Post reply

BUILTIN\Administrators who is he ?

  • January 28, 2009 at 10:42 am

    #128274

    Hi,

    Im studying for my MSTC and am a little confused about the BUILTIN\Administrators login. I know it gets created when SQL Server is installed.Who is this account intended for ? Is it for the System Administartors and what server role should be assigned to it (sysadmin or serveradmin) ?

    Thank You

  • January 28, 2009 at 10:54 am

    #934004

    on every Windows machine, there is an Administrators group, and by default a specific login named Administrator. On laptops it is typical that every login on the laptop become an administrator of the laptop, so the group "Administrators" might have multiple people.

    stating the obvious, there is an expectation that the "Administrator", or anyone in that "Administrators" group should have access to everything....

    the BuiltIn\Administrators group is the implementation of that idea.... that group, which gets inherited from Windows, has the same rights as the "sa" user in SQL Server. You can take away those rights from that group if needed, but you can't take them away from "sa". Since they are already inheriting the same rights that sa has, ther's no need to try to assign roles like sysadmin, etc.

    One advantage to the group is if you forgot the sa password, you would want to login as a user from the Administrators group so you can reset the sa password to a new value, so having the group has it's advantages. From an accoutability standpoint, changes made is SQL server by "Bob" thru his builtin\Administrators access is easier to track down than if everyone logs in as "sa"

    the disadvantage, obviously, is that it is possible that someone that doesn't know enough about SQL has super-user access to SQL thru their windows role, and could unknowingly break things.

    Hope that helps.

    Lowell

    --help us help you! If you post a question, make sure you include a CREATE TABLE... statement and INSERT INTO... statement into that table to give the volunteers here representative data. with your description of the problem, we can provide a tested, verifiable solution to your question! asking the question the right way gets you a tested answer the fastest way possible!

  • January 28, 2009 at 10:57 am

    #934007

    Check this link for complete info on BUILTIN/Administrators

    http://qa.sqlservercentral.com/articles/Security/sqlserversecuritysecurityadmins/1031/

  • January 28, 2009 at 11:21 am

    #934031

    Thank You.Those replies were fast and cleared my doubts

Viewing 4 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic. Login to reply