Security Best Practices tell us to remove BULITIN\Administrator from
SQL Server Logins. Is this also true in SQL Server 2000 Cluster.
Many Thanks
John
Yes, clustering does not change that.
Cheers,
Rod
"John" <johnx02@.hotmail.com> wrote in message
news:a701f8e6.0406161039.6b7e9616@.posting.google.c om...
> Security Best Practices tell us to remove BULITIN\Administrator from
> SQL Server Logins. Is this also true in SQL Server 2000 Cluster.
> Many Thanks
> John
|||but you do have to make sure you add the service account for sql server &
sql server agent, as well as the windows cluster service, as sysadmin role
members and valid logins to the server.
Richard Waymire, MCSE, MCDBA
This posting is provided "AS IS" with no warranties, and confers no rights.
"Rodney R. Fournier [MVP]" <rod@.die.spam.die.nw-america.com> wrote in
message news:upYRYC$UEHA.2692@.TK2MSFTNGP09.phx.gbl...
> Yes, clustering does not change that.
> Cheers,
> Rod
> "John" <johnx02@.hotmail.com> wrote in message
> news:a701f8e6.0406161039.6b7e9616@.posting.google.c om...
>
|||Some people take remove to mean deny access. Do not do this. It will cause
all logins who are members of the group to fail. Use the sp_revokelogin to
remove it.
Rand
This posting is provided "as is" with no warranties and confers no rights.
Showing posts with label logins. Show all posts
Showing posts with label logins. Show all posts
Thursday, February 16, 2012
BUILTIN\Amdministrators & sa login
Hi All ,
can i delete the 2 logins above ? tried deleting sa but could not
i actually deleted the BUILTIN\Administrators when i tried to access the
Enterprise Managers i could not connect anymore , how can i rectify this ?
what's the inital password for sa ? i changed it to sa after deleteing the
BUILTIN\Administrators and when i tried to use SQL server login with id sa &
pwd sa i got error "Login failed for user 'Sa' Reason : Not associated with a
trusted sql server connection' how can i rectify this as well ?
appreciate the advice from anyone
tks & rdgs
maxzsim wrote:
> Hi All ,
>
> can i delete the 2 logins above ? tried deleting sa but could not
You can't delete the "sa" account. Deleting the Adminsitrators group is
not a great idea because you can no longer easily assign users (like the
DBA) to the group for admin access. The group is meaningless if no one
is assigned, so leaving it there without any users should be fine.
> i actually deleted the BUILTIN\Administrators when i tried to access
> the Enterprise Managers i could not connect anymore , how can i
> rectify this ?
You're probably using a login to the server in the SQL EM registration
page that used to be in the administrator group. Why you would delete
the administrators group without first verifying you had a valid admin
account with which to manage the server is a little strange.
> what's the inital password for sa ? i changed it to sa after
> deleteing the BUILTIN\Administrators and when i tried to use SQL
> server login with id sa & pwd sa i got error "Login failed for user
> 'Sa' Reason : Not associated with a trusted sql server connection'
> how can i rectify this as well ?
>
Maybe your server is not set up for mixed-mode security. If not, you can
change the setting, but doing so I believe requires admin access. If you
have another admin account, you can log in and change the "sa" password.
If you don't know your "sa" password and don't have any other admin
accounts, you may be forced to rebuild the master database and reattach
your databases. The 'sa" password is set up during the installation and
has no default value. You could try using an empty password and see if
that works.
David G.
|||Hi David ,
tks for your advice i will try out. Actually i was trying to prevent
someone from loggin using the sa login id
rdgs
"David Gugick" wrote:
> maxzsim wrote:
> You can't delete the "sa" account. Deleting the Adminsitrators group is
> not a great idea because you can no longer easily assign users (like the
> DBA) to the group for admin access. The group is meaningless if no one
> is assigned, so leaving it there without any users should be fine.
>
> You're probably using a login to the server in the SQL EM registration
> page that used to be in the administrator group. Why you would delete
> the administrators group without first verifying you had a valid admin
> account with which to manage the server is a little strange.
>
> Maybe your server is not set up for mixed-mode security. If not, you can
> change the setting, but doing so I believe requires admin access. If you
> have another admin account, you can log in and change the "sa" password.
> If you don't know your "sa" password and don't have any other admin
> accounts, you may be forced to rebuild the master database and reattach
> your databases. The 'sa" password is set up during the installation and
> has no default value. You could try using an empty password and see if
> that works.
>
> --
> David G.
>
|||maxzsim wrote:
> Hi David ,
> tks for your advice i will try out. Actually i was trying to prevent
> someone from loggin using the sa login id
>
The best way to do that is set SQL Server up to use Integrated Security
only. Without SQL Security, no one could log on using "sa" even if they
knew the password. But you need the "sa" account there and the best way
to secure it is to give it a nasty password. You do need at least one
administrator to manage the server. It's better to use integrated
security for this and add the domain user into the Administrators group.
That way, if the employeee should leave and the login removed from the
server, the backup is to enable mixed-mode security and log in using the
"sa" account.
David Gugick
Imceda Software
www.imceda.com
can i delete the 2 logins above ? tried deleting sa but could not
i actually deleted the BUILTIN\Administrators when i tried to access the
Enterprise Managers i could not connect anymore , how can i rectify this ?
what's the inital password for sa ? i changed it to sa after deleteing the
BUILTIN\Administrators and when i tried to use SQL server login with id sa &
pwd sa i got error "Login failed for user 'Sa' Reason : Not associated with a
trusted sql server connection' how can i rectify this as well ?
appreciate the advice from anyone
tks & rdgs
maxzsim wrote:
> Hi All ,
>
> can i delete the 2 logins above ? tried deleting sa but could not
You can't delete the "sa" account. Deleting the Adminsitrators group is
not a great idea because you can no longer easily assign users (like the
DBA) to the group for admin access. The group is meaningless if no one
is assigned, so leaving it there without any users should be fine.
> i actually deleted the BUILTIN\Administrators when i tried to access
> the Enterprise Managers i could not connect anymore , how can i
> rectify this ?
You're probably using a login to the server in the SQL EM registration
page that used to be in the administrator group. Why you would delete
the administrators group without first verifying you had a valid admin
account with which to manage the server is a little strange.
> what's the inital password for sa ? i changed it to sa after
> deleteing the BUILTIN\Administrators and when i tried to use SQL
> server login with id sa & pwd sa i got error "Login failed for user
> 'Sa' Reason : Not associated with a trusted sql server connection'
> how can i rectify this as well ?
>
Maybe your server is not set up for mixed-mode security. If not, you can
change the setting, but doing so I believe requires admin access. If you
have another admin account, you can log in and change the "sa" password.
If you don't know your "sa" password and don't have any other admin
accounts, you may be forced to rebuild the master database and reattach
your databases. The 'sa" password is set up during the installation and
has no default value. You could try using an empty password and see if
that works.
David G.
|||Hi David ,
tks for your advice i will try out. Actually i was trying to prevent
someone from loggin using the sa login id
rdgs
"David Gugick" wrote:
> maxzsim wrote:
> You can't delete the "sa" account. Deleting the Adminsitrators group is
> not a great idea because you can no longer easily assign users (like the
> DBA) to the group for admin access. The group is meaningless if no one
> is assigned, so leaving it there without any users should be fine.
>
> You're probably using a login to the server in the SQL EM registration
> page that used to be in the administrator group. Why you would delete
> the administrators group without first verifying you had a valid admin
> account with which to manage the server is a little strange.
>
> Maybe your server is not set up for mixed-mode security. If not, you can
> change the setting, but doing so I believe requires admin access. If you
> have another admin account, you can log in and change the "sa" password.
> If you don't know your "sa" password and don't have any other admin
> accounts, you may be forced to rebuild the master database and reattach
> your databases. The 'sa" password is set up during the installation and
> has no default value. You could try using an empty password and see if
> that works.
>
> --
> David G.
>
|||maxzsim wrote:
> Hi David ,
> tks for your advice i will try out. Actually i was trying to prevent
> someone from loggin using the sa login id
>
The best way to do that is set SQL Server up to use Integrated Security
only. Without SQL Security, no one could log on using "sa" even if they
knew the password. But you need the "sa" account there and the best way
to secure it is to give it a nasty password. You do need at least one
administrator to manage the server. It's better to use integrated
security for this and add the domain user into the Administrators group.
That way, if the employeee should leave and the login removed from the
server, the backup is to enable mixed-mode security and log in using the
"sa" account.
David Gugick
Imceda Software
www.imceda.com
BUILTIN\Amdministrators & sa login
Hi All ,
can i delete the 2 logins above ? tried deleting sa but could not
i actually deleted the BUILTIN\Administrators when i tried to access the
Enterprise Managers i could not connect anymore , how can i rectify this ?
what's the inital password for sa ? i changed it to sa after deleteing the
BUILTIN\Administrators and when i tried to use SQL server login with id sa &
pwd sa i got error "Login failed for user 'Sa' Reason : Not associated with a
trusted sql server connection' how can i rectify this as well ?
appreciate the advice from anyone
tks & rdgsmaxzsim wrote:
> Hi All ,
>
> can i delete the 2 logins above ? tried deleting sa but could not
You can't delete the "sa" account. Deleting the Adminsitrators group is
not a great idea because you can no longer easily assign users (like the
DBA) to the group for admin access. The group is meaningless if no one
is assigned, so leaving it there without any users should be fine.
> i actually deleted the BUILTIN\Administrators when i tried to access
> the Enterprise Managers i could not connect anymore , how can i
> rectify this ?
You're probably using a login to the server in the SQL EM registration
page that used to be in the administrator group. Why you would delete
the administrators group without first verifying you had a valid admin
account with which to manage the server is a little strange.
> what's the inital password for sa ? i changed it to sa after
> deleteing the BUILTIN\Administrators and when i tried to use SQL
> server login with id sa & pwd sa i got error "Login failed for user
> 'Sa' Reason : Not associated with a trusted sql server connection'
> how can i rectify this as well ?
>
Maybe your server is not set up for mixed-mode security. If not, you can
change the setting, but doing so I believe requires admin access. If you
have another admin account, you can log in and change the "sa" password.
If you don't know your "sa" password and don't have any other admin
accounts, you may be forced to rebuild the master database and reattach
your databases. The 'sa" password is set up during the installation and
has no default value. You could try using an empty password and see if
that works.
David G.|||Hi David ,
tks for your advice i will try out. Actually i was trying to prevent
someone from loggin using the sa login id
rdgs
"David Gugick" wrote:
> maxzsim wrote:
> > Hi All ,
> >
> >
> > can i delete the 2 logins above ? tried deleting sa but could not
> You can't delete the "sa" account. Deleting the Adminsitrators group is
> not a great idea because you can no longer easily assign users (like the
> DBA) to the group for admin access. The group is meaningless if no one
> is assigned, so leaving it there without any users should be fine.
> >
> > i actually deleted the BUILTIN\Administrators when i tried to access
> > the Enterprise Managers i could not connect anymore , how can i
> > rectify this ?
> You're probably using a login to the server in the SQL EM registration
> page that used to be in the administrator group. Why you would delete
> the administrators group without first verifying you had a valid admin
> account with which to manage the server is a little strange.
> >
> > what's the inital password for sa ? i changed it to sa after
> > deleteing the BUILTIN\Administrators and when i tried to use SQL
> > server login with id sa & pwd sa i got error "Login failed for user
> > 'Sa' Reason : Not associated with a trusted sql server connection'
> > how can i rectify this as well ?
> >
> Maybe your server is not set up for mixed-mode security. If not, you can
> change the setting, but doing so I believe requires admin access. If you
> have another admin account, you can log in and change the "sa" password.
> If you don't know your "sa" password and don't have any other admin
> accounts, you may be forced to rebuild the master database and reattach
> your databases. The 'sa" password is set up during the installation and
> has no default value. You could try using an empty password and see if
> that works.
>
> --
> David G.
>|||maxzsim wrote:
> Hi David ,
> tks for your advice i will try out. Actually i was trying to prevent
> someone from loggin using the sa login id
>
The best way to do that is set SQL Server up to use Integrated Security
only. Without SQL Security, no one could log on using "sa" even if they
knew the password. But you need the "sa" account there and the best way
to secure it is to give it a nasty password. You do need at least one
administrator to manage the server. It's better to use integrated
security for this and add the domain user into the Administrators group.
That way, if the employeee should leave and the login removed from the
server, the backup is to enable mixed-mode security and log in using the
"sa" account.
--
David Gugick
Imceda Software
www.imceda.com
can i delete the 2 logins above ? tried deleting sa but could not
i actually deleted the BUILTIN\Administrators when i tried to access the
Enterprise Managers i could not connect anymore , how can i rectify this ?
what's the inital password for sa ? i changed it to sa after deleteing the
BUILTIN\Administrators and when i tried to use SQL server login with id sa &
pwd sa i got error "Login failed for user 'Sa' Reason : Not associated with a
trusted sql server connection' how can i rectify this as well ?
appreciate the advice from anyone
tks & rdgsmaxzsim wrote:
> Hi All ,
>
> can i delete the 2 logins above ? tried deleting sa but could not
You can't delete the "sa" account. Deleting the Adminsitrators group is
not a great idea because you can no longer easily assign users (like the
DBA) to the group for admin access. The group is meaningless if no one
is assigned, so leaving it there without any users should be fine.
> i actually deleted the BUILTIN\Administrators when i tried to access
> the Enterprise Managers i could not connect anymore , how can i
> rectify this ?
You're probably using a login to the server in the SQL EM registration
page that used to be in the administrator group. Why you would delete
the administrators group without first verifying you had a valid admin
account with which to manage the server is a little strange.
> what's the inital password for sa ? i changed it to sa after
> deleteing the BUILTIN\Administrators and when i tried to use SQL
> server login with id sa & pwd sa i got error "Login failed for user
> 'Sa' Reason : Not associated with a trusted sql server connection'
> how can i rectify this as well ?
>
Maybe your server is not set up for mixed-mode security. If not, you can
change the setting, but doing so I believe requires admin access. If you
have another admin account, you can log in and change the "sa" password.
If you don't know your "sa" password and don't have any other admin
accounts, you may be forced to rebuild the master database and reattach
your databases. The 'sa" password is set up during the installation and
has no default value. You could try using an empty password and see if
that works.
David G.|||Hi David ,
tks for your advice i will try out. Actually i was trying to prevent
someone from loggin using the sa login id
rdgs
"David Gugick" wrote:
> maxzsim wrote:
> > Hi All ,
> >
> >
> > can i delete the 2 logins above ? tried deleting sa but could not
> You can't delete the "sa" account. Deleting the Adminsitrators group is
> not a great idea because you can no longer easily assign users (like the
> DBA) to the group for admin access. The group is meaningless if no one
> is assigned, so leaving it there without any users should be fine.
> >
> > i actually deleted the BUILTIN\Administrators when i tried to access
> > the Enterprise Managers i could not connect anymore , how can i
> > rectify this ?
> You're probably using a login to the server in the SQL EM registration
> page that used to be in the administrator group. Why you would delete
> the administrators group without first verifying you had a valid admin
> account with which to manage the server is a little strange.
> >
> > what's the inital password for sa ? i changed it to sa after
> > deleteing the BUILTIN\Administrators and when i tried to use SQL
> > server login with id sa & pwd sa i got error "Login failed for user
> > 'Sa' Reason : Not associated with a trusted sql server connection'
> > how can i rectify this as well ?
> >
> Maybe your server is not set up for mixed-mode security. If not, you can
> change the setting, but doing so I believe requires admin access. If you
> have another admin account, you can log in and change the "sa" password.
> If you don't know your "sa" password and don't have any other admin
> accounts, you may be forced to rebuild the master database and reattach
> your databases. The 'sa" password is set up during the installation and
> has no default value. You could try using an empty password and see if
> that works.
>
> --
> David G.
>|||maxzsim wrote:
> Hi David ,
> tks for your advice i will try out. Actually i was trying to prevent
> someone from loggin using the sa login id
>
The best way to do that is set SQL Server up to use Integrated Security
only. Without SQL Security, no one could log on using "sa" even if they
knew the password. But you need the "sa" account there and the best way
to secure it is to give it a nasty password. You do need at least one
administrator to manage the server. It's better to use integrated
security for this and add the domain user into the Administrators group.
That way, if the employeee should leave and the login removed from the
server, the backup is to enable mixed-mode security and log in using the
"sa" account.
--
David Gugick
Imceda Software
www.imceda.com
BUILTIN\Amdministrators & sa login
Hi All ,
can i delete the 2 logins above ? tried deleting sa but could not
i actually deleted the BUILTIN\Administrators when i tried to access the
Enterprise Managers i could not connect anymore , how can i rectify this ?
what's the inital password for sa ? i changed it to sa after deleteing the
BUILTIN\Administrators and when i tried to use SQL server login with id sa
&
pwd sa i got error "Login failed for user 'Sa' Reason : Not associated with
a
trusted sql server connection' how can i rectify this as well ?
appreciate the advice from anyone
tks & rdgsmaxzsim wrote:
> Hi All ,
>
> can i delete the 2 logins above ? tried deleting sa but could not
You can't delete the "sa" account. Deleting the Adminsitrators group is
not a great idea because you can no longer easily assign users (like the
DBA) to the group for admin access. The group is meaningless if no one
is assigned, so leaving it there without any users should be fine.
> i actually deleted the BUILTIN\Administrators when i tried to access
> the Enterprise Managers i could not connect anymore , how can i
> rectify this ?
You're probably using a login to the server in the SQL EM registration
page that used to be in the administrator group. Why you would delete
the administrators group without first verifying you had a valid admin
account with which to manage the server is a little strange.
> what's the inital password for sa ? i changed it to sa after
> deleteing the BUILTIN\Administrators and when i tried to use SQL
> server login with id sa & pwd sa i got error "Login failed for user
> 'Sa' Reason : Not associated with a trusted sql server connection'
> how can i rectify this as well ?
>
Maybe your server is not set up for mixed-mode security. If not, you can
change the setting, but doing so I believe requires admin access. If you
have another admin account, you can log in and change the "sa" password.
If you don't know your "sa" password and don't have any other admin
accounts, you may be forced to rebuild the master database and reattach
your databases. The 'sa" password is set up during the installation and
has no default value. You could try using an empty password and see if
that works.
David G.|||Hi David ,
tks for your advice i will try out. Actually i was trying to prevent
someone from loggin using the sa login id
rdgs
"David Gugick" wrote:
> maxzsim wrote:
> You can't delete the "sa" account. Deleting the Adminsitrators group is
> not a great idea because you can no longer easily assign users (like the
> DBA) to the group for admin access. The group is meaningless if no one
> is assigned, so leaving it there without any users should be fine.
>
> You're probably using a login to the server in the SQL EM registration
> page that used to be in the administrator group. Why you would delete
> the administrators group without first verifying you had a valid admin
> account with which to manage the server is a little strange.
>
> Maybe your server is not set up for mixed-mode security. If not, you can
> change the setting, but doing so I believe requires admin access. If you
> have another admin account, you can log in and change the "sa" password.
> If you don't know your "sa" password and don't have any other admin
> accounts, you may be forced to rebuild the master database and reattach
> your databases. The 'sa" password is set up during the installation and
> has no default value. You could try using an empty password and see if
> that works.
>
> --
> David G.
>|||maxzsim wrote:
> Hi David ,
> tks for your advice i will try out. Actually i was trying to prevent
> someone from loggin using the sa login id
>
The best way to do that is set SQL Server up to use Integrated Security
only. Without SQL Security, no one could log on using "sa" even if they
knew the password. But you need the "sa" account there and the best way
to secure it is to give it a nasty password. You do need at least one
administrator to manage the server. It's better to use integrated
security for this and add the domain user into the Administrators group.
That way, if the employeee should leave and the login removed from the
server, the backup is to enable mixed-mode security and log in using the
"sa" account.
David Gugick
Imceda Software
www.imceda.com
can i delete the 2 logins above ? tried deleting sa but could not
i actually deleted the BUILTIN\Administrators when i tried to access the
Enterprise Managers i could not connect anymore , how can i rectify this ?
what's the inital password for sa ? i changed it to sa after deleteing the
BUILTIN\Administrators and when i tried to use SQL server login with id sa
&
pwd sa i got error "Login failed for user 'Sa' Reason : Not associated with
a
trusted sql server connection' how can i rectify this as well ?
appreciate the advice from anyone
tks & rdgsmaxzsim wrote:
> Hi All ,
>
> can i delete the 2 logins above ? tried deleting sa but could not
You can't delete the "sa" account. Deleting the Adminsitrators group is
not a great idea because you can no longer easily assign users (like the
DBA) to the group for admin access. The group is meaningless if no one
is assigned, so leaving it there without any users should be fine.
> i actually deleted the BUILTIN\Administrators when i tried to access
> the Enterprise Managers i could not connect anymore , how can i
> rectify this ?
You're probably using a login to the server in the SQL EM registration
page that used to be in the administrator group. Why you would delete
the administrators group without first verifying you had a valid admin
account with which to manage the server is a little strange.
> what's the inital password for sa ? i changed it to sa after
> deleteing the BUILTIN\Administrators and when i tried to use SQL
> server login with id sa & pwd sa i got error "Login failed for user
> 'Sa' Reason : Not associated with a trusted sql server connection'
> how can i rectify this as well ?
>
Maybe your server is not set up for mixed-mode security. If not, you can
change the setting, but doing so I believe requires admin access. If you
have another admin account, you can log in and change the "sa" password.
If you don't know your "sa" password and don't have any other admin
accounts, you may be forced to rebuild the master database and reattach
your databases. The 'sa" password is set up during the installation and
has no default value. You could try using an empty password and see if
that works.
David G.|||Hi David ,
tks for your advice i will try out. Actually i was trying to prevent
someone from loggin using the sa login id
rdgs
"David Gugick" wrote:
> maxzsim wrote:
> You can't delete the "sa" account. Deleting the Adminsitrators group is
> not a great idea because you can no longer easily assign users (like the
> DBA) to the group for admin access. The group is meaningless if no one
> is assigned, so leaving it there without any users should be fine.
>
> You're probably using a login to the server in the SQL EM registration
> page that used to be in the administrator group. Why you would delete
> the administrators group without first verifying you had a valid admin
> account with which to manage the server is a little strange.
>
> Maybe your server is not set up for mixed-mode security. If not, you can
> change the setting, but doing so I believe requires admin access. If you
> have another admin account, you can log in and change the "sa" password.
> If you don't know your "sa" password and don't have any other admin
> accounts, you may be forced to rebuild the master database and reattach
> your databases. The 'sa" password is set up during the installation and
> has no default value. You could try using an empty password and see if
> that works.
>
> --
> David G.
>|||maxzsim wrote:
> Hi David ,
> tks for your advice i will try out. Actually i was trying to prevent
> someone from loggin using the sa login id
>
The best way to do that is set SQL Server up to use Integrated Security
only. Without SQL Security, no one could log on using "sa" even if they
knew the password. But you need the "sa" account there and the best way
to secure it is to give it a nasty password. You do need at least one
administrator to manage the server. It's better to use integrated
security for this and add the domain user into the Administrators group.
That way, if the employeee should leave and the login removed from the
server, the backup is to enable mixed-mode security and log in using the
"sa" account.
David Gugick
Imceda Software
www.imceda.com
Tuesday, February 14, 2012
Built-In Administrators disabled! Please help!
We're in a big mess here:
One of our groups has taken it upon themselves to cleanup some of their SQL
servers of old and unwanted logins. The first thing to go on the first
machine was the 'built-in administrators' group. Now, the SQL server is
unreachable. Can't register to another machine, can't make changes, NOTHING
.
Can someone provide some guidance to enabling the account, please?
Also, I wasn't aware that disabling the built-in would cause this problem,
especially since we have alternate accounts that act as db owners and
administrators. is the built-in account somehing we should just put on the
side and leave alone? Thanks!add a login account for the Local System account
using sp_grantlogin [NT Authority\System] and ensure that the login acco
unt
is a member of the sysadmin fixed server role.
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"D Lee" <DLee@.discussions.microsoft.com> wrote in message
news:4FC1DBEE-21BE-4B9F-9B99-AA616A5ACB26@.microsoft.com...
> We're in a big mess here:
> One of our groups has taken it upon themselves to cleanup some of their
> SQL
> servers of old and unwanted logins. The first thing to go on the first
> machine was the 'built-in administrators' group. Now, the SQL server is
> unreachable. Can't register to another machine, can't make changes,
> NOTHING.
> Can someone provide some guidance to enabling the account, please?
> Also, I wasn't aware that disabling the built-in would cause this problem,
> especially since we have alternate accounts that act as db owners and
> administrators. is the built-in account somehing we should just put on
> the
> side and leave alone? Thanks!|||hillary's idea sounds right to me. I will add that disabling the local
admins is a great security idea but the genius left out a step.
Create a SQL Server Administrators group in the domain. Add that group to
the local administrators group on the box. Add that group to the SQL Server
and make it a sysadmin. NOW take out the local administrators and you'll be
fine.
BTW: don't forget to add people to the SQL Server Administrators group.
d.
"D Lee" <DLee@.discussions.microsoft.com> wrote in message
news:4FC1DBEE-21BE-4B9F-9B99-AA616A5ACB26@.microsoft.com...
> We're in a big mess here:
> One of our groups has taken it upon themselves to cleanup some of their
SQL
> servers of old and unwanted logins. The first thing to go on the first
> machine was the 'built-in administrators' group. Now, the SQL server is
> unreachable. Can't register to another machine, can't make changes,
NOTHING.
> Can someone provide some guidance to enabling the account, please?
> Also, I wasn't aware that disabling the built-in would cause this problem,
> especially since we have alternate accounts that act as db owners and
> administrators. is the built-in account somehing we should just put on
the
> side and leave alone? Thanks!
One of our groups has taken it upon themselves to cleanup some of their SQL
servers of old and unwanted logins. The first thing to go on the first
machine was the 'built-in administrators' group. Now, the SQL server is
unreachable. Can't register to another machine, can't make changes, NOTHING
.
Can someone provide some guidance to enabling the account, please?
Also, I wasn't aware that disabling the built-in would cause this problem,
especially since we have alternate accounts that act as db owners and
administrators. is the built-in account somehing we should just put on the
side and leave alone? Thanks!add a login account for the Local System account
using sp_grantlogin [NT Authority\System] and ensure that the login acco
unt
is a member of the sysadmin fixed server role.
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"D Lee" <DLee@.discussions.microsoft.com> wrote in message
news:4FC1DBEE-21BE-4B9F-9B99-AA616A5ACB26@.microsoft.com...
> We're in a big mess here:
> One of our groups has taken it upon themselves to cleanup some of their
> SQL
> servers of old and unwanted logins. The first thing to go on the first
> machine was the 'built-in administrators' group. Now, the SQL server is
> unreachable. Can't register to another machine, can't make changes,
> NOTHING.
> Can someone provide some guidance to enabling the account, please?
> Also, I wasn't aware that disabling the built-in would cause this problem,
> especially since we have alternate accounts that act as db owners and
> administrators. is the built-in account somehing we should just put on
> the
> side and leave alone? Thanks!|||hillary's idea sounds right to me. I will add that disabling the local
admins is a great security idea but the genius left out a step.
Create a SQL Server Administrators group in the domain. Add that group to
the local administrators group on the box. Add that group to the SQL Server
and make it a sysadmin. NOW take out the local administrators and you'll be
fine.
BTW: don't forget to add people to the SQL Server Administrators group.
d.
"D Lee" <DLee@.discussions.microsoft.com> wrote in message
news:4FC1DBEE-21BE-4B9F-9B99-AA616A5ACB26@.microsoft.com...
> We're in a big mess here:
> One of our groups has taken it upon themselves to cleanup some of their
SQL
> servers of old and unwanted logins. The first thing to go on the first
> machine was the 'built-in administrators' group. Now, the SQL server is
> unreachable. Can't register to another machine, can't make changes,
NOTHING.
> Can someone provide some guidance to enabling the account, please?
> Also, I wasn't aware that disabling the built-in would cause this problem,
> especially since we have alternate accounts that act as db owners and
> administrators. is the built-in account somehing we should just put on
the
> side and leave alone? Thanks!
Built-In Administrators disabled! Please help!
We're in a big mess here:
One of our groups has taken it upon themselves to cleanup some of their SQL
servers of old and unwanted logins. The first thing to go on the first
machine was the 'built-in administrators' group. Now, the SQL server is
unreachable. Can't register to another machine, can't make changes, NOTHING.
Can someone provide some guidance to enabling the account, please?
Also, I wasn't aware that disabling the built-in would cause this problem,
especially since we have alternate accounts that act as db owners and
administrators. is the built-in account somehing we should just put on the
side and leave alone? Thanks!
add a login account for the Local System account
using sp_grantlogin [NT Authority\System] and ensure that the login account
is a member of the sysadmin fixed server role.
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"D Lee" <DLee@.discussions.microsoft.com> wrote in message
news:4FC1DBEE-21BE-4B9F-9B99-AA616A5ACB26@.microsoft.com...
> We're in a big mess here:
> One of our groups has taken it upon themselves to cleanup some of their
> SQL
> servers of old and unwanted logins. The first thing to go on the first
> machine was the 'built-in administrators' group. Now, the SQL server is
> unreachable. Can't register to another machine, can't make changes,
> NOTHING.
> Can someone provide some guidance to enabling the account, please?
> Also, I wasn't aware that disabling the built-in would cause this problem,
> especially since we have alternate accounts that act as db owners and
> administrators. is the built-in account somehing we should just put on
> the
> side and leave alone? Thanks!
|||hillary's idea sounds right to me. I will add that disabling the local
admins is a great security idea but the genius left out a step.
Create a SQL Server Administrators group in the domain. Add that group to
the local administrators group on the box. Add that group to the SQL Server
and make it a sysadmin. NOW take out the local administrators and you'll be
fine.
BTW: don't forget to add people to the SQL Server Administrators group.
d.
"D Lee" <DLee@.discussions.microsoft.com> wrote in message
news:4FC1DBEE-21BE-4B9F-9B99-AA616A5ACB26@.microsoft.com...
> We're in a big mess here:
> One of our groups has taken it upon themselves to cleanup some of their
SQL
> servers of old and unwanted logins. The first thing to go on the first
> machine was the 'built-in administrators' group. Now, the SQL server is
> unreachable. Can't register to another machine, can't make changes,
NOTHING.
> Can someone provide some guidance to enabling the account, please?
> Also, I wasn't aware that disabling the built-in would cause this problem,
> especially since we have alternate accounts that act as db owners and
> administrators. is the built-in account somehing we should just put on
the
> side and leave alone? Thanks!
One of our groups has taken it upon themselves to cleanup some of their SQL
servers of old and unwanted logins. The first thing to go on the first
machine was the 'built-in administrators' group. Now, the SQL server is
unreachable. Can't register to another machine, can't make changes, NOTHING.
Can someone provide some guidance to enabling the account, please?
Also, I wasn't aware that disabling the built-in would cause this problem,
especially since we have alternate accounts that act as db owners and
administrators. is the built-in account somehing we should just put on the
side and leave alone? Thanks!
add a login account for the Local System account
using sp_grantlogin [NT Authority\System] and ensure that the login account
is a member of the sysadmin fixed server role.
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"D Lee" <DLee@.discussions.microsoft.com> wrote in message
news:4FC1DBEE-21BE-4B9F-9B99-AA616A5ACB26@.microsoft.com...
> We're in a big mess here:
> One of our groups has taken it upon themselves to cleanup some of their
> SQL
> servers of old and unwanted logins. The first thing to go on the first
> machine was the 'built-in administrators' group. Now, the SQL server is
> unreachable. Can't register to another machine, can't make changes,
> NOTHING.
> Can someone provide some guidance to enabling the account, please?
> Also, I wasn't aware that disabling the built-in would cause this problem,
> especially since we have alternate accounts that act as db owners and
> administrators. is the built-in account somehing we should just put on
> the
> side and leave alone? Thanks!
|||hillary's idea sounds right to me. I will add that disabling the local
admins is a great security idea but the genius left out a step.
Create a SQL Server Administrators group in the domain. Add that group to
the local administrators group on the box. Add that group to the SQL Server
and make it a sysadmin. NOW take out the local administrators and you'll be
fine.
BTW: don't forget to add people to the SQL Server Administrators group.
d.
"D Lee" <DLee@.discussions.microsoft.com> wrote in message
news:4FC1DBEE-21BE-4B9F-9B99-AA616A5ACB26@.microsoft.com...
> We're in a big mess here:
> One of our groups has taken it upon themselves to cleanup some of their
SQL
> servers of old and unwanted logins. The first thing to go on the first
> machine was the 'built-in administrators' group. Now, the SQL server is
> unreachable. Can't register to another machine, can't make changes,
NOTHING.
> Can someone provide some guidance to enabling the account, please?
> Also, I wasn't aware that disabling the built-in would cause this problem,
> especially since we have alternate accounts that act as db owners and
> administrators. is the built-in account somehing we should just put on
the
> side and leave alone? Thanks!
Built-In Administrators disabled! Please help!
We're in a big mess here:
One of our groups has taken it upon themselves to cleanup some of their SQL
servers of old and unwanted logins. The first thing to go on the first
machine was the 'built-in administrators' group. Now, the SQL server is
unreachable. Can't register to another machine, can't make changes, NOTHING.
Can someone provide some guidance to enabling the account, please?
Also, I wasn't aware that disabling the built-in would cause this problem,
especially since we have alternate accounts that act as db owners and
administrators. is the built-in account somehing we should just put on the
side and leave alone? Thanks!add a login account for the Local System account
using sp_grantlogin [NT Authority\System] and ensure that the login account
is a member of the sysadmin fixed server role.
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"D Lee" <DLee@.discussions.microsoft.com> wrote in message
news:4FC1DBEE-21BE-4B9F-9B99-AA616A5ACB26@.microsoft.com...
> We're in a big mess here:
> One of our groups has taken it upon themselves to cleanup some of their
> SQL
> servers of old and unwanted logins. The first thing to go on the first
> machine was the 'built-in administrators' group. Now, the SQL server is
> unreachable. Can't register to another machine, can't make changes,
> NOTHING.
> Can someone provide some guidance to enabling the account, please?
> Also, I wasn't aware that disabling the built-in would cause this problem,
> especially since we have alternate accounts that act as db owners and
> administrators. is the built-in account somehing we should just put on
> the
> side and leave alone? Thanks!|||hillary's idea sounds right to me. I will add that disabling the local
admins is a great security idea but the genius left out a step.
Create a SQL Server Administrators group in the domain. Add that group to
the local administrators group on the box. Add that group to the SQL Server
and make it a sysadmin. NOW take out the local administrators and you'll be
fine.
BTW: don't forget to add people to the SQL Server Administrators group.
d.
"D Lee" <DLee@.discussions.microsoft.com> wrote in message
news:4FC1DBEE-21BE-4B9F-9B99-AA616A5ACB26@.microsoft.com...
> We're in a big mess here:
> One of our groups has taken it upon themselves to cleanup some of their
SQL
> servers of old and unwanted logins. The first thing to go on the first
> machine was the 'built-in administrators' group. Now, the SQL server is
> unreachable. Can't register to another machine, can't make changes,
NOTHING.
> Can someone provide some guidance to enabling the account, please?
> Also, I wasn't aware that disabling the built-in would cause this problem,
> especially since we have alternate accounts that act as db owners and
> administrators. is the built-in account somehing we should just put on
the
> side and leave alone? Thanks!
One of our groups has taken it upon themselves to cleanup some of their SQL
servers of old and unwanted logins. The first thing to go on the first
machine was the 'built-in administrators' group. Now, the SQL server is
unreachable. Can't register to another machine, can't make changes, NOTHING.
Can someone provide some guidance to enabling the account, please?
Also, I wasn't aware that disabling the built-in would cause this problem,
especially since we have alternate accounts that act as db owners and
administrators. is the built-in account somehing we should just put on the
side and leave alone? Thanks!add a login account for the Local System account
using sp_grantlogin [NT Authority\System] and ensure that the login account
is a member of the sysadmin fixed server role.
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"D Lee" <DLee@.discussions.microsoft.com> wrote in message
news:4FC1DBEE-21BE-4B9F-9B99-AA616A5ACB26@.microsoft.com...
> We're in a big mess here:
> One of our groups has taken it upon themselves to cleanup some of their
> SQL
> servers of old and unwanted logins. The first thing to go on the first
> machine was the 'built-in administrators' group. Now, the SQL server is
> unreachable. Can't register to another machine, can't make changes,
> NOTHING.
> Can someone provide some guidance to enabling the account, please?
> Also, I wasn't aware that disabling the built-in would cause this problem,
> especially since we have alternate accounts that act as db owners and
> administrators. is the built-in account somehing we should just put on
> the
> side and leave alone? Thanks!|||hillary's idea sounds right to me. I will add that disabling the local
admins is a great security idea but the genius left out a step.
Create a SQL Server Administrators group in the domain. Add that group to
the local administrators group on the box. Add that group to the SQL Server
and make it a sysadmin. NOW take out the local administrators and you'll be
fine.
BTW: don't forget to add people to the SQL Server Administrators group.
d.
"D Lee" <DLee@.discussions.microsoft.com> wrote in message
news:4FC1DBEE-21BE-4B9F-9B99-AA616A5ACB26@.microsoft.com...
> We're in a big mess here:
> One of our groups has taken it upon themselves to cleanup some of their
SQL
> servers of old and unwanted logins. The first thing to go on the first
> machine was the 'built-in administrators' group. Now, the SQL server is
> unreachable. Can't register to another machine, can't make changes,
NOTHING.
> Can someone provide some guidance to enabling the account, please?
> Also, I wasn't aware that disabling the built-in would cause this problem,
> especially since we have alternate accounts that act as db owners and
> administrators. is the built-in account somehing we should just put on
the
> side and leave alone? Thanks!
builtin admin - OOOPS
Lets say a dba removes the builtin admin group from the sql server in haste.
They donâ't have any other logins with sysadmin rights, and they donâ't know
the SA password. How would they get sysadmin rights back?It would be difficult to start the services using some service account if there is no service
account with sysadmin privileges. For instance, Agent refuses to start unless it is sysadmin. Worst
case, you use LocalSystem as service account, then it is more difficult since you cannot use this
interactively. In that case, I guess you are in for a rebuild of the system databases.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://sqlblog.com/blogs/tibor_karaszi
"Jason" <Jason@.discussions.microsoft.com> wrote in message
news:4ED73AA6-A4A1-452E-877B-2135C0804FC7@.microsoft.com...
> Lets say a dba removes the builtin admin group from the sql server in haste.
> They donâ't have any other logins with sysadmin rights, and they donâ't know
> the SA password. How would they get sysadmin rights back?
They donâ't have any other logins with sysadmin rights, and they donâ't know
the SA password. How would they get sysadmin rights back?It would be difficult to start the services using some service account if there is no service
account with sysadmin privileges. For instance, Agent refuses to start unless it is sysadmin. Worst
case, you use LocalSystem as service account, then it is more difficult since you cannot use this
interactively. In that case, I guess you are in for a rebuild of the system databases.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://sqlblog.com/blogs/tibor_karaszi
"Jason" <Jason@.discussions.microsoft.com> wrote in message
news:4ED73AA6-A4A1-452E-877B-2135C0804FC7@.microsoft.com...
> Lets say a dba removes the builtin admin group from the sql server in haste.
> They donâ't have any other logins with sysadmin rights, and they donâ't know
> the SA password. How would they get sysadmin rights back?
Subscribe to:
Posts (Atom)