This article applies to:

• Trustwave MailMarshal (SEG) 6.8 and above
• Trustwave ECM/MailMarshal Exchange 7.X 

Question:

• What are the required SQL Server permissions to create, upgrade, or use a SQL database with SEG or ECM?

Reply:

To create a database requires Sysadmin permission on the SQL server.

To upgrade a database requires one of the following:

• Sysadmin permission on the SQL server
• Database Owner permission on the product database (only if this user is also used as the "operational user" for daily operation).

The credential used can be a Windows or SQL credential.

This level of permission is required to create new tables, stored procedures, and other objects, and to assign security permissions to new objects.

The same requirements apply for additional databases (Syslog database in 8.0 and above, Configuration Service database in 10.X)

Available Options

The following options are available (from most to least secure):

1. Use an account with minimum permissions for daily operation and an elevated account to create or upgrade the database:
   • Use SQL tools to create a credential with no permissions.
   • In the product interface, specify any database name and specify the user you created as "operational user". You will be prompted to enter an administrative account. The administrative account must have Sysadmin permission on the server (for example, the default SQL SA user). This elevated credential will be used to create a custom database role, and assign this role to the operational user.
   • The elevated credential will not be saved.
   • Each time you upgrade or re-create the database you will be prompted for an administrative account.
2. Use a single account with moderate permissions for all functions:
   • Use SQL tools to create a blank database and a credential that has Database Owner permission on that database.
     • You can also add a Database Owner credential to an existing database. 
   • In the product UI, specify this database name and credential as operational user. The product will use this account to create and upgrade the tables and other database structure, and also for daily operation.
3. Simply use a single account (least secure):
   • Specify a credential with sysadmin permission (such as the default SA) as the operational user.
   • This option is typically used in a single server installation where the product installer has installed SQL Express.

Notes:

• The "Basic Install" option uses the Windows system account ("sys" in SQL Server) as operational user.
• For MailMarshal (SEG) 10.X, "Basic Install" uses the IIS application pool identity of the SEG Configuration Service for the Configuration Service database.
• If the Windows account used to install the product has SQL administrative permissions, then you will not need to enter administrative credentials.
• For a more detailed explanation of permissions and options, see article Q12939.
• If you encounter database permission issues when upgrading, you can re-run the upgrade installation. See article 20594.