Error While Deploying SSIS 2012 project from SSDT to SSIS Catalog : System.ComponentModel.Win32Exception: A required privilege is not held by the client

Published Jan 15 2019 02:36 PM 214 Views
First published on MSDN on Aug 20, 2012

A .NET Framework error occurred during execution of user-defined routine or aggregate "deploy_project_internal": System.ComponentModel.Win32Exception: A required privilege is not held by the client.

I ran across this issue in one of my newly set up Sql 2012 Servers when I tried to deploy a project to the SSIS Catalog using the Project Deployment Model. I set Sql 2012 up in 3-4 of my servers and never encountered this before. I was using my same domain account across all the Servers. I tried to grab a profiler but could not find any calls to the system stored procedures used for deployment, so my guess was the call is not even reaching to Sql.

After spending a few hours, I was actually able to get past the problem even though I’m not sure if I found out the exact cause! In this case, I’m pretty sure that SSIS is doing a CreateProcessAsUser() using my account credentials, and the SQL/Agent service account is not involved. The SSIS Catalog only accepts Windows Auth (because it does account impersonation during deployment, validation and execution).


Since the deployment process is making call to an executable residing in the file system (outside of Sql), I suspected that the Sql Server Service Account would come into question . I changed the Sql Server Service Account from built in default “Nt Service\MSSQLSERVER” (New account introduced in Denali) to another account with admin rights on the system and VOILA!! it started working.


This seems to be an issue specific to the Sql Service account permissions; however I could not reproduce the problem in my other machines though my service runs as “Nt Service\MSSQLSERVER”. I believe it has something to do with the group policy. SSIS is launching the external process to do the deployment (ISServerExec) in much the same way that SQL Agent runs its jobs. In similar SQL Agent cases, it looked like service account requires the “ Act as part of the operating system ” account policy.

Author : Debarchan(MSFT) SQL Developer Engineer, Microsoft

Reviewed by : Snehadeep(MSFT), SQL Developer Technical Lead , Microsoft

%3CLINGO-SUB%20id%3D%22lingo-sub-317183%22%20slang%3D%22en-US%22%3EError%20While%20Deploying%20SSIS%202012%20project%20from%20SSDT%20to%20SSIS%20Catalog%20%3A%20System.ComponentModel.Win32Exception%3A%20A%20required%20privilege%20is%20not%20held%20by%20the%20client%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-317183%22%20slang%3D%22en-US%22%3E%0A%20%26lt%3Bmeta%20http-equiv%3D%22Content-Type%22%20content%3D%22text%2Fhtml%3B%20charset%3DUTF-8%22%20%2F%26gt%3B%3CSTRONG%3E%20First%20published%20on%20MSDN%20on%20Aug%2020%2C%202012%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%3CP%3EA%20.NET%20Framework%20error%20occurred%20during%20execution%20of%20user-defined%20routine%20or%20aggregate%20%22deploy_project_internal%22%3A%20%3CEM%3E%20System.ComponentModel.Win32Exception%3A%20A%20required%20privilege%20is%20not%20held%20by%20the%20client.%20%3C%2FEM%3E%3C%2FP%3E%0A%20%20%3CP%3EI%20ran%20across%20this%20issue%20in%20one%20of%20my%20newly%20set%20up%20Sql%202012%20Servers%20when%20I%20tried%20to%20deploy%20a%20project%20to%20the%20SSIS%20Catalog%20using%20the%20Project%20Deployment%20Model.%20I%20set%20Sql%202012%20up%20in%203-4%20of%20my%20servers%20and%20never%20encountered%20this%20before.%20I%20was%20using%20my%20same%20domain%20account%20across%20all%20the%20Servers.%20I%20tried%20to%20grab%20a%20profiler%20but%20could%20not%20find%20any%20calls%20to%20the%20system%20stored%20procedures%20used%20for%20deployment%2C%20so%20my%20guess%20was%20the%20call%20is%20not%20even%20reaching%20to%20Sql.%3C%2FP%3E%0A%20%20%3CP%3E%3C%2FP%3E%0A%20%20%3CP%3EAfter%20spending%20a%20few%20hours%2C%20I%20was%20actually%20able%20to%20get%20past%20the%20problem%20even%20though%20I%E2%80%99m%20not%20sure%20if%20I%20found%20out%20the%20exact%20cause!%20In%20this%20case%2C%20I%E2%80%99m%20pretty%20sure%20that%20SSIS%20is%20doing%20a%20CreateProcessAsUser()%20using%20my%20account%20credentials%2C%20and%20the%20SQL%2FAgent%20service%20account%20is%20not%20involved.%20The%20SSIS%20Catalog%20only%20accepts%20Windows%20Auth%20(because%20it%20does%20account%20impersonation%20during%20deployment%2C%20validation%20and%20execution).%3C%2FP%3E%0A%20%20%3CP%3E%3CBR%20%2F%3E%20Since%20the%20deployment%20process%20is%20making%20call%20to%20an%20executable%20residing%20in%20the%20file%20system%20(outside%20of%20Sql)%2C%20I%20suspected%20that%20the%20Sql%20Server%20Service%20Account%20would%20come%20into%20question%20%3CSTRONG%3E%20.%20%3C%2FSTRONG%3E%20I%20changed%20the%20Sql%20Server%20Service%20Account%20from%20built%20in%20default%20%E2%80%9CNt%20Service%5CMSSQLSERVER%E2%80%9D%20(New%20account%20introduced%20in%20Denali)%20to%20another%20account%20with%20admin%20rights%20on%20the%20system%20and%20VOILA!!%20it%20started%20working.%3C%2FP%3E%0A%20%20%3CP%3E%3CSTRONG%3E%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%20This%20seems%20to%20be%20an%20issue%20specific%20to%20the%20Sql%20Service%20account%20permissions%3B%20however%20I%20could%20not%20reproduce%20the%20problem%20in%20my%20other%20machines%20though%20my%20service%20runs%20as%20%E2%80%9CNt%20Service%5CMSSQLSERVER%E2%80%9D.%20I%20believe%20it%20has%20something%20to%20do%20with%20the%20group%20policy.%20SSIS%20is%20launching%20the%20external%20process%20to%20do%20the%20deployment%20(ISServerExec)%20in%20much%20the%20same%20way%20that%20SQL%20Agent%20runs%20its%20jobs.%20In%20similar%20SQL%20Agent%20cases%2C%20it%20looked%20like%20service%20account%20requires%20the%20%E2%80%9C%20%3CA%20href%3D%22http%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Flibrary%2Fms813614.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%20Act%20as%20part%20of%20the%20operating%20system%20%3C%2FA%3E%20%E2%80%9D%20account%20policy.%3C%2FP%3E%0A%20%20%3CP%3E%3C%2FP%3E%0A%20%20%3CP%3E%3CSTRONG%3E%20Author%20%3A%20Debarchan(MSFT)%20SQL%20Developer%20Engineer%2C%20Microsoft%20%3C%2FSTRONG%3E%3C%2FP%3E%0A%20%20%3CP%3E%3CSTRONG%3E%20Reviewed%20by%20%3A%20Snehadeep(MSFT)%2C%20SQL%20Developer%20Technical%20Lead%20%2C%20Microsoft%20%3C%2FSTRONG%3E%3C%2FP%3E%0A%20%0A%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-317183%22%20slang%3D%22en-US%22%3EFirst%20published%20on%20MSDN%20on%20Aug%2020%2C%202012%20A%20.%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-317183%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EIntegration%20Services(SSIS)%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Version history
Last update:
‎Jan 15 2019 02:36 PM
Updated by: