local administrator does not have permissions to create database in db2 I have a fresh standard installation of DB2 11.5 on Windows server 2016. According to documentation, i need the to have SYSADM or SYSCTRL to create a new Database.
The documentation for &quot;sysadm_group - System administration authority group name configuration parameter&quot; states.

SYSADM authority is determined by the security facilities used in a specific operating environment.

For the Windows operating system, this parameter can be set to local or domain group. Group names must adhere to the length limits specified in SQL and XML limits. The following users have SYSADM authority if &quot;NULL&quot; is specified for sysadm_group database manager configuration parameter:

Members of the local Administrators group
Members of the Administrators group at the Domain Controller if DB2_GRP_LOOKUP is not set or set to DOMAIN
Members of DB2ADMNS group if Extended Security feature is enabled.
The location of the DB2ADMNS group was decided during installation
The LocalSystem account




The parameter is empty and my account is in the DB2ADMN group which was automatically created during the install and also in the local admin group. Extended Security is enabled on that instance. Since my account used to be in these group through another group I added my account explicitly to both groups. Either way, db2 still thinks I don't have enough permissions to create a database.
I checked db2diag but there are no entries logged.
Is there anything that I missed or that I can check to see what's going on?
I had some chats with IBM and the issue is kind of simple. The db2 service is running as a local account (db2admin) just as a default installation would do. My account is a domain account and is in the local administrator group. The local account is not able to verify my domain account and therefore I am denied admin permission.
Solutions:

use a local account for connecting to the database
run db2 service under the local system account
run db2 service under domain account

I changed the setup to local system account. Waiting on IBM for letting me know what the security impact (risk) is.