SSIS proxy/credentials not working from within SQL Agent job step
I appreciate the feedback on this, and I hope this helps people in the future. I finally narrowed down the true root cause of the problem. I had not provided enough detail around the fact that an Excel file was being used. After disabling everything in the package, If I only enabled the Data flow task using the Excel source, I would get the failure, but only when using the SSIS proxy (which launched the job using the Domain1\NewUser account). If I set the job step to use the SQL Server Agent account, everything would work fine.
After some time away from the problem, I tried logging into the server with the NewUser1 credentials, and ran Excel for the first time. It prompted me for initials and then I closed the program. I had also added the account to the server's local Administrators group so I could RDP.
Then I ran the job using the SSIS proxy and everything worked fine. When I removed the account from the local Administrators group it would fail again, but I determined it was the local policy "logon as a batch job" that was being granted in that membership.
Here is what I have learned from this experience:
- SQL Credentials can only impersonate a user account, NOT a group. SSIS proxy is a valid solution for granting necessary privileges for a batch job. Excel (and possibly other applications) may need to be launched once using the related credentials, just to complete application settings in the user's profile on the server. Logon as a batch job is required for a proxy that runs DTExec to launch a package from the file system. Excel sources are problematic, and the OLE DB driver may report this problem when it isn't a layout/format issue:
Hresult: 0x80004005 Description: "External table is not in the expected format."