Tuesday, July 27, 2010

When Is an Administrator NOT a Sysadmin?

When you are working on a default install of SQL Server 2008, that’s when!

In the past, when you installed SQL Server the local administrators group was automatically granted SA privileges. With SQL Server 2008 that is no longer the case. I think this is in general a good move and forces us to be more aware of who can do crazy things to our database servers, but it’s also not overly obvious that this change was made until someone gets "access denied” or “login failed for…”.

With a tool like SQL Sentry that needs a certain level of access, it’s important to keep in mind that during or after installing a new instance of SQL Server 2008 or greater you will need to grant the service account the necessary privileges. This is the case even if the account is already a local administrator or even a domain administrator.

I’ve posted this to our KB as well here.

-JRH

No comments:

Post a Comment