Removing operators from System administrator Role

Hi List!
I have 2 users with SA admin rol granted on a SQL2000 SP3 Server. I want to
take them off, but the people said me that they need to monitor a lot of job
s
running on this server, so what priviledges does i need to grant them to all
o
to see the results of this jobs?496371c0860" target="_blank">http://groups.google.de/group/micro.../>
496371c0860
http://groups.google.de/group/micro...853a5d26aa1b4e1
HTH, Jens Suessmeyer.
"Tinchos" wrote:

> Hi List!
> I have 2 users with SA admin rol granted on a SQL2000 SP3 Server. I want t
o
> take them off, but the people said me that they need to monitor a lot of j
obs
> running on this server, so what priviledges does i need to grant them to a
llo
> to see the results of this jobs?
>

Removing operators from System administrator Role

Hi List!
I have 2 users with SA admin rol granted on a SQL2000 SP3 Server. I want to
take them off, but the people said me that they need to monitor a lot of jobs
running on this server, so what priviledges does i need to grant them to allo
to see the results of this jobs?
http://groups.google.de/group/micros...9c4496371c0860
http://groups.google.de/group/micros...53a5d26aa1b4e1
HTH, Jens Suessmeyer.
"Tinchos" wrote:

> Hi List!
> I have 2 users with SA admin rol granted on a SQL2000 SP3 Server. I want to
> take them off, but the people said me that they need to monitor a lot of jobs
> running on this server, so what priviledges does i need to grant them to allo
> to see the results of this jobs?
>

Removing operators from System administrator Role

Hi List!
I have 2 users with SA admin rol granted on a SQL2000 SP3 Server. I want to
take them off, but the people said me that they need to monitor a lot of jobs
running on this server, so what priviledges does i need to grant them to allo
to see the results of this jobs?http://groups.google.de/group/microsoft.public.sqlserver.server/browse_frm/thread/795ec20703b7b535/919c4496371c0860?tvc=1&q=jobs+Jens+S%C3%BC%C3%9Fmeyer&hl=de#919c4496371c0860
http://groups.google.de/group/microsoft.public.sqlserver.security/browse_frm/thread/1d0ffa0f2b2fbdcd/0853a5d26aa1b4e1?lnk=st&q=jobs+Jens+S%C3%BC%C3%9Fmeyer&rnum=6&hl=de#0853a5d26aa1b4e1
HTH, Jens Suessmeyer.
"Tinchos" wrote:
> Hi List!
> I have 2 users with SA admin rol granted on a SQL2000 SP3 Server. I want to
> take them off, but the people said me that they need to monitor a lot of jobs
> running on this server, so what priviledges does i need to grant them to allo
> to see the results of this jobs?
>

Removing Guest and BUILTIN\Administrator accounts

Alll, I am looking for advice on disabling the "guest" account on SQL Server
2000.
-Are there any negatives or issues with doing this?
I am also looking to remove the BUILTIN\administrator account.
-Are there any negtive implications of removing this account?You can remove the guest user account from all database
except for master and tempdb. The guest account is needed in
these databases.
In terms of removing the builtin\administrators group, it
depends. The following article has an additional information
section with links to some issues that could come up:
INF: How to impede Windows NT administrators from
administering a clustered instance of SQL Server
http://support.microsoft.com/?id=263712
-Sue
On Fri, 27 Feb 2004 12:16:08 -0800, "RobDowdy"
<anonymous@.discussions.microsoft.com> wrote:

>Alll, I am looking for advice on disabling the "guest" account on SQL Serve
r 2000.
>-Are there any negatives or issues with doing this?
>I am also looking to remove the BUILTIN\administrator account.
>-Are there any negtive implications of removing this account?|||Usually you would replace the Builtin\administrators login with one of your
own creation. I create a group in AD called SQLAdmins, map it to a login in
SQL Server, make it a member of the sysadmins fixed server role. If the
service account is getting sysadmin permission thru membership in the local
administrators group, be sure and add the service account to your new
SQLAdmins group in AD.
Remove Pubs and Northwind from a production server.
Don't create a guest account in any production databases.
Refrain from using the public role to grant permissions to users.
Bill
"Sue Hoegemeier" <Sue_H@.nomail.please> wrote in message
news:s8bv301qe57kudb5vs2h72ah2vr52k1kdt@.
4ax.com...
> You can remove the guest user account from all database
> except for master and tempdb. The guest account is needed in
> these databases.
> In terms of removing the builtin\administrators group, it
> depends. The following article has an additional information
> section with links to some issues that could come up:
> INF: How to impede Windows NT administrators from
> administering a clustered instance of SQL Server
> http://support.microsoft.com/?id=263712
> -Sue
> On Fri, 27 Feb 2004 12:16:08 -0800, "RobDowdy"
> <anonymous@.discussions.microsoft.com> wrote:
>
Server 2000.
>

Removing BUILTIN\ADMINISTRATOR

Hello
I'm sure this has been answered many times, but my search of the newsgroup
gives me hits on messages that have already been 'removed'. Googling hasn't
given me the answer yet either.
I need to remove BUILTIN from many 'inherited' servers that I am called on
to support. I am required to remove it. However, it is also DBO for every
database. All the databases are actually owned by 'sa'. If I try to drop
BUILTIN access to a database I get the 'the database owner cannot be
dropped'. If I try to drop remove the DBO permit for BUILTIN in a database
I get 'Error 15405: Cannot use the reserved user or role name dbo'. UGH!
There's a simple solution for this, right?
Thanks!
> I need to remove BUILTIN from many 'inherited' servers that I am called on to support. I am
> required to remove it. However, it is also DBO for every database. All the databases are
> actually owned by 'sa'.
Above is a contradiction. You can't have both BUILTIN\Administrators *and* sa as owner for a
database! My guess is that the owner is BUILTIN\Administrators. Just change the owner to sa, using
sp_changedbowner.
Also, before removing the administrators group, add LocalSystem (actual name is NT
AUTHORITY\SYSTEM). Google for it to see why.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Steve" <pezguy@.mn.rr.com> wrote in message news:fpsbe.31959$215.21781@.tornado.rdc-kc.rr.com...
> Hello
> I'm sure this has been answered many times, but my search of the newsgroup gives me hits on
> messages that have already been 'removed'. Googling hasn't given me the answer yet either.
> I need to remove BUILTIN from many 'inherited' servers that I am called on to support. I am
> required to remove it. However, it is also DBO for every database. All the databases are
> actually owned by 'sa'. If I try to drop BUILTIN access to a database I get the 'the database
> owner cannot be dropped'. If I try to drop remove the DBO permit for BUILTIN in a database I get
> 'Error 15405: Cannot use the reserved user or role name dbo'. UGH!
> There's a simple solution for this, right?
> Thanks!
>
|||Hi Steve,
Maybe this articles will help you:
"Removing builtin\administrators: Some pitfalls to avoid"
http://www.sqlservercentral.com/colu...lstoavoi .asp
"10 Steps to Securing your SQL Server"
http://www.sqlservercentral.com/colu...rsqlserver.asp
Cristian Lefter, SQL Server MVP
"Steve" <pezguy@.mn.rr.com> wrote in message
news:fpsbe.31959$215.21781@.tornado.rdc-kc.rr.com...
> Hello
> I'm sure this has been answered many times, but my search of the newsgroup
> gives me hits on messages that have already been 'removed'. Googling
> hasn't given me the answer yet either.
> I need to remove BUILTIN from many 'inherited' servers that I am called on
> to support. I am required to remove it. However, it is also DBO for
> every database. All the databases are actually owned by 'sa'. If I try
> to drop BUILTIN access to a database I get the 'the database owner cannot
> be dropped'. If I try to drop remove the DBO permit for BUILTIN in a
> database I get 'Error 15405: Cannot use the reserved user or role name
> dbo'. UGH!
> There's a simple solution for this, right?
> Thanks!
>

Removing BUILTIN\ADMINISTRATOR

Hello
I'm sure this has been answered many times, but my search of the newsgroup
gives me hits on messages that have already been 'removed'. Googling hasn't
given me the answer yet either.
I need to remove BUILTIN from many 'inherited' servers that I am called on
to support. I am required to remove it. However, it is also DBO for every
database. All the databases are actually owned by 'sa'. If I try to drop
BUILTIN access to a database I get the 'the database owner cannot be
dropped'. If I try to drop remove the DBO permit for BUILTIN in a database
I get 'Error 15405: Cannot use the reserved user or role name dbo'. UGH!
There's a simple solution for this, right?
Thanks!> I need to remove BUILTIN from many 'inherited' servers that I am called on to support. I am
> required to remove it. However, it is also DBO for every database. All the databases are
> actually owned by 'sa'.
Above is a contradiction. You can't have both BUILTIN\Administrators *and* sa as owner for a
database! My guess is that the owner is BUILTIN\Administrators. Just change the owner to sa, using
sp_changedbowner.
Also, before removing the administrators group, add LocalSystem (actual name is NT
AUTHORITY\SYSTEM). Google for it to see why.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Steve" <pezguy@.mn.rr.com> wrote in message news:fpsbe.31959$215.21781@.tornado.rdc-kc.rr.com...
> Hello
> I'm sure this has been answered many times, but my search of the newsgroup gives me hits on
> messages that have already been 'removed'. Googling hasn't given me the answer yet either.
> I need to remove BUILTIN from many 'inherited' servers that I am called on to support. I am
> required to remove it. However, it is also DBO for every database. All the databases are
> actually owned by 'sa'. If I try to drop BUILTIN access to a database I get the 'the database
> owner cannot be dropped'. If I try to drop remove the DBO permit for BUILTIN in a database I get
> 'Error 15405: Cannot use the reserved user or role name dbo'. UGH!
> There's a simple solution for this, right?
> Thanks!
>|||Hi Steve,
Maybe this articles will help you:
"Removing builtin\administrators: Some pitfalls to avoid"
http://www.sqlservercentral.com/columnists/kKellenberger/removingthebuiltinadministratorssomepitfallstoavoi.asp
"10 Steps to Securing your SQL Server"
http://www.sqlservercentral.com/columnists/bknight/10securingyoursqlserver.asp
Cristian Lefter, SQL Server MVP
"Steve" <pezguy@.mn.rr.com> wrote in message
news:fpsbe.31959$215.21781@.tornado.rdc-kc.rr.com...
> Hello
> I'm sure this has been answered many times, but my search of the newsgroup
> gives me hits on messages that have already been 'removed'. Googling
> hasn't given me the answer yet either.
> I need to remove BUILTIN from many 'inherited' servers that I am called on
> to support. I am required to remove it. However, it is also DBO for
> every database. All the databases are actually owned by 'sa'. If I try
> to drop BUILTIN access to a database I get the 'the database owner cannot
> be dropped'. If I try to drop remove the DBO permit for BUILTIN in a
> database I get 'Error 15405: Cannot use the reserved user or role name
> dbo'. UGH!
> There's a simple solution for this, right?
> Thanks!
>

Removing BUILTIN\ADMINISTRATOR

Hello
I'm sure this has been answered many times, but my search of the newsgroup
gives me hits on messages that have already been 'removed'. Googling hasn't
given me the answer yet either.
I need to remove BUILTIN from many 'inherited' servers that I am called on
to support. I am required to remove it. However, it is also DBO for every
database. All the databases are actually owned by 'sa'. If I try to drop
BUILTIN access to a database I get the 'the database owner cannot be
dropped'. If I try to drop remove the DBO permit for BUILTIN in a database
I get 'Error 15405: Cannot use the reserved user or role name dbo'. UGH!
There's a simple solution for this, right?
Thanks!> I need to remove BUILTIN from many 'inherited' servers that I am called on to support. I
am
> required to remove it. However, it is also DBO for every database. All t
he databases are
> actually owned by 'sa'.
Above is a contradiction. You can't have both BUILTIN\Administrators *and* s
a as owner for a
database! My guess is that the owner is BUILTIN\Administrators. Just change
the owner to sa, using
sp_changedbowner.
Also, before removing the administrators group, add LocalSystem (actual name
is NT
AUTHORITY\SYSTEM). Google for it to see why.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Steve" <pezguy@.mn.rr.com> wrote in message news:fpsbe.31959$215.21781@.tornado.rdc-kc.rr.com
..
> Hello
> I'm sure this has been answered many times, but my search of the newsgroup
gives me hits on
> messages that have already been 'removed'. Googling hasn't given me the an
swer yet either.
> I need to remove BUILTIN from many 'inherited' servers that I am called on
to support. I am
> required to remove it. However, it is also DBO for every database. All t
he databases are
> actually owned by 'sa'. If I try to drop BUILTIN access to a database I g
et the 'the database
> owner cannot be dropped'. If I try to drop remove the DBO permit for BUIL
TIN in a database I get
> 'Error 15405: Cannot use the reserved user or role name dbo'. UGH!
> There's a simple solution for this, right?
> Thanks!
>|||Hi Steve,
Maybe this articles will help you:
"Removing builtin\administrators: Some pitfalls to avoid"
tratorssomepitfallstoavoi.asp" target="_blank">http://www.sqlservercentral.com/col...fallstoavoi.asp
"10 Steps to Securing your SQL Server"
[url]http://www.sqlservercentral.com/columnists/bknight/10securingyoursqlserver.asp[/ur
l]
Cristian Lefter, SQL Server MVP
"Steve" <pezguy@.mn.rr.com> wrote in message
news:fpsbe.31959$215.21781@.tornado.rdc-kc.rr.com...
> Hello
> I'm sure this has been answered many times, but my search of the newsgroup
> gives me hits on messages that have already been 'removed'. Googling
> hasn't given me the answer yet either.
> I need to remove BUILTIN from many 'inherited' servers that I am called on
> to support. I am required to remove it. However, it is also DBO for
> every database. All the databases are actually owned by 'sa'. If I try
> to drop BUILTIN access to a database I get the 'the database owner cannot
> be dropped'. If I try to drop remove the DBO permit for BUILTIN in a
> database I get 'Error 15405: Cannot use the reserved user or role name
> dbo'. UGH!
> There's a simple solution for this, right?
> Thanks!
>