What permissions do I need to grant on service accounts on SQL root path when relocating? During a Win2012 with SQL Server 2012 two-node cluster installation, I accidentally set the system root to be the mount point volume hosting folders for the various attached LUNs for the system and user DBs. 

I relocated them post-installation to the volume I have for the System DBs and made the corrections to the startup switches, registry for the full-text service, and SQL Server Agent error log. However, I'm still getting:


  error code 5: Access Denied errors on service startup 


This only goes away when I grant the SQL Server service account local Admin privileges. I tried granting NTFS Full Control privileges on the mount point to the service account but no luck. 

Is there another permission set I should apply and to which accounts?
I was able to get guidance from the following MSDN link: Configure Windows Service Accounts and Permissions. The pertinent section (bookmarked in the link) is "File System Permissions Granted to SQL Server Per-service SIDs or Local Windows Groups". 

The short version for the solution is that either Read, Execute or Full Control are needed on the leaf-level subdirs under the system root (DATA, LOG, FTDATA, etc). 

On my host, NTFS permissions weren't propagating from the mountpoint volume root or the folder by which the SYSDB LUN were mounted. Applying NTFS permissions on the leaf-level corrected the issue.