Help - removing NT Admin Group from sa role

Help - removing NT Admin Group from sa role

Post by Paul » Wed, 31 Oct 2001 00:36:33



Hello,

I am trying to remove my NT Administrators Group from my
sysadmin role, as I do not want my NT Administrators to
have sa access.  What steps do I need to take? I have
already removed all of the users/groups from my sysadmin
role except for sa and a couple DBA users.   What is the
name of the NT Admin Group?  Additionaly I have a Login
called BuiltIn/Administrtors - Is this the NT Admin group?
I have removed it from the sysadmin role - but it is still
a Login with permission to all my dbases.  When I try and
remove the permissions SQl errors?

Thanks - Paul

 
 
 

Help - removing NT Admin Group from sa role

Post by Paul » Wed, 31 Oct 2001 00:36:26


Hello,

I am trying to remove my NT Administrators Group from my
sysadmin role, as I do not want my NT Administrators to
have sa access.  What steps do I need to take? I have
already removed all of the users/groups from my sysadmin
role except for sa and a couple DBA users.   What is the
name of the NT Admin Group?  Additionaly I have a Login
called BuiltIn/Administrtors - Is this the NT Admin group?
I have removed it from the sysadmin role - but it is still
a Login with permission to all my dbases.  When I try and
remove the permissions SQl errors?

Thanks - Paul

 
 
 

Help - removing NT Admin Group from sa role

Post by Paul » Wed, 31 Oct 2001 01:55:02


Thank You!!
Quote:>-----Original Message-----
>Paul,

>The nt admin group is called 'builtin\administrators'
>group shown in the security login is SQL Servers.  This
>account has the 'sa' rights by default during
>installation.  The account an be removed by running this
>sp:

>sp_revokelogin 'builtin\administrators'

>This will get the nt group out of your SQL Server for
good.

>DeeJay.

>>-----Original Message-----
>>Hello,

>>I am trying to remove my NT Administrators Group from my
>>sysadmin role, as I do not want my NT Administrators to
>>have sa access.  What steps do I need to take? I have
>>already removed all of the users/groups from my sysadmin
>>role except for sa and a couple DBA users.   What is the
>>name of the NT Admin Group?  Additionaly I have a Login
>>called BuiltIn/Administrtors - Is this the NT Admin
group?
>>I have removed it from the sysadmin role - but it is
>still
>>a Login with permission to all my dbases.  When I try
and
>>remove the permissions SQl errors?

>>Thanks - Paul
>>.

>.

 
 
 

Help - removing NT Admin Group from sa role

Post by Rand Bo » Wed, 31 Oct 2001 03:31:53


As a caution to this:

Make sure you have at least on NT account who is a member of the sysadmin
role. This will assure that someone can act as sa in case sa password is
forgotten.

Rand Boyd
Microsoft SQL Server Support

Please reply only to the newsgroups.
When posting, please state the version of SQL Server being used and the
error number/exact error message text received, if any.

I've been "encouraged" to share this helpful information from our lawyers.
This posting is provided "AS IS" with no warranties, and confers no rights.
You assume all risk for your use.
? 2001 Microsoft Corporation. All rights reserved.

 
 
 

Help - removing NT Admin Group from sa role

Post by Kevin Connel » Wed, 31 Oct 2001 10:02:02


Uh, also make sure you are using service accounts for MSSQLSERVER and
SQLSERVERAGENT with the appropriate NT and SQL permissions.  (local admin
and "sysadmin" work)


Quote:> As a caution to this:

> Make sure you have at least on NT account who is a member of the sysadmin
> role. This will assure that someone can act as sa in case sa password is
> forgotten.

> Rand Boyd
> Microsoft SQL Server Support

> Please reply only to the newsgroups.
> When posting, please state the version of SQL Server being used and the
> error number/exact error message text received, if any.

> I've been "encouraged" to share this helpful information from our lawyers.
> This posting is provided "AS IS" with no warranties, and confers no
rights.
> You assume all risk for your use.
> ? 2001 Microsoft Corporation. All rights reserved.

 
 
 

1. Remove NT Admin from SQL SysAdmin Role

Hi,

I know that SQL Server 2000 automatically makes NT Admins -
 SQL Server Sys Admins.  I do not want for this to be the
case.  How do I remove the NT Admins and mebers of its NT
group from being a SQL Server Sys Admin?  Thanks

2. SQLMaint with -Updsts fails in 7

3. Help with creating database roles and NT Groups

4. Compiling / TCL error

5. Removing builtin/admin group in sql2k cluster

6. Permissions and Jobs

7. Security NT/Admin x SQL/sa

8. Tricky query

9. NT Admin Vs. sa

10. NT Admin right Vs. SA

11. SA account and SA role

12. REMOVE, remove, PLEASE REMOVE this idoit out of this group