"Altiris Deployment Server DB Management" and "Altiris eXpress Server" services main requirement for a valid account

Products

• Ghost Solution Suite

Issue/Introduction

You have your "network administrator" account set to log in for the Altiris Deployment Server DB Management and Altiris eXpress Server services for your GSS (Ghost Solution Suite) server.

You would like to know if you can change the "Log on as" section to the "Local System account", or "LOCAL SERVICE, NETWORK SERVICE, or Local Administrator".

Also, if this type of change will cause any issues with the services by swapping the "Log on as" account.

Questions:

1. With recent GSS 3.3 releases, is still true that the "Log On" account used to run these services (Altiris Deployment Server DB Management and Altiris eXpress Server services) needs to be a domain account with DB rights and to the database?
2. Is there a minimal permissions/privileges that the account should have?

Environment

GSS 3.3 RU12 or later

Cause

As background information:

Those 2 services (Altiris Deployment Server DB Management and Altiris eXpress Server services) are the main requirement for "valid" account is:

"The account has been added as a User in the Database"

Since those services need database access, we want to make sure the desired "Account" has valid User rights to our express database. You can see this KB article for Steps to add a user to the Ghost Solution Suite database

If the desired account doesn't have the proper rights to the database as mentioned above, it can cause the services to crash as described under KB article Service 'Altiris Deployment Server DB Management' crashing in Ghost Solution Suite

There is more details on what type of account you can use for GSS services in the documentation under Service Logon Account

You can also change your network administrator account to some other service logon account by using this documentation Symantec Ghost Solution Suite Server Configuration Utility under the "Account" section

Resolution

This area has not changed recently, so the information provided under the "Cause" section above still remains valid.

If you need to change the service account, the account must have Administrator rights on the Ghost Solution Suite server and it also must be configured with appropriate permissions on the SQL Server:

1. It is recommended to use an administrator account, either a local or domain admin (it is not mandatory for the account to be a domain user — a local user can be used as long as it has the necessary SQL access. However, using a domain account is generally more typical and offers greater flexibility).
2. The selected account should have Server Roles on your SQL Server for the eXpressDB as "public" and "sysadmin". 
3. Also make sure the "db_owner" and "public" check-boxes are selected in the eXpressDB database membership field.