Removing Guest and BUILTIN\Administrator accounts

Alll, I am looking for advice on disabling the "guest" account on SQL Server
2000.
-Are there any negatives or issues with doing this?
I am also looking to remove the BUILTIN\administrator account.
-Are there any negtive implications of removing this account?You can remove the guest user account from all database
except for master and tempdb. The guest account is needed in
these databases.
In terms of removing the builtin\administrators group, it
depends. The following article has an additional information
section with links to some issues that could come up:
INF: How to impede Windows NT administrators from
administering a clustered instance of SQL Server
http://support.microsoft.com/?id=263712
-Sue
On Fri, 27 Feb 2004 12:16:08 -0800, "RobDowdy"
<anonymous@.discussions.microsoft.com> wrote:

>Alll, I am looking for advice on disabling the "guest" account on SQL Serve
r 2000.
>-Are there any negatives or issues with doing this?
>I am also looking to remove the BUILTIN\administrator account.
>-Are there any negtive implications of removing this account?|||Usually you would replace the Builtin\administrators login with one of your
own creation. I create a group in AD called SQLAdmins, map it to a login in
SQL Server, make it a member of the sysadmins fixed server role. If the
service account is getting sysadmin permission thru membership in the local
administrators group, be sure and add the service account to your new
SQLAdmins group in AD.
Remove Pubs and Northwind from a production server.
Don't create a guest account in any production databases.
Refrain from using the public role to grant permissions to users.
Bill
"Sue Hoegemeier" <Sue_H@.nomail.please> wrote in message
news:s8bv301qe57kudb5vs2h72ah2vr52k1kdt@.
4ax.com...
> You can remove the guest user account from all database
> except for master and tempdb. The guest account is needed in
> these databases.
> In terms of removing the builtin\administrators group, it
> depends. The following article has an additional information
> section with links to some issues that could come up:
> INF: How to impede Windows NT administrators from
> administering a clustered instance of SQL Server
> http://support.microsoft.com/?id=263712
> -Sue
> On Fri, 27 Feb 2004 12:16:08 -0800, "RobDowdy"
> <anonymous@.discussions.microsoft.com> wrote:
>
Server 2000.
>

removing Builtin\Administrators login

How can I safely remove the Builtin\Administrators login?See the following:
http://www.microsoft.com/technet/tr...chnet/prodtechn
ol/sql/maintain/security/sp3sec/SP3SEC02.ASP
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.|||Thanks

quote:

---

>--Original Message--
>See the following:
>http://www.microsoft.com/technet/treeview/default.asp?

---

url=/technet/prodtechn

quote:

---

>ol/sql/maintain/security/sp3sec/SP3SEC02.ASP
>Thanks,
>Kevin McDonnell
>Microsoft Corporation
>This posting is provided AS IS with no warranties, and

---

confers no rights.

quote:

---

>
>.
>

---

Removing BUILTIN\Administrators

We need to remove the BUILTIN\Administrators from reporting services. I.T. personnel do not want to be able to see restricted reports. We have two department users that have been added as Content Managers and we are running reporting services under a created domain user account that we created and not a system service. I have removed BUILTIN\Administrators from the Home folder and when I check, it comes right back. Do I need to deny access to BUILTIN\Administrator on SQL Server 2005 itself? I would apprecate any suggestions.

I used the link below and followed the steps to remove the BUILTIN\Administrators group from SQL Server 2005 and SRS 2005. Hopefully this will be helpful to others.

http://www.mssqltips.com/tip.asp?tip1017

Removing BUILTIN\ADMINISTRATOR

Hello
I'm sure this has been answered many times, but my search of the newsgroup
gives me hits on messages that have already been 'removed'. Googling hasn't
given me the answer yet either.
I need to remove BUILTIN from many 'inherited' servers that I am called on
to support. I am required to remove it. However, it is also DBO for every
database. All the databases are actually owned by 'sa'. If I try to drop
BUILTIN access to a database I get the 'the database owner cannot be
dropped'. If I try to drop remove the DBO permit for BUILTIN in a database
I get 'Error 15405: Cannot use the reserved user or role name dbo'. UGH!
There's a simple solution for this, right?
Thanks!
> I need to remove BUILTIN from many 'inherited' servers that I am called on to support. I am
> required to remove it. However, it is also DBO for every database. All the databases are
> actually owned by 'sa'.
Above is a contradiction. You can't have both BUILTIN\Administrators *and* sa as owner for a
database! My guess is that the owner is BUILTIN\Administrators. Just change the owner to sa, using
sp_changedbowner.
Also, before removing the administrators group, add LocalSystem (actual name is NT
AUTHORITY\SYSTEM). Google for it to see why.
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Steve" <pezguy@.mn.rr.com> wrote in message news:fpsbe.31959$215.21781@.tornado.rdc-kc.rr.com...
> Hello
> I'm sure this has been answered many times, but my search of the newsgroup gives me hits on
> messages that have already been 'removed'. Googling hasn't given me the answer yet either.
> I need to remove BUILTIN from many 'inherited' servers that I am called on to support. I am
> required to remove it. However, it is also DBO for every database. All the databases are
> actually owned by 'sa'. If I try to drop BUILTIN access to a database I get the 'the database
> owner cannot be dropped'. If I try to drop remove the DBO permit for BUILTIN in a database I get
> 'Error 15405: Cannot use the reserved user or role name dbo'. UGH!
> There's a simple solution for this, right?
> Thanks!
>
|||Hi Steve,
Maybe this articles will help you:
"Removing builtin\administrators: Some pitfalls to avoid"
http://www.sqlservercentral.com/colu...lstoavoi .asp
"10 Steps to Securing your SQL Server"
http://www.sqlservercentral.com/colu...rsqlserver.asp
Cristian Lefter, SQL Server MVP
"Steve" <pezguy@.mn.rr.com> wrote in message
news:fpsbe.31959$215.21781@.tornado.rdc-kc.rr.com...
> Hello
> I'm sure this has been answered many times, but my search of the newsgroup
> gives me hits on messages that have already been 'removed'. Googling
> hasn't given me the answer yet either.
> I need to remove BUILTIN from many 'inherited' servers that I am called on
> to support. I am required to remove it. However, it is also DBO for
> every database. All the databases are actually owned by 'sa'. If I try
> to drop BUILTIN access to a database I get the 'the database owner cannot
> be dropped'. If I try to drop remove the DBO permit for BUILTIN in a
> database I get 'Error 15405: Cannot use the reserved user or role name
> dbo'. UGH!
> There's a simple solution for this, right?
> Thanks!
>

Removing BUILTIN\ADMINISTRATOR

Hello
I'm sure this has been answered many times, but my search of the newsgroup
gives me hits on messages that have already been 'removed'. Googling hasn't
given me the answer yet either.
I need to remove BUILTIN from many 'inherited' servers that I am called on
to support. I am required to remove it. However, it is also DBO for every
database. All the databases are actually owned by 'sa'. If I try to drop
BUILTIN access to a database I get the 'the database owner cannot be
dropped'. If I try to drop remove the DBO permit for BUILTIN in a database
I get 'Error 15405: Cannot use the reserved user or role name dbo'. UGH!
There's a simple solution for this, right?
Thanks!> I need to remove BUILTIN from many 'inherited' servers that I am called on to support. I am
> required to remove it. However, it is also DBO for every database. All the databases are
> actually owned by 'sa'.
Above is a contradiction. You can't have both BUILTIN\Administrators *and* sa as owner for a
database! My guess is that the owner is BUILTIN\Administrators. Just change the owner to sa, using
sp_changedbowner.
Also, before removing the administrators group, add LocalSystem (actual name is NT
AUTHORITY\SYSTEM). Google for it to see why.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Steve" <pezguy@.mn.rr.com> wrote in message news:fpsbe.31959$215.21781@.tornado.rdc-kc.rr.com...
> Hello
> I'm sure this has been answered many times, but my search of the newsgroup gives me hits on
> messages that have already been 'removed'. Googling hasn't given me the answer yet either.
> I need to remove BUILTIN from many 'inherited' servers that I am called on to support. I am
> required to remove it. However, it is also DBO for every database. All the databases are
> actually owned by 'sa'. If I try to drop BUILTIN access to a database I get the 'the database
> owner cannot be dropped'. If I try to drop remove the DBO permit for BUILTIN in a database I get
> 'Error 15405: Cannot use the reserved user or role name dbo'. UGH!
> There's a simple solution for this, right?
> Thanks!
>|||Hi Steve,
Maybe this articles will help you:
"Removing builtin\administrators: Some pitfalls to avoid"
http://www.sqlservercentral.com/columnists/kKellenberger/removingthebuiltinadministratorssomepitfallstoavoi.asp
"10 Steps to Securing your SQL Server"
http://www.sqlservercentral.com/columnists/bknight/10securingyoursqlserver.asp
Cristian Lefter, SQL Server MVP
"Steve" <pezguy@.mn.rr.com> wrote in message
news:fpsbe.31959$215.21781@.tornado.rdc-kc.rr.com...
> Hello
> I'm sure this has been answered many times, but my search of the newsgroup
> gives me hits on messages that have already been 'removed'. Googling
> hasn't given me the answer yet either.
> I need to remove BUILTIN from many 'inherited' servers that I am called on
> to support. I am required to remove it. However, it is also DBO for
> every database. All the databases are actually owned by 'sa'. If I try
> to drop BUILTIN access to a database I get the 'the database owner cannot
> be dropped'. If I try to drop remove the DBO permit for BUILTIN in a
> database I get 'Error 15405: Cannot use the reserved user or role name
> dbo'. UGH!
> There's a simple solution for this, right?
> Thanks!
>

Removing BUILTIN\ADMINISTRATOR

Hello
I'm sure this has been answered many times, but my search of the newsgroup
gives me hits on messages that have already been 'removed'. Googling hasn't
given me the answer yet either.
I need to remove BUILTIN from many 'inherited' servers that I am called on
to support. I am required to remove it. However, it is also DBO for every
database. All the databases are actually owned by 'sa'. If I try to drop
BUILTIN access to a database I get the 'the database owner cannot be
dropped'. If I try to drop remove the DBO permit for BUILTIN in a database
I get 'Error 15405: Cannot use the reserved user or role name dbo'. UGH!
There's a simple solution for this, right?
Thanks!> I need to remove BUILTIN from many 'inherited' servers that I am called on to support. I
am
> required to remove it. However, it is also DBO for every database. All t
he databases are
> actually owned by 'sa'.
Above is a contradiction. You can't have both BUILTIN\Administrators *and* s
a as owner for a
database! My guess is that the owner is BUILTIN\Administrators. Just change
the owner to sa, using
sp_changedbowner.
Also, before removing the administrators group, add LocalSystem (actual name
is NT
AUTHORITY\SYSTEM). Google for it to see why.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Steve" <pezguy@.mn.rr.com> wrote in message news:fpsbe.31959$215.21781@.tornado.rdc-kc.rr.com
..
> Hello
> I'm sure this has been answered many times, but my search of the newsgroup
gives me hits on
> messages that have already been 'removed'. Googling hasn't given me the an
swer yet either.
> I need to remove BUILTIN from many 'inherited' servers that I am called on
to support. I am
> required to remove it. However, it is also DBO for every database. All t
he databases are
> actually owned by 'sa'. If I try to drop BUILTIN access to a database I g
et the 'the database
> owner cannot be dropped'. If I try to drop remove the DBO permit for BUIL
TIN in a database I get
> 'Error 15405: Cannot use the reserved user or role name dbo'. UGH!
> There's a simple solution for this, right?
> Thanks!
>|||Hi Steve,
Maybe this articles will help you:
"Removing builtin\administrators: Some pitfalls to avoid"
tratorssomepitfallstoavoi.asp" target="_blank">http://www.sqlservercentral.com/col...fallstoavoi.asp
"10 Steps to Securing your SQL Server"
[url]http://www.sqlservercentral.com/columnists/bknight/10securingyoursqlserver.asp[/ur
l]
Cristian Lefter, SQL Server MVP
"Steve" <pezguy@.mn.rr.com> wrote in message
news:fpsbe.31959$215.21781@.tornado.rdc-kc.rr.com...
> Hello
> I'm sure this has been answered many times, but my search of the newsgroup
> gives me hits on messages that have already been 'removed'. Googling
> hasn't given me the answer yet either.
> I need to remove BUILTIN from many 'inherited' servers that I am called on
> to support. I am required to remove it. However, it is also DBO for
> every database. All the databases are actually owned by 'sa'. If I try
> to drop BUILTIN access to a database I get the 'the database owner cannot
> be dropped'. If I try to drop remove the DBO permit for BUILTIN in a
> database I get 'Error 15405: Cannot use the reserved user or role name
> dbo'. UGH!
> There's a simple solution for this, right?
> Thanks!
>

Removing Administrators access to all folders

We would like to not allow our administrators to see sensitive Payroll information in Reporting Services. I have removed 'BUILTIN\Administrators' from all folders, yet those in the Domain Admins group can still see all of the adminstrative functions, as well as all of the folders. We don't want them to see some of the folders.

Does this have to do with the Domain Admins having local Admin rights on the server?

I think you have to install RS with another service, not Local Service or Networkservice, you can make the service to be installed to the name of a special user Financee\FinanceeAdministrator, after it remove builtin\administrators on the folders you dont want them to see,

|||Can we take Domain Administrator's out of the Local Administrators group on the server and get the same effect?|||Domain administrators are the superpowerful users, I dont think you can deny access to them