¿Puede el administrador del servidor de Windows heredar los privilegios de SQL SA?

Can users who are part of Windows Administrators group inherit SA priveleges on SQL Server that is installed on Windows box

Muchas Gracias

preguntado el 10 de septiembre de 13 a las 00:09

1 Respuestas

If you want to grant SA privileges to all local administrators, just create a sql login for the local administrator group and add it to the sysadmin server role.

If you do not want SA access, make sure that login is not part of the sysadmin server role.

However, a local administrator can impersonate other local windows accounts like the NT AUTHORITY\SYSTEM account. That one always has SA access to any local SQL Server instance when using integrated security. That means you cannot really prevent a local admin from getting sysadmin access.

For details on gaining SA access to a SQL 2008R2 instance as a local admin, checkout this link: http://www.mssqltips.com/sqlservertip/2682/recover-access-to-a-sql-server-instance/

Respondido el 10 de Septiembre de 13 a las 23:09

Thanks Sebastian! So, im my envrionment i have NT AUTHORITY\SYSTEM account with sa priveleges on sql server and there is a user XYZ who is administrator on the windows box but has only datareader rights on SQL server, so will this user XYZ be able to access SQL server with SA priveleges because of him being an administrator on the windows server? Pls let me know.. Thanks in advance - user2537249

That is correct. In SQL Server 2008R2 NT AUTHORITY\SYSTEM has sysadmin privileges on any local instance. Any local administrator can execute a program like sqlcmd "impersonating" that account and therefore gain sysadmin access themselves. - In SQL 2012 and 2014 the process is a little more complex, but it is still possible for a local admin to gain sysadmin on any local instance. - Sebastián Meine

Please let me know the process for impersonation, if you can share the steps and can the user (described above) use SQL Mgmt Studio with sysadmin priveleges using impersonation? - user2537249

I added a link above. - Sebastián Meine

Thanks a ton Sebastian! - user2537249

No es la respuesta que estás buscando? Examinar otras preguntas etiquetadas or haz tu propia pregunta.