Required permissions for backup and restore when using Microsoft SQL Server

Last Updated On: 15 May 2026|

6 minutes read |

Note

This page only applies if your Endpoint Central uses Microsoft SQL Server. If you're using the default PostgreSQL database, you can skip this page.

Why This Is Needed

The database account used by Endpoint Central needs specific permissions for backup and restore to work correctly. Without these, backups may fail or restore operations may not complete.

Tip

Set up all permissions upfront when you first configure your MSSQL database — not when you urgently need to restore.

Note

How to run these queries: Open SQL Server Management Studio, connect with admin privileges, click New Query, paste the query, and execute. Replace user_name with your Endpoint Centrall database user (e.g., dcuser) and database_name with your database name (e.g., desktopcentral).

Permissions at a Glance

Permission	Backup	Restore
db_owner (database role)	Required	Required
VIEW SERVER STATE (server permission)	Required	Required
CREATE ANY DATABASE (server permission)	—	Required
Folder access (SQL Server service account)	Write	Read

For Backup: What to Set Up

These permissions are needed for Scheduled Backup, Manual Backup, and Upgrade Backup.

Step 1: Grant db_owner role

Allows the system to read database tables and create backup files.

Prerequisites

Use master;
ALTER AUTHORIZATION ON DATABASE::database_name TO user_name;
GO

Step 2: Grant VIEW SERVER STATE

Allows the system to monitor SQL Server status during backup.

Prerequisites

Use master;
GRANT VIEW SERVER STATE TO user_name;
GO

Step 3: Grant folder write access to the SQL Server service account

The SQL Server service account needs write access to the backup folder so it can save backup files.

Find the SQL Server Service Account
Open SQL Server Configuration Manager and note the account under "Log On As" for the SQL Server service.
Open the Backup Folder Properties
Navigate to the backup folder (e.g., C:\Program Files\UEMS_CentralServer\ScheduledDBBackup), right-click → Properties → Security tab.
Add the SQL Server Account
Click Edit → Add. Enter the service account or computer name and click OK.
Grant Full Control
Select the account, check Full Control under "Allow", click Apply → OK.
Share the Folder (if using a network path)
Go to the Sharing tab → click Share → add the service account with Read/Write permission → click Share → Done.

Warning

For network backups: Both the Endpoint Central service account and the SQL Server service account need write access to the same network folder. Both machines must be in the same domain.

For Restore: What to Set Up

Restore requires all the backup permissions above, plus one additional permission:

Grant CREATE ANY DATABASE

Required to recreate the database during a full restore.

Prerequisites

Use master;
GRANT CREATE ANY DATABASE TO user_name;
GO

Note

Folder access for restore: The SQL Server service account needs read access to the folder containing the backup file. If you already set up folder permissions for backup, no additional action is needed.

Verifying Your Setup

After configuring permissions, verify by running a test:

Open the Backup-Restore Utility and create a manual backup
Check that the backup file was created in your specified folder
If scheduled backups are enabled, verify the next scheduled backup completes successfully