> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/server/knowledge-base/knowledge-base-articles/dvls_owner-control-server-usage.md). # DVLS\_Owner control server usage The `Control Server` permission on the ***DVLS\_Owner*** account may appear excessive at first glance. This article explains exactly why it is required, when it is used, and how to avoid granting it. ### Grant view server state to DVLS\_Scheduler Devolutions Server requires the ***DVLS\_Scheduler*** account to hold the `View server state server level` permission. The Scheduler service uses this permission to query SQL Server dynamic management views (DMVs) in order to monitor the current load on the SQL instance and throttle its own work accordingly, ensuring the Scheduler never overloads your SQL Server during background operations. SQL Server enforces a rule: to grant a server-level permission to another account, the grantor must itself hold `Control Server` (or be a member of the sysadmin role). There is no lower-privilege alternative for granting server-level permissions in SQL Server. This means ***DVLS\_Owner*** needs `Control Server` not to use it directly, but solely to be able to issue the following grant to ***DVLS\_Scheduler***: `GRANT VIEW SERVER STATE TO [DVLS_Scheduler];`. #### Error message The following error message appears when a user clicks the [***Apply least permissions***](broken://pages/54e1ba64bbe41bb8f4a9cfb86bb044e57ff65a85#settings) button in the Devolutions Server Console without having `GRANT` permission, or when updating Devolutions Server: `Msg 4613, Level 16, State 1, Line 1 Grantor does not have GRANT permission` ### When is Control Server actually used? `Control Server` is not a runtime permission. Devolutions Server never uses it during normal operation. It is only exercised at the following specific administrative moments: * Initial installation: when the database and accounts are first provisioned. * Product updates: when the permission model is re-applied after an upgrade. * Manual re-application: when an administrator explicitly clicks [***Apply least permissions***](https://docs.devolutions.net/server/devolutions-server-console/devolutions-server-settings/database/advanced-credentials/#settings) in the ***Advanced credentials*** section of the Devolutions Server Console. * Credentials window (typically only needed when the service account is changed). Outside of these moments, ***DVLS\_Owner*** does not connect to SQL Server during normal operation and is not the runtime account. #### Workarounds to avoid using control server on DVLS\_Owner If your security policy does not permit granting `Control Server` to ***DVLS\_Owner***, there are two supported alternatives. Both achieve the same result: ***DVLS\_Scheduler*** holding `View Server State` without requiring ***DVLS\_Owner*** to hold `Control Server`. **Option 1: Generate and run the script manually** Devolutions Server can [generate the SQL script](https://docs.devolutions.net/server/kb/how-to-articles/generate-script-database-permissions/) that it would otherwise execute itself. An SQL Server administrator with the appropriate privileges, e.g., a sysadmin account, can then review and run the script manually. **Option 2: Grant the permission manually** An SQL Server administrator [can grant the permission directly](https://docs.devolutions.net/server/devolutions-server-console/devolutions-server-settings/database/advanced-credentials/) to ***DVLS\_Scheduler*** without involving ***DVLS\_Owner*** at all. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.devolutions.net/server/knowledge-base/knowledge-base-articles/dvls_owner-control-server-usage.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.