MS SQL Server - BUILDIN\Administrator's login account

Author

BUILDIN\Administrator's login account

Catelin Wang

2005-07-28, 8:23 pm

I am going to remove the BUILDIN\Administrato
r's log account as recommneded
for the security reason , is there anyone has thouhgts on how good and (or)
how bad it can be if I remove it ? and what if I need this acccount later?
can I put it back?

Thanks a lot

Lau Lei Cheong

2005-07-29, 3:23 am

I think it'll be better to rename it in Local Policy Editor rather than
remove it.

"Catelin Wang" < CatelinWang@discussi
ons.microsoft.com> ¼¶¼g©ó¶l¥ó·s»D:A3C2C
86C-21BC-4A62-AE67- B8AE0B6ADAD8@microso
ft.com...
>I am going to remove the BUILDIN\Administrato
r's log account as recommneded
> for the security reason , is there anyone has thouhgts on how good and
> (or)
> how bad it can be if I remove it ? and what if I need this acccount later?
> can I put it back?
>
> Thanks a lot
>

Sue Hoegemeier

2005-07-29, 3:23 am

You can remove the builtin\administrato
rs group from SQL
Server. However, under some scenarios, this can cause
problems. Whether you experience problems or not depends.
The following article has a more information section with
links to some issues that could come up:
INF: How to impede Windows NT administrators from
administering a clustered instance of SQL Server
http://support.microsoft.com/?id=263712

You can add the account back later by executing the
following in Query Analyzer:
EXEC sp_grantlogin 'BUILTIN\Administrat
ors'

By default, the group is a member of the sysadmins sql
server role. If you wanted this back as well, you could
execute the following:
EXEC sp_addsrvrolemember 'BUILTIN\Administrat
ors' ,
'sysadmin'

-Sue

On Thu, 28 Jul 2005 18:38:55 -0700, Catelin Wang
< CatelinWang@discussi
ons.microsoft.com> wrote:

>I am going to remove the BUILDIN\Administrato
r's log account as recommneded
>for the security reason , is there anyone has thouhgts on how good and (or)
>how bad it can be if I remove it ? and what if I need this acccount later?
>can I put it back?
>
>Thanks a lot

Catelin Wang

2005-07-29, 9:23 am

Thanks a lot.

What if I uncheck the 'system administror' role in SQL Srver login, does ths
work the same?

"Catelin Wang" wrote:

> I am going to remove the BUILDIN\Administrato
r's log account as recommneded
> for the security reason , is there anyone has thouhgts on how good and (or)
> how bad it can be if I remove it ? and what if I need this acccount later?
> can I put it back?
>
> Thanks a lot
>

Sue Hoegemeier

2005-08-01, 3:23 am

Technically it's not the same as removing the account. When
you remove the group from the sysadmin server role, they can
still log into SQL Server but aren't sysadmins. If they
aren't added to any databases, server or database roles,
they would have whatever access the guest account has. Which
way to go depends on what you want to accomplish.

-Sue

On Fri, 29 Jul 2005 06:45:02 -0700, Catelin Wang
< CatelinWang@discussi
ons.microsoft.com> wrote:
[color=darkred]
>Thanks a lot.
>
>What if I uncheck the 'system administror' role in SQL Srver login, does ths
>work the same?
>
>
>"Catelin Wang" wrote:
>

Catelin Wang

2005-08-01, 11:23 am

Thanks Sue, your messages are very helpful.

"Sue Hoegemeier" wrote:

> Technically it's not the same as removing the account. When
> you remove the group from the sysadmin server role, they can
> still log into SQL Server but aren't sysadmins. If they
> aren't added to any databases, server or database roles,
> they would have whatever access the guest account has. Which
> way to go depends on what you want to accomplish.
>
> -Sue
>
> On Fri, 29 Jul 2005 06:45:02 -0700, Catelin Wang
> < CatelinWang@discussi
ons.microsoft.com> wrote:
>
>
>

Sponsored Links