BULITIN\Administrator

Security Best Practices tell us to remove BULITIN\Administrator from
SQL Server Logins. Is this also true in SQL Server 2000 Cluster.
Many Thanks
John
Yes, clustering does not change that.
Cheers,
Rod
"John" <johnx02@.hotmail.com> wrote in message
news:a701f8e6.0406161039.6b7e9616@.posting.google.c om...
> Security Best Practices tell us to remove BULITIN\Administrator from
> SQL Server Logins. Is this also true in SQL Server 2000 Cluster.
> Many Thanks
> John
|||but you do have to make sure you add the service account for sql server &
sql server agent, as well as the windows cluster service, as sysadmin role
members and valid logins to the server.
Richard Waymire, MCSE, MCDBA
This posting is provided "AS IS" with no warranties, and confers no rights.
"Rodney R. Fournier [MVP]" <rod@.die.spam.die.nw-america.com> wrote in
message news:upYRYC$UEHA.2692@.TK2MSFTNGP09.phx.gbl...
> Yes, clustering does not change that.
> Cheers,
> Rod
> "John" <johnx02@.hotmail.com> wrote in message
> news:a701f8e6.0406161039.6b7e9616@.posting.google.c om...
>
|||Some people take remove to mean deny access. Do not do this. It will cause
all logins who are members of the group to fail. Use the sp_revokelogin to
remove it.
Rand
This posting is provided "as is" with no warranties and confers no rights.

BUILTIN\Administrators vs System Administrator

Hello all,

does someone know where to find information regarding what is accesible to a BUILTIN\Administrator which is not accesible to a System Administrator?

Somewhere I have read that a System Administrator can not see the "All users' folders (i.e. the collection of "My folder"s for all users of the Report Server) but I have also experienced a behaviour which has surprised me: as a System Administrator with all permissions I cann't even see folders that a BUILTIN\Administrator can.

Does it mean that a System Administrator can not really manage all the resources of a Report Server?

Any ideas will be welcomed. Many thanks.

Firstly I would like to ask from where you have read the information, rather than replying you to with generic answers in this topic.

As one of the best practices is to remove the Builtin\Administrators as a part of security breakdown involving the sysadmin role. By default (from installation), the NT group BUILTIN\Administrators is granted sysadmin rights to SQL Server because it is made a member of the syadmin role. The BUILTIN\Administrators group corresponds to the local Administrators group for the server.

Builtin\Administrator login

Hi All,
I have few questions about above mentioned login.
1. What is this login for?
2. Can I delete it without causing any problems? I don't want the network guys have the sysadmin role to the SQL Server.
Can you tell me what I need to do? Thanks.This is the login that is used by administrators on the local machine. It is handy in case you forget the sa password, and need to change it. In order to disable it, set up a DBA group, and add it to the sysadmin server role before doing anything else. Then you can safely drop the builtin administrators group. If you drop your DBA group from the domain after that, then all of your SQL Servers are auto-magically transmogrified into glorified server room space heaters.|||If you drop your DBA group from the domain after that, then all of your SQL Servers are auto-magically transmogrified into glorified server room space heaters.

LOL:D

Do you speak from experience? Or is this...ahem...second-hand knowledge?

Regards,

hmscott

Builtin\Administrator login

Hi All,
How can I tell what account SQL Agent configured to start up with? Local or domain?In Enterprise Mangler, right click on the SQL Server Agent and select Properties. If you can't connect to the server, look at the Service in Windows services, and click the "Log On" tab to see the login information.

-PatP|||I looked in Enterprise Manager and the radio button next to System Account is selected. Is it local or domain?|||Local. If it were a domain administrator, the domain name would be a prefix such as MyDomain\Administrator in the box.

-PatP|||Thank you.

BUILDIN\Administrator's login account

I am going to remove the BUILDIN\Administrator's log account as recommneded
for the security reason , is there anyone has thouhgts on how good and (or)
how bad it can be if I remove it ? and what if I need this acccount later?
can I put it back?
Thanks a lotI think it'll be better to rename it in Local Policy Editor rather than
remove it.
"Catelin Wang" <CatelinWang@.discussions.microsoft.com> glsD:A3C2C86C-21BC-4A62-AE6
7-B8AE0B6ADAD8@.microsoft.com...
>I am going to remove the BUILDIN\Administrator's log account as recommneded
> for the security reason , is there anyone has thouhgts on how good and
> (or)
> how bad it can be if I remove it ? and what if I need this acccount later?
> can I put it back?
> Thanks a lot
>|||You can remove the builtin\administrators group from SQL
Server. However, under some scenarios, this can cause
problems. Whether you experience problems or not depends.
The following article has a more information section with
links to some issues that could come up:
INF: How to impede Windows NT administrators from
administering a clustered instance of SQL Server
http://support.microsoft.com/?id=263712
You can add the account back later by executing the
following in Query Analyzer:
EXEC sp_grantlogin 'BUILTIN\Administrators'
By default, the group is a member of the sysadmins sql
server role. If you wanted this back as well, you could
execute the following:
EXEC sp_addsrvrolemember 'BUILTIN\Administrators' ,
'sysadmin'
-Sue
On Thu, 28 Jul 2005 18:38:55 -0700, Catelin Wang
<CatelinWang@.discussions.microsoft.com> wrote:

>I am going to remove the BUILDIN\Administrator's log account as recommneded
>for the security reason , is there anyone has thouhgts on how good and (or)
>how bad it can be if I remove it ? and what if I need this acccount later?
>can I put it back?
>Thanks a lot|||Thanks a lot.
What if I uncheck the 'system administror' role in SQL Srver login, does ths
work the same?
"Catelin Wang" wrote:

> I am going to remove the BUILDIN\Administrator's log account as recommnede
d
> for the security reason , is there anyone has thouhgts on how good and (or
)
> how bad it can be if I remove it ? and what if I need this acccount later?
> can I put it back?
> Thanks a lot
>|||Technically it's not the same as removing the account. When
you remove the group from the sysadmin server role, they can
still log into SQL Server but aren't sysadmins. If they
aren't added to any databases, server or database roles,
they would have whatever access the guest account has. Which
way to go depends on what you want to accomplish.
-Sue
On Fri, 29 Jul 2005 06:45:02 -0700, Catelin Wang
<CatelinWang@.discussions.microsoft.com> wrote:
[vbcol=seagreen]
>Thanks a lot.
>What if I uncheck the 'system administror' role in SQL Srver login, does th
s
>work the same?
>
>"Catelin Wang" wrote:
>|||Thanks Sue, your messages are very helpful.
"Sue Hoegemeier" wrote:

> Technically it's not the same as removing the account. When
> you remove the group from the sysadmin server role, they can
> still log into SQL Server but aren't sysadmins. If they
> aren't added to any databases, server or database roles,
> they would have whatever access the guest account has. Which
> way to go depends on what you want to accomplish.
> -Sue
> On Fri, 29 Jul 2005 06:45:02 -0700, Catelin Wang
> <CatelinWang@.discussions.microsoft.com> wrote:
>
>

BUILDIN\Administrator's login account

I am going to remove the BUILDIN\Administrator's log account as recommneded
for the security reason , is there anyone has thouhgts on how good and (or)
how bad it can be if I remove it ? and what if I need this acccount later?
can I put it back?
Thanks a lotI think it'll be better to rename it in Local Policy Editor rather than
remove it.
"Catelin Wang" <CatelinWang@.discussions.microsoft.com> ¼¶¼g©ó¶l¥ó·s»D:A3C2C86C-21BC-4A62-AE67-B8AE0B6ADAD8@.microsoft.com...
>I am going to remove the BUILDIN\Administrator's log account as recommneded
> for the security reason , is there anyone has thouhgts on how good and
> (or)
> how bad it can be if I remove it ? and what if I need this acccount later?
> can I put it back?
> Thanks a lot
>|||You can remove the builtin\administrators group from SQL
Server. However, under some scenarios, this can cause
problems. Whether you experience problems or not depends.
The following article has a more information section with
links to some issues that could come up:
INF: How to impede Windows NT administrators from
administering a clustered instance of SQL Server
http://support.microsoft.com/?id=263712
You can add the account back later by executing the
following in Query Analyzer:
EXEC sp_grantlogin 'BUILTIN\Administrators'
By default, the group is a member of the sysadmins sql
server role. If you wanted this back as well, you could
execute the following:
EXEC sp_addsrvrolemember 'BUILTIN\Administrators' ,
'sysadmin'
-Sue
On Thu, 28 Jul 2005 18:38:55 -0700, Catelin Wang
<CatelinWang@.discussions.microsoft.com> wrote:
>I am going to remove the BUILDIN\Administrator's log account as recommneded
>for the security reason , is there anyone has thouhgts on how good and (or)
>how bad it can be if I remove it ? and what if I need this acccount later?
>can I put it back?
>Thanks a lot|||Thanks a lot.
What if I uncheck the 'system administror' role in SQL Srver login, does ths
work the same?
"Catelin Wang" wrote:
> I am going to remove the BUILDIN\Administrator's log account as recommneded
> for the security reason , is there anyone has thouhgts on how good and (or)
> how bad it can be if I remove it ? and what if I need this acccount later?
> can I put it back?
> Thanks a lot
>|||Technically it's not the same as removing the account. When
you remove the group from the sysadmin server role, they can
still log into SQL Server but aren't sysadmins. If they
aren't added to any databases, server or database roles,
they would have whatever access the guest account has. Which
way to go depends on what you want to accomplish.
-Sue
On Fri, 29 Jul 2005 06:45:02 -0700, Catelin Wang
<CatelinWang@.discussions.microsoft.com> wrote:
>Thanks a lot.
>What if I uncheck the 'system administror' role in SQL Srver login, does ths
>work the same?
>
>"Catelin Wang" wrote:
>> I am going to remove the BUILDIN\Administrator's log account as recommneded
>> for the security reason , is there anyone has thouhgts on how good and (or)
>> how bad it can be if I remove it ? and what if I need this acccount later?
>> can I put it back?
>> Thanks a lot|||Thanks Sue, your messages are very helpful.
"Sue Hoegemeier" wrote:
> Technically it's not the same as removing the account. When
> you remove the group from the sysadmin server role, they can
> still log into SQL Server but aren't sysadmins. If they
> aren't added to any databases, server or database roles,
> they would have whatever access the guest account has. Which
> way to go depends on what you want to accomplish.
> -Sue
> On Fri, 29 Jul 2005 06:45:02 -0700, Catelin Wang
> <CatelinWang@.discussions.microsoft.com> wrote:
> >Thanks a lot.
> >
> >What if I uncheck the 'system administror' role in SQL Srver login, does ths
> >work the same?
> >
> >
> >"Catelin Wang" wrote:
> >
> >> I am going to remove the BUILDIN\Administrator's log account as recommneded
> >> for the security reason , is there anyone has thouhgts on how good and (or)
> >> how bad it can be if I remove it ? and what if I need this acccount later?
> >> can I put it back?
> >>
> >> Thanks a lot
> >>
>

BUILDIN\Administrator's login account

I am going to remove the BUILDIN\Administrator's log account as recommneded
for the security reason , is there anyone has thouhgts on how good and (or)
how bad it can be if I remove it ? and what if I need this acccount later?
can I put it back?
Thanks a lot
I think it'll be better to rename it in Local Policy Editor rather than
remove it.
"Catelin Wang" <CatelinWang@.discussions.microsoft.com> glsD:A3C2C86C-21BC-4A62-AE67-B8AE0B6ADAD8@.microsoft.com...
>I am going to remove the BUILDIN\Administrator's log account as recommneded
> for the security reason , is there anyone has thouhgts on how good and
> (or)
> how bad it can be if I remove it ? and what if I need this acccount later?
> can I put it back?
> Thanks a lot
>
|||You can remove the builtin\administrators group from SQL
Server. However, under some scenarios, this can cause
problems. Whether you experience problems or not depends.
The following article has a more information section with
links to some issues that could come up:
INF: How to impede Windows NT administrators from
administering a clustered instance of SQL Server
http://support.microsoft.com/?id=263712
You can add the account back later by executing the
following in Query Analyzer:
EXEC sp_grantlogin 'BUILTIN\Administrators'
By default, the group is a member of the sysadmins sql
server role. If you wanted this back as well, you could
execute the following:
EXEC sp_addsrvrolemember 'BUILTIN\Administrators' ,
'sysadmin'
-Sue
On Thu, 28 Jul 2005 18:38:55 -0700, Catelin Wang
<CatelinWang@.discussions.microsoft.com> wrote:

>I am going to remove the BUILDIN\Administrator's log account as recommneded
>for the security reason , is there anyone has thouhgts on how good and (or)
>how bad it can be if I remove it ? and what if I need this acccount later?
>can I put it back?
>Thanks a lot
|||Thanks a lot.
What if I uncheck the 'system administror' role in SQL Srver login, does ths
work the same?
"Catelin Wang" wrote:

> I am going to remove the BUILDIN\Administrator's log account as recommneded
> for the security reason , is there anyone has thouhgts on how good and (or)
> how bad it can be if I remove it ? and what if I need this acccount later?
> can I put it back?
> Thanks a lot
>
|||Technically it's not the same as removing the account. When
you remove the group from the sysadmin server role, they can
still log into SQL Server but aren't sysadmins. If they
aren't added to any databases, server or database roles,
they would have whatever access the guest account has. Which
way to go depends on what you want to accomplish.
-Sue
On Fri, 29 Jul 2005 06:45:02 -0700, Catelin Wang
<CatelinWang@.discussions.microsoft.com> wrote:
[vbcol=seagreen]
>Thanks a lot.
>What if I uncheck the 'system administror' role in SQL Srver login, does ths
>work the same?
>
>"Catelin Wang" wrote:
|||Thanks Sue, your messages are very helpful.
"Sue Hoegemeier" wrote:

> Technically it's not the same as removing the account. When
> you remove the group from the sysadmin server role, they can
> still log into SQL Server but aren't sysadmins. If they
> aren't added to any databases, server or database roles,
> they would have whatever access the guest account has. Which
> way to go depends on what you want to accomplish.
> -Sue
> On Fri, 29 Jul 2005 06:45:02 -0700, Catelin Wang
> <CatelinWang@.discussions.microsoft.com> wrote:
>
>