sa removal

Question

sa removal

Viewing 15 posts - 16 through 29 (of 29 total)

You must be logged in to reply to this topic. Login to reply

Steve Jones - SSC Editor SSC Guru Points: 734459 More actions · Answer 1

If you're really concerned, give it a long, one-time password that you don't write down. Randomly bang on 20 keys to get it.

Don't rename it or delete it. You'll get into trouble later. If you can go to Windows auth only, still set a strong password for SA. Never know when someone will change it back.

Bob Fazio SSChampion Points: 10794 More actions · Answer 2

Steve Jones - Editor (5/27/2008)
If you're really concerned, give it a long, one-time password that you don't write down. Randomly bang on 20 keys to get it.

I like that :hehe: You will honestly be able to say you don't know the password.

Matt Miller (4) SSC Guru Points: 124210 More actions · Answer 3

Steve Jones - Editor (5/27/2008)
If you're really concerned, give it a long, one-time password that you don't write down. Randomly bang on 20 keys to get it.
Don't rename it or delete it. You'll get into trouble later. If you can go to Windows auth only, still set a strong password for SA. Never know when someone will change it back.

You could also go the extra mile, and mark it as disabled for logins, and deny it access to the DB engine.

----------------------------------------------------------------------------------
Your lack of planning does not constitute an emergency on my part...unless you're my manager...or a director and above...or a really loud-spoken end-user..All right - what was my emergency again?

K. Brian Kelley SSC Guru Points: 114562 More actions · Answer 4

Piggy-backing on what's already been said here:

Introduce your users to The Principle of Least Privilege. It's a security principle that says you give the users the rights they need and no more. Now, if an end user can justify needing be able to create databases, manage security on the server, shutdown the SQL Server, etc., then they get the appropriate rights. They can't. You should be able to get backing from your security personnel or auditors if you're in a large enough organization.

Show them the tons of documentation which all state "Don't use the sa account, ever." This is a well known security practice not to use. You can rename and you can disable, but as Steve says, you'll likely get into trouble later. I've written a blog post about a security company that requires it for one of their security products, okay, a rant, but generally, this is a no-brainer.

As previously said, set a strong password. Use a password generator to ensure it is complex and long. 20 characters or more. Make two copies of the password. One sealed and stored on-site in the event of an emergency and one sealed and stoerd off-site with your backups in the event of a disaster. Do this even if you can go to Windows authentication only mode. It's a simple registry change to flip it to mixed mode and then the next time the service restarts, such as when the server reboots due to security patches, you're in mixed mode.

If possible, switch to Windows authentication only mode. SQL Server logins have known weaknesses travelling across the wire and besides, if you can go to Windows auth mode, that means you have one source for security: Active Directory.

K. Brian Kelley
@kbriankelley

mobasha SSCertifiable Points: 5334 More actions · Answer 5

thanks gues for the info and for ur help..its going to happen but things must go slowly.one step at a time.

..>>..

MobashA

MsCode_Pro Say Hey Kid Points: 690 More actions · Answer 6

🙂 hello professionals, i think it is a lecture for soft skills. lol

YoU CaN't LoSe WhAt YoU NeVeR HaD;)

Manoj-485464 SSCrazy Points: 2717 More actions · Answer 7

You Should not be able to Delete SA login from the server, But you could be able to DISABLE the SA account from the server.

Manoj

MCP, MCTS (GDBA/EDA)

Stacey SSCommitted Points: 1766 More actions · Answer 8

My approach to being a DBA is that I am here to protect the companies data. These to me means that no one ever uses the sa account on any system that I managed. I told this to the management team before I was hired.

As the DBA you are not always popular. You are there to protect the money, which is exactly what information in a companies database is.

Take the hard line of changing the password, then rename sa to something else (good security practise anyway), any only use that account in an emergency. Limit right on databases to only what is required and even question that access.

If you do not protect the data and something happens to it, you are the one that is in trouble. Take the hard line, and in the log run you and your company will be better off for it.

Stacey W. A. Gregerson

Jeff Moden SSC Guru Points: 1003869 More actions · Answer 9

Manoj (6/3/2008)
You Should not be able to Delete SA login from the server, But you could be able to DISABLE the SA account from the server.

Cool... how would you go about doing that?

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

Jeff Moden SSC Guru Points: 1003869 More actions · Answer 10

gregers65 (6/23/2008)
My approach to being a DBA is that I am here to protect the companies data. These to me means that no one ever uses the sa account on any system that I managed. I told this to the management team before I was hired.
As the DBA you are not always popular. You are there to protect the money, which is exactly what information in a companies database is.
Take the hard line of changing the password, then rename sa to something else (good security practise anyway), any only use that account in an emergency. Limit right on databases to only what is required and even question that access.
If you do not protect the data and something happens to it, you are the one that is in trouble. Take the hard line, and in the log run you and your company will be better off for it.

I absolutely agree there... Protect the data at all costs. If they don't agree, then maybe it's to start looking for a company that actually knows what a DBA is supposed to do.

Shifting gears... I've never tried renaming SA to something else... how would you do it?

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

Stacey SSCommitted Points: 1766 More actions · Answer 11

Example:

ALTER LOGIN sa WITH NAME = peanutbuttercup

Available with 2005

Stacey W. A. Gregerson

Jeff Moden SSC Guru Points: 1003869 More actions · Answer 12

Heh... Embarassingly simple. Thanks Stacey.

Mobasha... that's gotta be as good as deleting SA... still, your users are going to know that you can give SA privs to any login... I'm still thinking that this is a lost cause and you and your managers just need to tell folks, "No". 🙂

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

steveb. SSC-Forever Points: 46733 More actions · Answer 13

Just say NO.

you wouldn't expect the sys admin to give everyone full access to the AD.

egementanirer Newbie Points: 7 More actions · Answer 14

Solution

Please try the link below;

http://egementanirer.blogspot.com/2014/01/removing-sysadmin-roles-from-sa-user.html

Gail Shaw SSC Guru Points: 1004504 More actions · Answer 15

Please note: 5 year old thread.

Gail Shaw
Microsoft Certified Master: SQL Server, MVP, M.Sc (Comp Sci)
SQL In The Wild: Discussions on DB performance with occasional diversions into recoverability

We walk in the dark places no others will enter
We stand on the bridge and no one may pass