Help! Removing SQLServer builtin/Administrators

Hi,
I'm having trouble maintaining security on SQLServer as
everyone who is a member of the Local Administrators (on
the system) has full control by default as SQLServer has
builtin/Administrators added by default to its System
Administrators List.
Last time I removed this group, so many things went
wrong. I dont' want the entire local administrators to be
the SQL Admins. So please suggest a way where I can
safely remove the default Built-in\Adminstrators from the
SQLServer security. Any article will be helpful.
ThanksIf you subscribe to SQL Server Professional, I wrote a piece on this:
http://www.pinpub.com/html/main.isx?sub=64&story=783
Briefly, you can add a domain account to the sysadmin role first and then
remove the BUILTIN\Administrators role.
Tom
----
Thomas A. Moreau, BSc, PhD, MCSE, MCDBA
SQL Server MVP
Columnist, SQL Server Professional
Toronto, ON Canada
www.pinnaclepublishing.com/sql
.
"tony" <anonymous@.discussions.microsoft.com> wrote in message
news:1475301c3c352$a5d28e00$a601280a@.phx
.gbl...
Hi,
I'm having trouble maintaining security on SQLServer as
everyone who is a member of the Local Administrators (on
the system) has full control by default as SQLServer has
builtin/Administrators added by default to its System
Administrators List.
Last time I removed this group, so many things went
wrong. I dont' want the entire local administrators to be
the SQL Admins. So please suggest a way where I can
safely remove the default Built-in\Adminstrators from the
SQLServer security. Any article will be helpful.
Thanks|||Adding to Tom's suggestion, you could also add a domain local group (with
only members you wish to have sysadmin equivalence) and grant that group
sysadmin permission -- then remove the builtin\administrators group. It's
also not a bad idea to reset the 'sa' account password at the same time in
case you need that account to log back in (in mixed mode).
Steve
"tony" <anonymous@.discussions.microsoft.com> wrote in message
news:1475301c3c352$a5d28e00$a601280a@.phx
.gbl...

quote:

---

> Hi,
> I'm having trouble maintaining security on SQLServer as
> everyone who is a member of the Local Administrators (on
> the system) has full control by default as SQLServer has
> builtin/Administrators added by default to its System
> Administrators List.
> Last time I removed this group, so many things went
> wrong. I dont' want the entire local administrators to be
> the SQL Admins. So please suggest a way where I can
> safely remove the default Built-in\Adminstrators from the
> SQLServer security. Any article will be helpful.

---

HELP! Printer Delivery Extension AND Forms Authentication

Hi,
I need some help with making the Printer Delivery Extension play nicely with
RS equipped with Forms Authentication/Custom Security. We have been using the
forms authentication for some time but just recently decided to implement the
Printer Delivery Extension.
The Problem:
With Forms Authentication, the Printer Delivery Extension CANNOT SEE NETWORK
PRINTERS.
I am sure this has something to do with permissions but what I am unsure
about is how to go about resolving this issue.
Basically when we try to use a network printer and then try to specify that
network printer for a subscription using the Printer Delivery Extension, the
Extension calls the IsValidPrinter() method which loops through the
PrinterSettings.InstalledPrinters collection looking for the printer I
specified. ONLY the local printers are displaying in that collection, no
network printers. I know this because I attached to the process and debugged
it inspecting the contents of that collection. So I know for sure NONE of the
network printers are in there.
Any help would be greatly appreciated!
Thanks,
Nick @. INDATAAre you using 2000 or 2005 version?
--
Markus Pöhler
netpoint-edv gmbh
Germany
"Nick P @. INDATA" wrote:
> Hi,
> I need some help with making the Printer Delivery Extension play nicely with
> RS equipped with Forms Authentication/Custom Security. We have been using the
> forms authentication for some time but just recently decided to implement the
> Printer Delivery Extension.
> The Problem:
> With Forms Authentication, the Printer Delivery Extension CANNOT SEE NETWORK
> PRINTERS.
> I am sure this has something to do with permissions but what I am unsure
> about is how to go about resolving this issue.
> Basically when we try to use a network printer and then try to specify that
> network printer for a subscription using the Printer Delivery Extension, the
> Extension calls the IsValidPrinter() method which loops through the
> PrinterSettings.InstalledPrinters collection looking for the printer I
> specified. ONLY the local printers are displaying in that collection, no
> network printers. I know this because I attached to the process and debugged
> it inspecting the contents of that collection. So I know for sure NONE of the
> network printers are in there.
> Any help would be greatly appreciated!
> Thanks,
> Nick @. INDATA|||SQL Server 2000, RS SP2
"MarkusPoehler" wrote:
> Are you using 2000 or 2005 version?
> --
> Markus Pöhler
> netpoint-edv gmbh
> Germany
>
> "Nick P @. INDATA" wrote:
> > Hi,
> >
> > I need some help with making the Printer Delivery Extension play nicely with
> > RS equipped with Forms Authentication/Custom Security. We have been using the
> > forms authentication for some time but just recently decided to implement the
> > Printer Delivery Extension.
> >
> > The Problem:
> > With Forms Authentication, the Printer Delivery Extension CANNOT SEE NETWORK
> > PRINTERS.
> >
> > I am sure this has something to do with permissions but what I am unsure
> > about is how to go about resolving this issue.
> >
> > Basically when we try to use a network printer and then try to specify that
> > network printer for a subscription using the Printer Delivery Extension, the
> > Extension calls the IsValidPrinter() method which loops through the
> > PrinterSettings.InstalledPrinters collection looking for the printer I
> > specified. ONLY the local printers are displaying in that collection, no
> > network printers. I know this because I attached to the process and debugged
> > it inspecting the contents of that collection. So I know for sure NONE of the
> > network printers are in there.
> >
> > Any help would be greatly appreciated!
> >
> > Thanks,
> >
> > Nick @. INDATA|||Can someone please help?
"Nick P @. INDATA" wrote:
> Hi,
> I need some help with making the Printer Delivery Extension play nicely with
> RS equipped with Forms Authentication/Custom Security. We have been using the
> forms authentication for some time but just recently decided to implement the
> Printer Delivery Extension.
> The Problem:
> With Forms Authentication, the Printer Delivery Extension CANNOT SEE NETWORK
> PRINTERS.
> I am sure this has something to do with permissions but what I am unsure
> about is how to go about resolving this issue.
> Basically when we try to use a network printer and then try to specify that
> network printer for a subscription using the Printer Delivery Extension, the
> Extension calls the IsValidPrinter() method which loops through the
> PrinterSettings.InstalledPrinters collection looking for the printer I
> specified. ONLY the local printers are displaying in that collection, no
> network printers. I know this because I attached to the process and debugged
> it inspecting the contents of that collection. So I know for sure NONE of the
> network printers are in there.
> Any help would be greatly appreciated!
> Thanks,
> Nick @. INDATA

Help! How to give replication admin access without giving system a

Hi,
Currently we have a problem regarding security for replication. We have
a SQLServer that hosts about 30 databases. One of the database owner
requests that he needs to setup replication. But I don't want him to give
full 'system admin' rights to setup replication as he might mess up other
sqlserver settings and other databases that don't concern him. What is the
best way so that I can grant him enough access, so he can setup replication
for his database, and I don't have to worry about compromising the security
of other databases and the server.
Thanks
Hi Tony,
To administer replication through the enterprise manager you have to be a
member of the sysadmin role, and therefor have unlimited access to the whole
server.
The only way I can think of is to develop your own custom application using
SQL-DMO and/or SQL server ActiveX objects for administering a specific
replication.
see BOL, "Replication Programming"
Regards,
Jorgen D:
"Tony" wrote:

> Hi,
> Currently we have a problem regarding security for replication. We have
> a SQLServer that hosts about 30 databases. One of the database owner
> requests that he needs to setup replication. But I don't want him to give
> full 'system admin' rights to setup replication as he might mess up other
> sqlserver settings and other databases that don't concern him. What is the
> best way so that I can grant him enough access, so he can setup replication
> for his database, and I don't have to worry about compromising the security
> of other databases and the server.
> Thanks
>

Help with using integrated security

I am building a reporting aspect of my .NET web app, and I have already come
accross the problem where if the app is hosted on a server and the backend
SQL database is hosted on another server, I cannot use integreated security
to retrieve data from the sql server (unless deligation is turned on...).
Now, our Report server is on a third machine. Can my data source(s) on the
report server use Integrated Authentication? A brief test failed, saying
cannot authorize NT/Anonymous but I may have set something up incorrectly.
Any suggestions?
BenThere is a double hop issue that you might be coming up against. You have to
be using Kerberos to be getting around this. Search the MS site for the
phrase double hop and you should find info on it and can see if it matches
your problem.
Bruce Loehle-Conger
MVP SQL Server Reporting Services
"Ben" <ben_1_ AT hotmail DOT com> wrote in message
news:B7DDBD38-A4FD-4EF2-AAA7-95D0B0478FDD@.microsoft.com...
>I am building a reporting aspect of my .NET web app, and I have already
>come
> accross the problem where if the app is hosted on a server and the backend
> SQL database is hosted on another server, I cannot use integreated
> security
> to retrieve data from the sql server (unless deligation is turned on...).
> Now, our Report server is on a third machine. Can my data source(s) on
> the
> report server use Integrated Authentication? A brief test failed, saying
> cannot authorize NT/Anonymous but I may have set something up incorrectly.
> Any suggestions?
> Ben|||Bruce
Thank you for the reply. I haven't done the search but I guess its the same
problem I'm having with the asp.net app im building.
Its funny, best practises says your db, your app and report server should
all be separate and integrated security used, but this setup doesnt naitively
work with integrated security.
thanks for the help.
"Bruce L-C [MVP]" wrote:
> There is a double hop issue that you might be coming up against. You have to
> be using Kerberos to be getting around this. Search the MS site for the
> phrase double hop and you should find info on it and can see if it matches
> your problem.
>
> --
> Bruce Loehle-Conger
> MVP SQL Server Reporting Services
> "Ben" <ben_1_ AT hotmail DOT com> wrote in message
> news:B7DDBD38-A4FD-4EF2-AAA7-95D0B0478FDD@.microsoft.com...
> >I am building a reporting aspect of my .NET web app, and I have already
> >come
> > accross the problem where if the app is hosted on a server and the backend
> > SQL database is hosted on another server, I cannot use integreated
> > security
> > to retrieve data from the sql server (unless deligation is turned on...).
> > Now, our Report server is on a third machine. Can my data source(s) on
> > the
> > report server use Integrated Authentication? A brief test failed, saying
> > cannot authorize NT/Anonymous but I may have set something up incorrectly.
> >
> > Any suggestions?
> > Ben
>
>|||You can use delegation, a feature built into 2K3 and AD. See this
link:
http://technet2.microsoft.com/WindowsServer/en/Library/c312ba01-318f-46ca-990e-a597f3c294eb1033.mspx
Bruce L-C [MVP] wrote:
> There is a double hop issue that you might be coming up against. You have to
> be using Kerberos to be getting around this. Search the MS site for the
> phrase double hop and you should find info on it and can see if it matches
> your problem.
>
> --
> Bruce Loehle-Conger
> MVP SQL Server Reporting Services
> "Ben" <ben_1_ AT hotmail DOT com> wrote in message
> news:B7DDBD38-A4FD-4EF2-AAA7-95D0B0478FDD@.microsoft.com...
> >I am building a reporting aspect of my .NET web app, and I have already
> >come
> > accross the problem where if the app is hosted on a server and the backend
> > SQL database is hosted on another server, I cannot use integreated
> > security
> > to retrieve data from the sql server (unless deligation is turned on...).
> > Now, our Report server is on a third machine. Can my data source(s) on
> > the
> > report server use Integrated Authentication? A brief test failed, saying
> > cannot authorize NT/Anonymous but I may have set something up incorrectly.
> >
> > Any suggestions?
> > Ben