sql local data: admin

Showing posts with label admin. Show all posts

Friday, March 30, 2012

Locked out again?

I have SQL Server 2005 Developer edition installed. I use Windows
Authentication and the user is an admin on this box. For whatever
reason, I was recently locked out of SQL Server. So I uninstalled and
reinstalled then I could get back in. Then once again, I became locked
out. Same procedure and I can get back in. I downloaded and installed
SP1 for SQL Server 2005 last night. Now I'm locked out again. "sa"
never works with a blank or any other password.
Any ideas why this keeps happening and how I can gain access?
Thanks,
BrettI'm running this on Vista. I always turn off account access control.
After installing SP1 for SQL Server and rebooting, access control was
reenabled. This prevented me from logging into SQL Server. I've once
again turned access control. Now I can log in.
Brett|||Make sure that you have configured it for mixed authentication if you want
to use sa. Also, make sure that if you are using Windows authentication
with SSMS that you have that option selected when you login.
Tom
----
Thomas A. Moreau, BSc, PhD, MCSE, MCDBA, MCITP, MCTS
SQL Server MVP
Toronto, ON Canada
.
"brett" <account@.cygen.com> wrote in message
news:1167499761.263497.179960@.h40g2000cwb.googlegroups.com...
I have SQL Server 2005 Developer edition installed. I use Windows
Authentication and the user is an admin on this box. For whatever
reason, I was recently locked out of SQL Server. So I uninstalled and
reinstalled then I could get back in. Then once again, I became locked
out. Same procedure and I can get back in. I downloaded and installed
SP1 for SQL Server 2005 last night. Now I'm locked out again. "sa"
never works with a blank or any other password.
Any ideas why this keeps happening and how I can gain access?
Thanks,
Brett|||Well did you give the sa acoount a password?
You sure that youre windows account is a member of the local administrator
group?
Greetz,
HDD
"brett" wrote:

> I have SQL Server 2005 Developer edition installed. I use Windows
> Authentication and the user is an admin on this box. For whatever
> reason, I was recently locked out of SQL Server. So I uninstalled and
> reinstalled then I could get back in. Then once again, I became locked
> out. Same procedure and I can get back in. I downloaded and installed
> SP1 for SQL Server 2005 last night. Now I'm locked out again. "sa"
> never works with a blank or any other password.
> Any ideas why this keeps happening and how I can gain access?
> Thanks,
> Brett
>|||Hate_orphaned_users wrote:
> Well did you give the sa acoount a password?
This was never an option during set.

> You sure that youre windows account is a member of the local administrato
r
> group?
Yep|||Tom Moreau wrote:
> Make sure that you have configured it for mixed authentication if you want
> to use sa.
Can it be set to mixed after installation?
Thanks,
Brett|||In Vista by default you are not an admin and as such not part of the
sysadmins group. You need to make yourself an admin, create an account for
yourself in SQL Server and then you can log in without being an admin. This
wasn't an issue with XP because you were generally always an admin on the
box when you logged in. Vista changed this default because running as an
admin made viruses much more nasty. I think that SP2 is supposed to create
this user for you automatically but I don't know if that part of it works in
the current CTP.
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"brett" <account@.cygen.com> wrote in message
news:1167501829.564730.89250@.n51g2000cwc.googlegroups.com...
> I'm running this on Vista. I always turn off account access control.
> After installing SP1 for SQL Server and rebooting, access control was
> reenabled. This prevented me from logging into SQL Server. I've once
> again turned access control. Now I can log in.
> Brett
>|||Yes.
Tom
----
Thomas A. Moreau, BSc, PhD, MCSE, MCDBA, MCITP, MCTS
SQL Server MVP
Toronto, ON Canada
.
"brett" <account@.cygen.com> wrote in message
news:1167505428.307381.19420@.i12g2000cwa.googlegroups.com...
Tom Moreau wrote:
> Make sure that you have configured it for mixed authentication if you want
> to use sa.
Can it be set to mixed after installation?
Thanks,
Brett

Friday, March 9, 2012

Local VB.NET app connection to remote SQL server

I know this is strickly not a website question, but dunno where else to post...

To remotely admin and monitor some functions of the website, I wish to use a local application to connect to the MSSQL DB which is held on the remote webhosting server

I have the following code:

Dim StrSQLUNAs String ="[UN]"Dim StrSQLPWAs String ="[PW]"Dim StrServerAs String ="[IP]\[INSTANCE]"Dim StrDBAs String ="[DB]"Dim strTimeOutAs String ="Connection Timeout=0;"Dim pStrSQLConnAs String ="Server=" & StrServer &";Database=" & StrDB &";User Id=" & StrSQLUN &";Password=" & StrSQLPW &";" & strTimeOutDim sqlConnAs New SqlClient.SqlConnection(pStrSQLConn)If sqlConn.State = ConnectionState.ClosedThen sqlConn.Open()

This has basically been take from the existing code on the website, but changing to the server details. I had just started dev'ing this app when the admins decided to move the SQL server over to a different server. It was working on the old one, but the new one doesn't. It just times out after whatever time you put in the timeout variable. 0=unlimited, and so just sits there.

I am also using the MSSQL Server Management Studio locally to connect to the same database, and although slow, does connect after about a minute or so. I thought they would be using the same type of underlying connection to access the server and database? Is this correct?

Can they put restrictions in place for this specific sort of data access?

Does anyone have any suggestions on how to resolve this issue??

Thanks for any help

Adam.

does the new server allow external connections? A lot of hosts I've used in the past only allow you to connect to the SQL database from an Asp.Net app on their webservers.

|||

Yeah it does allow external access as I am using MSSQL Mgmt Studio.

Anyway I think I have found the cause of the problem - my Cisco router. I needed to put in IP Inspect rules in for the MSSQL. Thing that confuses me still is that I could use the Mgnt Studio and I thought it would be accessing it in the same way. Anyway - it still seems to work - albeit with random connection times (eg last night it was connecting in a second or to and now taking about 5mins!)

Anyway have experience in this area??

Thanks

Adam.

Wednesday, March 7, 2012

local sql server not visible for 'Users' on the same PC

Users on the same PC who do not have admin rights cannot see or logon to the
sql server/msde that exists on the PC. Any user with admin rights can see
it, of course. I have waded thru lots of hits in my searches but none of
them describe this behavior and whether I can surmount this or not. Does
anyone have any suggestions?
Thanks,
Steve
I'm not sure what tool they are using to "see" SQL Server
but in terms of logging into the instance, they would need a
login set up in order to do this. By default, the windows
local admin group is added as a login on SQL Server. That's
how the admins are able to log into the instance.
-Sue
On Mon, 6 Dec 2004 11:09:04 -0800, "Steven.Dahlin"
<StevenDahlin@.discussions.microsoft.com> wrote:

>Users on the same PC who do not have admin rights cannot see or logon to the
>sql server/msde that exists on the PC. Any user with admin rights can see
>it, of course. I have waded thru lots of hits in my searches but none of
>them describe this behavior and whether I can surmount this or not. Does
>anyone have any suggestions?
>Thanks,
>Steve
|||The tool is Query Analyzer. As a another user I can run the tool and execute
the connect function. This will pull a list of all servers that can be
seen. The (local) server is not visible at all even though others on the
network are and the local is running.
Presumedly this accessing a broadcast feature of the servers. I do not know
why the local cannot be seen.
Steve
"Sue Hoegemeier" wrote:

> I'm not sure what tool they are using to "see" SQL Server
> but in terms of logging into the instance, they would need a
> login set up in order to do this. By default, the windows
> local admin group is added as a login on SQL Server. That's
> how the admins are able to log into the instance.
> -Sue
> On Mon, 6 Dec 2004 11:09:04 -0800, "Steven.Dahlin"
> <StevenDahlin@.discussions.microsoft.com> wrote:
>
>
|||The drop down is populated with instances you have connected
to - it's not based upon servers that are broadcasting.
The users should be able to type the server name or put in a
period (just "." without the quotes) or type in (local) to
connect to the local instance.
-Sue
On Fri, 10 Dec 2004 12:07:02 -0800, "Steven.Dahlin"
<StevenDahlin@.discussions.microsoft.com> wrote:
[vbcol=seagreen]
>The tool is Query Analyzer. As a another user I can run the tool and execute
>the connect function. This will pull a list of all servers that can be
>seen. The (local) server is not visible at all even though others on the
>network are and the local is running.
>Presumedly this accessing a broadcast feature of the servers. I do not know
>why the local cannot be seen.
>Steve
>"Sue Hoegemeier" wrote:

Friday, February 24, 2012

local computer Admin through AMO?

Hi everybody.

I know that members of the Administrators local group of the local computer where SQL Server 2005 is installed are automatically members of the server role in an instance of Analysis Services.

My problem is that in my application, through AMO I am able to see the Analysis Services server administrator added explicitally in the server role, ma am not able to obtain also the ones who are AS server administrators because inherit from the Administrators local group.

Does anyone can suggest me how to obtain also this list, through AMO, ADOMD.NET or something else?

Thank you so much.

Your statement "members of the Administrators local group of the local computer where SQL Server 2005 is installed are automatically members of the server role" is not entirely correct.

Yes, members of local Administrators group are AS admins, but that is not through membership in the server role. Actually after installation the server role membership is empty. The local Administrators are just given the admn right to AS bypassing the server role membership.

You can use server property BuiltinAdminsAreServerAdmins to revoke rights of local admins.

Edward Melomed.
--
This posting is provided "AS IS" with no warranties, and confers no rights.

|||

Thank you very much for your kind answer.

Actually the property BuiltinAdminsAreServerAdmins is very useful for us to check if the local admins are also AS admins or not.

Our application wouldn't like to prevent this behaviour, but simply needs to retrieve all the AS admins: both the ones added in the server role, both the ones who have the admin rights bypassing the server role membership, because inherit from the local group, if the BuiltinAdminsAreServerAdmins is set to True.

Could you suggest us a way? Maybe we should directly extract the members of the local admin group? Do you know a way to do this, because I am not aware of such an instruction (we are using C#).

Thank you very much.

|||

Yes, you would have to query for the memebership in the local admin group.

Some simple search should give you quite a few C# samples like this one http://www.thecodeproject.com/csharp/groupandmembers.asp. I am sure you would find more.

Edward Melomed.
--
This posting is provided "AS IS" with no warranties, and confers no rights.

Monday, February 20, 2012

local administrator access for DBA's - is this required?

Hi
I need to manage a SQL cluster, monitor database and O.S performance and
apply database patches. Do I require local admin rights for this? If not
what is the workaround please?
Problem is, my organisation is very reluctant to grant local admin rights.
Is there a Microsoft article on this type of issue (I couldn't find one).
Thanks!
MilesHI
Use the SQL server account if you need local admin privilege on server.
Andras Jakus MCDBA
"Miles" wrote:

> Hi
> I need to manage a SQL cluster, monitor database and O.S performance and
> apply database patches. Do I require local admin rights for this? If not
> what is the workaround please?
> Problem is, my organisation is very reluctant to grant local admin rights.
> Is there a Microsoft article on this type of issue (I couldn't find one).
> Thanks!
> Miles
>

local administrator access for DBA's - is this required?

Hi
I need to manage a SQL cluster, monitor database and O.S performance and
apply database patches. Do I require local admin rights for this? If not
what is the workaround please?
Problem is, my organisation is very reluctant to grant local admin rights.
Is there a Microsoft article on this type of issue (I couldn't find one).
Thanks!
MilesHI
Use the SQL server account if you need local admin privilege on server.
Andras Jakus MCDBA
"Miles" wrote:
> Hi
> I need to manage a SQL cluster, monitor database and O.S performance and
> apply database patches. Do I require local admin rights for this? If not
> what is the workaround please?
> Problem is, my organisation is very reluctant to grant local admin rights.
> Is there a Microsoft article on this type of issue (I couldn't find one).
> Thanks!
> Miles
>

local administrator access for DBA's - is this required?

Hi
I need to manage a SQL cluster, monitor database and O.S performance and
apply database patches. Do I require local admin rights for this? If not
what is the workaround please?
Problem is, my organisation is very reluctant to grant local admin rights.
Is there a Microsoft article on this type of issue (I couldn't find one).
Thanks!
Miles
HI
Use the SQL server account if you need local admin privilege on server.
Andras Jakus MCDBA
"Miles" wrote:

> Hi
> I need to manage a SQL cluster, monitor database and O.S performance and
> apply database patches. Do I require local admin rights for this? If not
> what is the workaround please?
> Problem is, my organisation is very reluctant to grant local admin rights.
> Is there a Microsoft article on this type of issue (I couldn't find one).
> Thanks!
> Miles
>

Local Admin Rights Needed to Use DSNs on W2K3 Server?

Hi, (sorry this is a long one)

I have MSSQL 2000 (version 8.00.2187) installed on Windows Server 2K3, nothing 'special' has been done to either of these servers as far as configuration goes.

The exact details of the Windows server are Version - 5.2.3790, SP1.

In order to query an Oracle db from SQL, I've set up a linked server within SQL that uses a DSN to connect to the Oracle system. I use ADO to connect to SQL with integrated security (SSPI = True) and users can fire SQL stored procedures via an app. which query the linked server (so these SPs of course are using the DSN).

The problem is that unless the user's domain account (the context which I presume SQL is passing to Windows when using the DSN due to the fact that integrated security is being used) is a member of the local admins group on the server, they obtain a security related error message stating that access is denied. Even if the user is a member of Power Users on the server, they get the same error. However as soon as the users account is a member of local admins on they can fire the stored procedures and get data from the linked server no problems.

I can understand why you would want to place security around DSNs which may be able to connect to a datasource with elevated privileges, but conversely I don't like having to make end users admins of server boxes.

So my question - is it possible to modify our setup in some way to either 1) configure Windows to allow 'normal' users (no elevated windows privileges) to call and use DSNs in the manned described above or 2) configure SQL to not pass a users credentials when calling to Windows to use a DSN (instead perhaps passing the credentials of the SQL service), this way I could grant the right permissions to the SQL account and wouldn't end up with loads of end users being local admins on my server. If this is possible could someone describe to me the steps taken to do this.

I've spoken to someone from IT about this and he suggests opening up permissions on the registry where details of DSNs are stored. Not surprisingly I'm not overly keen on this option.

Thanks for reading this far, any suggestions greatly appreciated!

Cheers,

IanThis is a darn good question to which I have no real answer to. I have no experience (read: exactly zero experience) with DSNs, so I can only give broad suggestions on how I would go about this.

My only suggestion is to take a look at the Security tree in Enterprise Manager. Pay particular attention to the Logins and Linked Servers tabs. Thoroughly check all of the permissions for the user accounts in that area.

Sorry I could not be of more help.

Local Admin Rights

Quick question...
Are members of the servers local admins group by default
members of the sysadmins role'
If so, does a login account still need to be made on the
sql server in order for that user to function properly
within sql?
thanks.Hi,
Yes, But default the BUILDIN\Administrators will be having 'sysadmin' SQL
Serevr server role.
Obviously you can use this accout to access sql server.
Since this user is powerful it is not safe to provide this Login id to
Developers. So is always advisable to create a group specifically meant for
developers with less privileges.
Thanks
Hari
MCDBA
"JRD" <anonymous@.discussions.microsoft.com> wrote in message
news:98ca01c3ea6f$05b73cb0$a601280a@.phx.gbl...

quote:

> Quick question...
> Are members of the servers local admins group by default
> members of the sysadmins role'
> If so, does a login account still need to be made on the
> sql server in order for that user to function properly
> within sql?
> thanks.

Local admin needed for DBA??

Its been proposed at my company that the DBA's no longer have WINNT Admin
rights to the SQL Servers. I don't know that Im totally opposed to it as long
as I can get my job done. What things would a DBA not be able to do if he was
not an Admin on the box? The two things Im really not sure of are replication
and performance monitor, but wouldnt be shocked if other people came up with
other ideas.
All thoughts are greatly appreciated.
TIA, ChrisRFull Text Search is hosed.
http://support.microsoft.com/kb/295051/en-us
There are encryption problems
http://support.microsoft.com/kb/314636/en-us
Replication will work if you use push subscriptions (change your snapshot
share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
pull, use a non administrator share snapshot share, i.e. don't use
\\publisher\c$ rather use something like \\publisher\temp where temp maps to
c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
--
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"ChrisR" <ChrisR@.discussions.microsoft.com> wrote in message
news:54D91F30-D23A-4D28-B685-AAD0AD4C654E@.microsoft.com...
> Its been proposed at my company that the DBA's no longer have WINNT Admin
> rights to the SQL Servers. I don't know that Im totally opposed to it as
> long
> as I can get my job done. What things would a DBA not be able to do if he
> was
> not an Admin on the box? The two things Im really not sure of are
> replication
> and performance monitor, but wouldnt be shocked if other people came up
> with
> other ideas.
> All thoughts are greatly appreciated.
> TIA, ChrisR|||This is a multi-part message in MIME format.
--080001010205040905060400
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Plus you wouldn't be able to start & stop services on the SQL boxes
(something I think every production DBA should be able to do) or
troubleshoot many O/S level problems. Setting up & troubleshooting
backup plans would become harder (but not impossible I guess) and
setting up log shipping would also become more troublesome.
Pretty much anything that deals with the O/S or filesystem on the SQL
box would become, if not impossible, more complicated to do. I'm all
for minimum-required privileges but a database administrator, I would
think, ought to be able to administer his or her database servers. I
guess it comes down to how you define "database administrator". Many
people categorise users who I would refer to as developers or analysts
as "database administrators". There's no way I would grant those type
of users local admin rights or sysadmin membership to SQL boxes. But
you need to put at least a little trust in the staff you hire to look
after your database servers methinks.
--
*mike hodgson*
blog: http://sqlnerd.blogspot.com
Hilary Cotter wrote:
>Full Text Search is hosed.
>http://support.microsoft.com/kb/295051/en-us
>There are encryption problems
>http://support.microsoft.com/kb/314636/en-us
>Replication will work if you use push subscriptions (change your snapshot
>share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
>to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
>pull, use a non administrator share snapshot share, i.e. don't use
>\\publisher\c$ rather use something like \\publisher\temp where temp maps to
>c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
>
>
--080001010205040905060400
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<tt>Plus you wouldn't be able to start & stop services on the SQL
boxes (something I think every production DBA should be able to do) or
troubleshoot many O/S level problems. Setting up & troubleshooting
backup plans would become harder (but not impossible I guess) and
setting up log shipping would also become more troublesome. 
 
Pretty much anything that deals with the O/S or filesystem on the SQL
box would become, if not impossible, more complicated to do. I'm all
for minimum-required privileges but a database administrator, I would
think, ought to be able to administer his or her database servers. I
guess it comes down to how you define "database administrator". Many
people categorise users who I would refer to as developers or analysts
as "database administrators". There's no way I would grant those type
of users local admin rights or sysadmin membership to SQL boxes. But
you need to put at least a little trust in the staff you hire to look
after your database servers methinks. 
</tt>
<div class="moz-signature">
<title></title>
<meta http-equiv="Content-Type" content="text/html; ">
-- 
 mike
hodgson 
blog: <a
href="http://links.10026.com/?link=http://sqlnerd.blogspot.com</a>">http://sqlnerd.blogspot.com">http://sqlnerd.blogspot.com</a>

</div>
 
 
Hilary Cotter wrote:
<blockquote cite="midee8xk9xFGHA.532@.TK2MSFTNGP15.phx.gbl" type="cite">
<pre wrap="">Full Text Search is hosed.
<a class="moz-txt-link-freetext" href="http://links.10026.com/?link=http://support.microsoft.com/kb/295051/en-us</a>">http://support.microsoft.com/kb/295051/en-us">http://support.microsoft.com/kb/295051/en-us</a>
There are encryption problems
<a class="moz-txt-link-freetext" href="http://links.10026.com/?link=http://support.microsoft.com/kb/314636/en-us</a>">http://support.microsoft.com/kb/314636/en-us">http://support.microsoft.com/kb/314636/en-us</a>
Replication will work if you use push subscriptions (change your snapshot
share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
pull, use a non administrator share snapshot share, i.e. don't use
\\publisher\c$ rather use something like \\publisher\temp where temp maps to
c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
</pre>
</blockquote>
</body>
</html>
--080001010205040905060400--

Local admin needed for DBA??

Local Admin group necessary for DBA's?

Assume that the DBA's windows login is in the sysadmin fixed server role, if
a DBA uses Windows Authentication to manage a SQL Server Enteriprise
(6.5,7.0,200), are there any problems with removing the DBA's account from
the local administrators group of each SQL Server?
Any supporting documentation or articles for removing the DBA from the admin
Group?
Any expected annoyances for the DBA?Hi,
You can't restrict the OS administrators fully, because they have full
rights on all folders and registry keys inwhich SQL server resides.
But, you can restrict them to an extend by removing "System Admin" role
from BUILTIN/ADMINISTRATORS account.
" I had problems in the below when I removed "Syadmin role" from
BuildIN/Administrators. So I have given back the sysadmin role to solve the
issue.
1. FULL Text Indexing
2. Maintenance Plans
So do a test in test server for couple of weeks and then implement in
Production server.
Known issues after removal , Some things to be aware of:
Q237604 PRB: SQL Server Agent Does Not Start and Displays Error 18456
Q295034 FIX: MSSearch Takes 100% CPU if BUILTIN\Administrators Removed
Q317746 PRB: SQL Server Full-Text Search Does Not Populate Catalogs "
Did i answer ur question?
Thanks
Hari
SQL Server MVP
"Johnnie Scott" <JohnnieScott@.discussions.microsoft.com> wrote in message
news:84A82B7C-6244-45C1-94A2-C64DE85C31FD@.microsoft.com...
> Assume that the DBA's windows login is in the sysadmin fixed server role,
> if
> a DBA uses Windows Authentication to manage a SQL Server Enteriprise
> (6.5,7.0,200), are there any problems with removing the DBA's account from
> the local administrators group of each SQL Server?
> Any supporting documentation or articles for removing the DBA from the
> admin
> Group?
> Any expected annoyances for the DBA?|||No, the question I'm really trying to answer is regarding removing the DBA's
windows account from the Local Administrators Group on the the server.
"Hari Prasad" wrote:

> Hi,
> You can't restrict the OS administrators fully, because they have full
> rights on all folders and registry keys inwhich SQL server resides.
> But, you can restrict them to an extend by removing "System Admin" role
> from BUILTIN/ADMINISTRATORS account.
>
> " I had problems in the below when I removed "Syadmin role" from
> BuildIN/Administrators. So I have given back the sysadmin role to solve t
he
> issue.
> 1. FULL Text Indexing
> 2. Maintenance Plans
> So do a test in test server for couple of weeks and then implement in
> Production server.
> Known issues after removal , Some things to be aware of:
> Q237604 PRB: SQL Server Agent Does Not Start and Displays Error 18456
> Q295034 FIX: MSSearch Takes 100% CPU if BUILTIN\Administrators Removed
> Q317746 PRB: SQL Server Full-Text Search Does Not Populate Catalogs "
> Did i answer ur question?
> --
> Thanks
> Hari
> SQL Server MVP
> "Johnnie Scott" <JohnnieScott@.discussions.microsoft.com> wrote in message
> news:84A82B7C-6244-45C1-94A2-C64DE85C31FD@.microsoft.com...
>
>|||We have this situation on some servers and it works to varying degree's.
There are "annoyances" - you have to work closely with the Windows admins to
define the required shares so that the DBA's can manage database
files,backups,logs etc. Management of a server "by committee" is tricky so
make sure you have the processes in place for the windows + sql admins to be
able to do their jobs. And remember that if the SQL Server Service account
is a member of the local admins group on the server so are the DBA's (via
xp_cmdshell) regardless of whether they are in the local admins group or not
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Johnnie Scott" <JohnnieScott@.discussions.microsoft.com> wrote in message
news:84A82B7C-6244-45C1-94A2-C64DE85C31FD@.microsoft.com...
> Assume that the DBA's windows login is in the sysadmin fixed server role,
> if
> a DBA uses Windows Authentication to manage a SQL Server Enteriprise
> (6.5,7.0,200), are there any problems with removing the DBA's account from
> the local administrators group of each SQL Server?
> Any supporting documentation or articles for removing the DBA from the
> admin
> Group?
> Any expected annoyances for the DBA?

Local Admin access

Hi,
Can you give me reason why a SQL server DBA needs local admin access to the
server it self. This is to convinece auditors. As a SQL DBA I feel we need
to have full admin access.
thksHi
"stoney" wrote:
> Hi,
> Can you give me reason why a SQL server DBA needs local admin access to the
> server it self. This is to convinece auditors. As a SQL DBA I feel we need
> to have full admin access.
> thks
If you are just doing database administration then having local admin rights
should not be necessary, it can provide inconvenient if you don't have decent
support from the system administrators, but that would not be a satisfactory
reason for the auditors.
John

Local Admin

If you start your SQL services with local admin and you have a process that
uses xp_cmdshell to get files based upon date on a remote server. Can you do
that?
What permission will I need to apply on the remote server folders or from
within the Sql2005 box issuing the xp_cmdshell request.
Thanks.First, you need to enable xp_cmdshell by using sp_configure (it is disabled
by default for security reasons).
Second, you need to give permissions on the remote shared folder to the
account used to run the SQL Server service. Usually this should be a Windows
domain account so it can access resources on the network.
Hope this helps,
Ben Nevarez
Senior Database Administrator
AIG SunAmerica
"AHartman" wrote:
> If you start your SQL services with local admin and you have a process that
> uses xp_cmdshell to get files based upon date on a remote server. Can you do
> that?
> What permission will I need to apply on the remote server folders or from
> within the Sql2005 box issuing the xp_cmdshell request.
>
> Thanks.
>|||No. Local admin won't have the required permissions for remote system
access. You will need to use a domain level account for the sql services
logins and give that account appropriate access.
--
Kevin G. Boles
TheSQLGuru
Indicium Resources, Inc.
"AHartman" <Hoosbruin@.Kconline.com> wrote in message
news:0PmdnSu0MdRCWNHanZ2dnUVZ_gGdnZ2d@.kconline.com...
> If you start your SQL services with local admin and you have a process
> that uses xp_cmdshell to get files based upon date on a remote server. Can
> you do that?
> What permission will I need to apply on the remote server folders or from
> within the Sql2005 box issuing the xp_cmdshell request.
>
> Thanks.|||In addition to the other posts:
If the login who executes xp_cmdshell isn't sysadmin you also need to define a proxy account.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://sqlblog.com/blogs/tibor_karaszi
"AHartman" <Hoosbruin@.Kconline.com> wrote in message
news:0PmdnSu0MdRCWNHanZ2dnUVZ_gGdnZ2d@.kconline.com...
> If you start your SQL services with local admin and you have a process that uses xp_cmdshell to
> get files based upon date on a remote server. Can you do that?
> What permission will I need to apply on the remote server folders or from within the Sql2005 box
> issuing the xp_cmdshell request.
>
> Thanks.

Local Admin

If you start your SQL services with local admin and you have a process that
uses xp_cmdshell to get files based upon date on a remote server. Can you do
that?
What permission will I need to apply on the remote server folders or from
within the Sql2005 box issuing the xp_cmdshell request.
Thanks.First, you need to enable xp_cmdshell by using sp_configure (it is disabled
by default for security reasons).
Second, you need to give permissions on the remote shared folder to the
account used to run the SQL Server service. Usually this should be a Windows
domain account so it can access resources on the network.
Hope this helps,
Ben Nevarez
Senior Database Administrator
AIG SunAmerica
"AHartman" wrote:

> If you start your SQL services with local admin and you have a process tha
t
> uses xp_cmdshell to get files based upon date on a remote server. Can you
do
> that?
> What permission will I need to apply on the remote server folders or from
> within the Sql2005 box issuing the xp_cmdshell request.
>
> Thanks.
>|||No. Local admin won't have the required permissions for remote system
access. You will need to use a domain level account for the sql services
logins and give that account appropriate access.
Kevin G. Boles
TheSQLGuru
Indicium Resources, Inc.
"AHartman" <Hoosbruin@.Kconline.com> wrote in message
news:0PmdnSu0MdRCWNHanZ2dnUVZ_gGdnZ2d@.kc
online.com...
> If you start your SQL services with local admin and you have a process
> that uses xp_cmdshell to get files based upon date on a remote server. Can
> you do that?
> What permission will I need to apply on the remote server folders or from
> within the Sql2005 box issuing the xp_cmdshell request.
>
> Thanks.|||In addition to the other posts:
If the login who executes xp_cmdshell isn't sysadmin you also need to define
a proxy account.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://sqlblog.com/blogs/tibor_karaszi
"AHartman" <Hoosbruin@.Kconline.com> wrote in message
news:0PmdnSu0MdRCWNHanZ2dnUVZ_gGdnZ2d@.kc
online.com...
> If you start your SQL services with local admin and you have a process tha
t uses xp_cmdshell to
> get files based upon date on a remote server. Can you do that?
> What permission will I need to apply on the remote server folders or from
within the Sql2005 box
> issuing the xp_cmdshell request.
>
> Thanks.

Local Admin

If you start your SQL services with local admin and you have a process that
uses xp_cmdshell to get files based upon date on a remote server. Can you do
that?
What permission will I need to apply on the remote server folders or from
within the Sql2005 box issuing the xp_cmdshell request.
Thanks.
First, you need to enable xp_cmdshell by using sp_configure (it is disabled
by default for security reasons).
Second, you need to give permissions on the remote shared folder to the
account used to run the SQL Server service. Usually this should be a Windows
domain account so it can access resources on the network.
Hope this helps,
Ben Nevarez
Senior Database Administrator
AIG SunAmerica
"AHartman" wrote:

> If you start your SQL services with local admin and you have a process that
> uses xp_cmdshell to get files based upon date on a remote server. Can you do
> that?
> What permission will I need to apply on the remote server folders or from
> within the Sql2005 box issuing the xp_cmdshell request.
>
> Thanks.
>
|||No. Local admin won't have the required permissions for remote system
access. You will need to use a domain level account for the sql services
logins and give that account appropriate access.
Kevin G. Boles
TheSQLGuru
Indicium Resources, Inc.
"AHartman" <Hoosbruin@.Kconline.com> wrote in message
news:0PmdnSu0MdRCWNHanZ2dnUVZ_gGdnZ2d@.kconline.com ...
> If you start your SQL services with local admin and you have a process
> that uses xp_cmdshell to get files based upon date on a remote server. Can
> you do that?
> What permission will I need to apply on the remote server folders or from
> within the Sql2005 box issuing the xp_cmdshell request.
>
> Thanks.

Friday, March 30, 2012

Locked out again?

Friday, March 9, 2012

Local VB.NET app connection to remote SQL server

Wednesday, March 7, 2012

local sql server not visible for 'Users' on the same PC

Friday, February 24, 2012

local computer Admin through AMO?

Monday, February 20, 2012

local administrator access for DBA's - is this required?

local administrator access for DBA's - is this required?

local administrator access for DBA's - is this required?

Local Admin Rights Needed to Use DSNs on W2K3 Server?

Local Admin Rights

Local admin needed for DBA??

Local admin needed for DBA??

Local admin needed for DBA??

Local Admin group necessary for DBA's?

Local Admin access

Local Admin

Local Admin

Local Admin

sql local data

Blog Archive

About Me