same account.
The symptoms appear as though a deny permission exists on the registry
(perhaps at a higher level). You might take a close look at the permission
on the key in question.

Note that undocumented features like xp_regwrite should be used at your own
risk. Avoid using this in production code since the behavior may be changed
or removed in subsequent SQL Server service packs or versions.
--
Hope this helps.

Dan Guzman
SQL Server MVP

Post by acorum
I am trying to write to the registry via query analyzer
with an sql server extended stored procedure (xp_regwrite)
which, on all other on a different domain server, works
without incident. However, on all servers on one
Server: Msg 22002, Level 16, State 1, Line 0
RegCreateKeyEx() returned error 5, 'Access is
denied.
I know that RegCreateKey is a windows api that xp_regwrite
employs.
The service accounts are domain accounts that are members
of the server machine's Windows local administrators fixes
server role, and still this doesn't work.
This error occurs when connected via query analyzer either
as the windows authenticated user that sql server and sql
agent run under or as sa logged into sqlserver. In either
case, I am executing this Furthermore, this behavior is
the same regardless of whether I am logged on the host Sql
Server machine machine (windows login, now) under my own
personal account or the sql server's service acount, or
whether I am doing this from on the actual server machine
or from some other machine via query analyzer.
If I log onto windows on the same server via the service
accounts and run regedit, I have no problem writing to the
registry, but xp_regwrite doesn't work when I run it via
query analyzer.
If I explicitly grant full control to the service accunt
via regedt32, to the key I am trying to add string values
to,
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client\Co
nnectTo, things work.
When I look this error up on support.microsoft.com or
google or anywhere else, I get the same remedy: make the
service account a member of the local machine's
administrators role. However, again, the service accounts
are already a member of the local administrators role and
shouldn't need specific assigned permissions on these
registry keys. Again, these work on all machines on
another domain that are configured the same with respect
to the service accounts, sql server versions, service
packs and OS service packs.
Any ideas?
Thanks in advance

[a***@discussions.microsoft.com]

Thank you very much for your prompt response.

Yes, I did try to write to the same key using both
methods, with the same results.

Also, I followed the registry chain down from
HKEY_LOCAL_MACHINE to ConnectTo, and didn't find any Denys.

I know that using this extended stored proc is an
undocumented feature, but I need to add server alias
dynamically. Our app references these aliases and runs on
a cluster. Both nodes of the cluster needs to have these
server aliases (registry entries), so I have a stored proc
that runs through some tables and creates them on
startup. These aliases may change or be augmented and
need to be centrally administered, so this was the only
way I could think of to implement such a thing.

-----Original Message-----

Post by acorum
If I log onto windows on the same server via the service
accounts and run regedit, I have no problem writing to

the

Post by acorum
registry, but xp_regwrite doesn't work when I run it via
query analyzer.

Did you try to write to the same key using both methods?

I would expect the

same error with either technique as long as you're using

the same account.

The symptoms appear as though a deny permission exists on

the registry

(perhaps at a higher level). You might take a close look

at the permission

on the key in question.
Note that undocumented features like xp_regwrite should

be used at your own

risk. Avoid using this in production code since the

behavior may be changed

or removed in subsequent SQL Server service packs or

versions.

--
Hope this helps.
Dan Guzman
SQL Server MVP

Post by acorum
I am trying to write to the registry via query analyzer
with an sql server extended stored procedure

(xp_regwrite)

Post by acorum
which, on all other on a different domain server, works
without incident. However, on all servers on one
Server: Msg 22002, Level 16, State 1, Line 0
RegCreateKeyEx() returned error 5, 'Access is
denied.
I know that RegCreateKey is a windows api that

xp_regwrite

Post by acorum
employs.
The service accounts are domain accounts that are

members

Post by acorum
of the server machine's Windows local administrators

fixes

Post by acorum
server role, and still this doesn't work.
This error occurs when connected via query analyzer

either

Post by acorum
as the windows authenticated user that sql server and

sql

Post by acorum
agent run under or as sa logged into sqlserver. In

either

Post by acorum
case, I am executing this Furthermore, this behavior is
the same regardless of whether I am logged on the host

Sql

Post by acorum
Server machine machine (windows login, now) under my own
personal account or the sql server's service acount, or
whether I am doing this from on the actual server

machine

Post by acorum
or from some other machine via query analyzer.
If I log onto windows on the same server via the service
accounts and run regedit, I have no problem writing to

the

Post by acorum
registry, but xp_regwrite doesn't work when I run it via
query analyzer.
If I explicitly grant full control to the service accunt
via regedt32, to the key I am trying to add string

values

Post by acorum
to,

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client\Co

Post by acorum
nnectTo, things work.
When I look this error up on support.microsoft.com or
google or anywhere else, I get the same remedy: make the
service account a member of the local machine's
administrators role. However, again, the service

accounts

Post by acorum
are already a member of the local administrators role

and

Post by acorum
shouldn't need specific assigned permissions on these
registry keys. Again, these work on all machines on
another domain that are configured the same with respect
to the service accounts, sql server versions, service
packs and OS service packs.
Any ideas?
Thanks in advance

.