SQL Server Agent Subsystems
A subsystem is a predefined object that represents a set of functionality available to a SQL Server Agent proxy. Each proxy has access to one or more subsystems. Subsystems provide security because they delimit access to the functionality that is available to a proxy. Each job step runs in the context of a proxy, except for Transact-SQL job steps. Transact-SQL job steps use the EXECUTE AS command to set the security context.
After upgrading from SQL Server 2000, all user proxy accounts that existed before upgrading are changed to the temporary global proxy account UpgradedProxyAccount. The UpgradedProxyAccount is only granted access to those subsystems that were explicitly used, and does not have access to all subsystems after upgrading.
SQL Server defines the subsystems listed in the following table:
Microsoft ActiveX Script
Run an ActiveX scripting job step.
The ActiveX Scripting subsystem will be removed from SQL Server Agent in a future version of Microsoft SQL Server. Avoid using this feature in new development work, and plan to modify applications that currently use this feature.
Operating System (CmdExec)
Run an executable program.
Run a PowerShell scripting job step.
Run a job step that activates the replication Distribution Agent.
Run a job step that activates the replication Merge Agent.
Replication Queue Reader
Run a job step that activates the replication Queue Reader Agent.
Run a job step that activates the replication Snapshot Agent.
Replication Transaction Log Reader
Run a job step that activates the replication Log Reader Agent.
Analysis Services Command
Run an Analysis Services command.
Analysis Services Query
Run an Analysis Services query.
SSIS package execution
Run an SSIS package.
Because Transact-SQL job steps do not use proxies, there is no SQL Server Agent subsystem for Transact-SQL job steps.
SQL Server Agent enforces subsystem restrictions even when the security principal for the proxy would normally have permission to run the task in the job step. For example, a proxy for a user that is a member of the sysadmin fixed server role cannot run an SSIS job step unless the proxy has access to the SSIS subsystem, even though the user can run SSIS packages.