removing windows group that's a database user

When attempting to remove a windows group using the
stored procedure xp_dropuser obtain the following error:
Server: Msg 15008, Level 16, State 1, Procedure
sp_dropuser, Line 12
User 'D0550000\CSMBalanceInquiry' does not exist in the
current database.
D0550000 is the domain and CSMBalanceInquiry is the
windows group.
Before removing this group I execute sp_helpuser and do a
copy and paste of the name.
If I attempt to remove this group through the enterprise
manager, I do not have a problem. I tried to search in
the Microsoft knowledge base and could not find an
article explaining this problem. Thank you for your help
in advance.You need to specify the value returned from sp_helpuser for the "name" of
the user\group.
You can see the valid names in the database by running select * from
sysusers while in that database.
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.|||is the group a role or a user? Note that sp_helpuser can return information
about roles as well as users...
If you think that might be the case try sp_droprole.
Richard Waymire, MCSE, MCDBA
This posting is provided "AS IS" with no warranties, and confers no rights.
"Maria Garcia" <garcim@.miamidade.gov> wrote in message
news:009e01c3c3fe$8e7b9880$a401280a@.phx.gbl...

quote:

---

> When attempting to remove a windows group using the
> stored procedure xp_dropuser obtain the following error:
> Server: Msg 15008, Level 16, State 1, Procedure
> sp_dropuser, Line 12
> User 'D0550000\CSMBalanceInquiry' does not exist in the
> current database.
> D0550000 is the domain and CSMBalanceInquiry is the
> windows group.
> Before removing this group I execute sp_helpuser and do a
> copy and paste of the name.
> If I attempt to remove this group through the enterprise
> manager, I do not have a problem. I tried to search in
> the Microsoft knowledge base and could not find an
> article explaining this problem. Thank you for your help
> in advance.

---

Removing service account from "SQLServer2005MSSQLUser" causes decryption error

I am attempting to implement tighter security on my instances of SQL Server 2005. One of my tasks is to make sure that the service account for the SQL Server service has the minimum privileges necessary to run the service. I thought I had everything configured correctly, but then I realized that the "SQLServer2005MSSQLUser" Windows group was a member of the "sysadmin" fixed server role. I do not want the service account to be a sysadmin, so I removed the service account from this group.

Everything seemed to be working, until I received a call from one of our developers. He was attempting to execute a stored procedure, and he kept getting the following error: "An error occurred during decryption".

I looked up the error, and found out it is related to the service master key. I am using the same service account that I did when I installed SQL Server, so I am baffled as to why I am receiving this error. The error was resolved when I added the service account back to the "SQLServer2005MSSQLUser" Windows group and restarted the SQL Server service.

Do have any idea what might be happening here?

SQL Server has a dependancy that the service account be a member of the sysadmin fixed server role. Removing the service account from sysadmin is currently unsupported.

If you want to remove the group from the sysadmin list you could manually add the service account to sysadmin and then remove the group. This will make changing service accounts non-automated since we add/remove accounts to this group and ACL many items to the local group.

hth,

--Steven Gott

S/DET

SQL Server

|||

I thought that only the SQL Server Agent security account was required to be a sysadmin. Books Online is a lot clearer about the requirement that the Agent account be a sysadmin than it is that the SQL Server service account be a sysadmin. I see now that I have to rethink the other SQL Server services, since I do not want those services to use an account with sysadmin privileges unless it is absolutely necessary.

Thanks for the information.

Ken