BUILDIN\Administrator's login account

I am going to remove the BUILDIN\Administrator's log account as recommneded
for the security reason , is there anyone has thouhgts on how good and (or)
how bad it can be if I remove it ? and what if I need this acccount later?
can I put it back?
Thanks a lotI think it'll be better to rename it in Local Policy Editor rather than
remove it.
"Catelin Wang" <CatelinWang@.discussions.microsoft.com> ¼¶¼g©ó¶l¥ó·s»D:A3C2C86C-21BC-4A62-AE67-B8AE0B6ADAD8@.microsoft.com...
>I am going to remove the BUILDIN\Administrator's log account as recommneded
> for the security reason , is there anyone has thouhgts on how good and
> (or)
> how bad it can be if I remove it ? and what if I need this acccount later?
> can I put it back?
> Thanks a lot
>|||You can remove the builtin\administrators group from SQL
Server. However, under some scenarios, this can cause
problems. Whether you experience problems or not depends.
The following article has a more information section with
links to some issues that could come up:
INF: How to impede Windows NT administrators from
administering a clustered instance of SQL Server
http://support.microsoft.com/?id=263712
You can add the account back later by executing the
following in Query Analyzer:
EXEC sp_grantlogin 'BUILTIN\Administrators'
By default, the group is a member of the sysadmins sql
server role. If you wanted this back as well, you could
execute the following:
EXEC sp_addsrvrolemember 'BUILTIN\Administrators' ,
'sysadmin'
-Sue
On Thu, 28 Jul 2005 18:38:55 -0700, Catelin Wang
<CatelinWang@.discussions.microsoft.com> wrote:
>I am going to remove the BUILDIN\Administrator's log account as recommneded
>for the security reason , is there anyone has thouhgts on how good and (or)
>how bad it can be if I remove it ? and what if I need this acccount later?
>can I put it back?
>Thanks a lot|||Thanks a lot.
What if I uncheck the 'system administror' role in SQL Srver login, does ths
work the same?
"Catelin Wang" wrote:
> I am going to remove the BUILDIN\Administrator's log account as recommneded
> for the security reason , is there anyone has thouhgts on how good and (or)
> how bad it can be if I remove it ? and what if I need this acccount later?
> can I put it back?
> Thanks a lot
>|||Technically it's not the same as removing the account. When
you remove the group from the sysadmin server role, they can
still log into SQL Server but aren't sysadmins. If they
aren't added to any databases, server or database roles,
they would have whatever access the guest account has. Which
way to go depends on what you want to accomplish.
-Sue
On Fri, 29 Jul 2005 06:45:02 -0700, Catelin Wang
<CatelinWang@.discussions.microsoft.com> wrote:
>Thanks a lot.
>What if I uncheck the 'system administror' role in SQL Srver login, does ths
>work the same?
>
>"Catelin Wang" wrote:
>> I am going to remove the BUILDIN\Administrator's log account as recommneded
>> for the security reason , is there anyone has thouhgts on how good and (or)
>> how bad it can be if I remove it ? and what if I need this acccount later?
>> can I put it back?
>> Thanks a lot|||Thanks Sue, your messages are very helpful.
"Sue Hoegemeier" wrote:
> Technically it's not the same as removing the account. When
> you remove the group from the sysadmin server role, they can
> still log into SQL Server but aren't sysadmins. If they
> aren't added to any databases, server or database roles,
> they would have whatever access the guest account has. Which
> way to go depends on what you want to accomplish.
> -Sue
> On Fri, 29 Jul 2005 06:45:02 -0700, Catelin Wang
> <CatelinWang@.discussions.microsoft.com> wrote:
> >Thanks a lot.
> >
> >What if I uncheck the 'system administror' role in SQL Srver login, does ths
> >work the same?
> >
> >
> >"Catelin Wang" wrote:
> >
> >> I am going to remove the BUILDIN\Administrator's log account as recommneded
> >> for the security reason , is there anyone has thouhgts on how good and (or)
> >> how bad it can be if I remove it ? and what if I need this acccount later?
> >> can I put it back?
> >>
> >> Thanks a lot
> >>
>