BUILTIN\Administrators Account

Discussion in 'microsoft.public.sqlserver.security' started by tress, Jan 22, 2009.

  1. tress

    tress Guest

    Hi,

    I have a query abou the BUILTIN\Administrators Account, I have recently had
    a problem with a System Administrator not knowing what they were up to and
    adding a new maintenance task to my sql server installation 2005 on Windows
    NT machine to make backups that were a. being done, b.trying to do them at
    the wrong time, c.backing up databases that did not need to be backed up.
    I have read that you can stop them from doing this by removing the
    BUILTIN\Administrator account "with caution", is it not possible to deny the
    login of this account to the SQL Server through properties rather than
    removing it altogether?

    Thanks
     
    tress, Jan 22, 2009
    #1
    1. Advertisements

  2. tress

    Chris Wood Guest

    I am currently going thru an exercise to take the sysadmin authority from
    this group. When you install SQL2005 it creates this group and it makes all
    Windows local admins have sysadmin authority inside SQL. You do need at
    least a Windows account that has sysadmin to administer SQL. My plan is
    adding our DBA account as a sysadmin and then removing sysadmin from this
    group.

    HTH

    Chris
     
    Chris Wood, Jan 22, 2009
    #2
    1. Advertisements

  3. tress

    Uri Dimant Guest

    tress
    I'd remove sysadmin server role from this group and not remove the grout
    itself
     
    Uri Dimant, Jan 25, 2009
    #3
  4. I remove the BUILTIN\Administrators account from access to the SQL Server.
    The "caution" is to make sure that you have an appropriate group defined
    with the sysadmin rights, so that the SQL Server administrators can get in
    to do the needed work.

    Of course BUILTIN\Administrators is still an administrator of the Windows
    box that is running SQL Server.

    FWIW.
    RLF
     
    Russell Fields, Jan 26, 2009
    #4
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.