docs(go.d/mssql): add Windows Authentication setup guide (#22089)
Ilya Mashchenko committed
Mar 30, 2026 at 21:08 UTC
d1db2c099094f3732f23d89f9069c2791af08455
1 file changed
+49
-2
src/go/plugin/go.d/collector/mssql/metadata.yaml
+49
-2
@@ -123,6 +123,45 @@ modules:
123
- `SELECT on distribution.dbo.MSreplication_monitordata` - Replication monitoring
124
- `SELECT on distribution.dbo.MSpublications` - Publication information
125
- `SELECT on distribution.dbo.MSsubscriptions` - Subscription counts
126
+ - title: Grant Windows Authentication access (optional)
127
+ description: |
128
+ If you prefer Windows integrated authentication instead of SQL authentication, grant the
129
+ Netdata service account access to SQL Server.
130
+
131
+ By default, the Netdata service runs as `Local System`. The identity it presents to
132
+ SQL Server depends on your environment:
133
+
134
+ **Domain-joined machine (Active Directory):**
135
+
136
+ `Local System` authenticates as the computer account (`DOMAIN\COMPUTERNAME$`).
137
+ Replace `DOMAIN\COMPUTERNAME$` with your actual values
138
+ (e.g., `MYDOM\SQLBOX01$`).
139
+
140
+ ```sql
141
+ CREATE LOGIN [DOMAIN\COMPUTERNAME$] FROM WINDOWS;
142
+ GRANT VIEW SERVER STATE TO [DOMAIN\COMPUTERNAME$];
143
+ GRANT VIEW ANY DEFINITION TO [DOMAIN\COMPUTERNAME$];
144
+ USE msdb;
145
+ CREATE USER [DOMAIN\COMPUTERNAME$] FOR LOGIN [DOMAIN\COMPUTERNAME$];
146
+ GRANT SELECT ON dbo.sysjobs TO [DOMAIN\COMPUTERNAME$];
147
+ ```
148
+
149
+ **Workgroup machine (no Active Directory, localhost only):**
150
+
151
+ `Local System` authenticates as `NT AUTHORITY\SYSTEM`.
152
+ This only works when SQL Server runs on the same machine.
153
+
154
+ ```sql
155
+ CREATE LOGIN [NT AUTHORITY\SYSTEM] FROM WINDOWS;
156
+ GRANT VIEW SERVER STATE TO [NT AUTHORITY\SYSTEM];
157
+ GRANT VIEW ANY DEFINITION TO [NT AUTHORITY\SYSTEM];
158
+ USE msdb;
159
+ CREATE USER [NT AUTHORITY\SYSTEM] FOR LOGIN [NT AUTHORITY\SYSTEM];
160
+ GRANT SELECT ON dbo.sysjobs TO [NT AUTHORITY\SYSTEM];
161
+ ```
162
+
163
+ > **Note**: To verify which account SQL Server sees, connect with Windows Authentication
164
+ > and run `SELECT SYSTEM_USER`.
165
configuration:
166
file:
167
name: go.d/mssql.conf
@@ -262,11 +301,19 @@ modules:
301
- name: local
302
dsn: "sqlserver://netdata_user:password@localhost:1433"
303
- name: Windows Authentication
265
- description: Connect using Windows integrated authentication.
304
+ description: |
305
+ Connect using Windows integrated authentication (Windows only).
306
+
307
+ When no username/password is provided in the DSN, the driver uses the Netdata service account's
308
+ Windows credentials. By default, the Netdata service runs as `Local System`, which authenticates
309
+ to SQL Server as the computer account (`DOMAIN\COMPUTERNAME$`).
310
+
311
+ See the [Grant Windows Authentication access](#grant-windows-authentication-access-optional) prerequisite
312
+ to configure SQL Server for this.
313
config: |
314
jobs:
315
- name: local
269
- dsn: "sqlserver://localhost:1433?trusted_connection=yes"
316
+ dsn: "sqlserver://localhost:1433"
317
- name: Named instance
318
description: Connect to a named SQL Server instance.
319
config: |