LocalAdmins, LocalSystem, and the sysadmin role

During SQL Server 2005 installation, several logins are added to the
sysadmin role including:
- local administrator group (BUILTIN\Administrators),
- Local System (NT AUTHORITY\SYSTEM), and
- sa.
A common hardening practice is to later remove the local administrator group
from the sysadmin role, thereby separating server administration from DBMS
administration. However, I don't recall ever seeing the recommendation to
also remove the LocalSystem account from the sysadmin role.
Has anyone seen recommendations to remove BOTH local administrators and
LocalSystem from the sysadmin role for hardening purposes, and - if this
were to be done - what are the consequences?
Thanks in advance (and apologies for re-posting in hopes of a response),
DrewHello Drew,
Yes, generally we remove local administrator group from sysadmin role which
actually prevent accessing sql server who is having system admini privilages
on the server.
Now personally I prefer not to remove Local System as I was facing problem
while using the full-text search. Please refer the following Microsoft
article.
http://support.microsoft.com/kb/317746
Hope this will help you.
Regards,
MB
"DHamre" <dhamre@.comcast.net> wrote in message
news:%23Au%23cyMMHHA.3424@.TK2MSFTNGP02.phx.gbl...
> During SQL Server 2005 installation, several logins are added to the
> sysadmin role including:
> - local administrator group (BUILTIN\Administrators),
> - Local System (NT AUTHORITY\SYSTEM), and
> - sa.
> A common hardening practice is to later remove the local administrator
> group from the sysadmin role, thereby separating server administration
> from DBMS administration. However, I don't recall ever seeing the
> recommendation to also remove the LocalSystem account from the sysadmin
> role.
> Has anyone seen recommendations to remove BOTH local administrators and
> LocalSystem from the sysadmin role for hardening purposes, and - if this
> were to be done - what are the consequences?
> Thanks in advance (and apologies for re-posting in hopes of a response),
> Drew
>

Local administrators was removed from SQL server logins, SQL Agent is not running

Colleagues,
I am experiencing problems described in (MSSQL 2000):
http://support.microsoft.com/default.aspx?scid=kb;en-us;237604
My problem is, that I have no MSSQL account I can use to solve the problem,
I cannot access SQL Servers Logins.
What can I do? Could please somebody help me?
Best regards,
PeterSQL Server Agent has to have an Administrative account. I would recommend
that the agent account be a local administrator on the server with far
reaching access accross the network. The only suggestion that I have is to
try and locate someone who can grant you sa or a minimum Security Admin for
this instance. One thing you might try is to determine if the console account
for the server is a user in SQL. I have always used the console account and
password as the SA on that SQL instance as well as the account that the
agent/service uses which is I believe to be quite common. Might get lucky.
(i.e If there server console name is Server1 and the console login in
P@.ssw0rd, then use that to try and login through Query analyizer. If it lets
you in, try editing the instance registration in Enterprise Manager and see
what kind of access that account has.)
Good Luck.
"Peter Rus" wrote:
> Colleagues,
> I am experiencing problems described in (MSSQL 2000):
> http://support.microsoft.com/default.aspx?scid=kb;en-us;237604
> My problem is, that I have no MSSQL account I can use to solve the problem,
> I cannot access SQL Servers Logins.
> What can I do? Could please somebody help me?
> Best regards,
> Peter
>
>