Friday, June 25, 2010

BUILTIN\Administrators on SQL Server 2005/2008

This Windows group BUILTIN\Administrators in SQL Server 2005/2008, do we need it?

I will say is depends!! If you have a DBA on place, he will take care of the security in SQL Server and I hope he will keep this groups but without sysadmin role.

Why we remove the sysadmin role for BUILTIN\Administrators, because any person who have the administrator right on the server, he will be sysadmin on the database server. If the person doesn’t have the knowledge of database, this is a risk for your data of your company.

Before to remove the role of sysadmin for BUILTIN\Administrators, you need to be sure you have another account (SQL or Windows) with sysadmin role.

By the way, a good practice is to disable the sa account.!!!