Is it wise to use Domain Administrator as a SQL Windows Authentication log-in?
+1
A:
In my opinion, I wouldn't use an Administrator account for anything management related (that's my Linux background telling me that root accounts shouldn't be used).
Neurofluxation
2010-03-17 11:44:22
A:
It depends a lot about - well - your size and security practices. It does show a security risk, but whethe rit is wise o wnot depends on the rest of the setup.
TomTom
2010-03-17 11:47:18
+1
A:
a. If you have no security problems than - it doesn't matter.
b. if you are connected to the internet, you shouldn't. someone can attack your domain using holes in sql code if the app you're using uses the domain admin authentication. or if someone get access to your administration machine.
c. there is no linkage between domain admin and sql server admin - so why do it ?
Just to be clear - It is not wise !
Dani
2010-03-17 11:52:02
+2
A:
No. Local admin, perhaps, yes: never domain admin
For example, xp_cmdshell would allow complete control over AD and your environment. CLR code could do the same. Although these are disabled by default, you can't rely on that to protect your entire network.
Edit:
Logging in as a user as domain admin is no different to using Exchange or similar with the same acount. For SQL Server. no extra rights are conferred or implied because all permissions are defined within SQL Server.
So if you only have a "SQL Server Admin" group as sysadmin, and the domain and local admins are not in this group or set up as logins, then they get normal user rights as per their login. Or they can't even connect.
Of course, as domain or enterprise admins they could just add themselves to the "SQL Server Admin" group... but this requires an extra step and restricts your sysadmin to the correct admin group.
After all, you wouldn't let me as SQL God near your Exchange server...
gbn
2010-03-17 12:01:55
Is the OP asking about running SQL Server service under the domain admin user, or logging in to the SQL Server instance using the domain administrator's account?
James B
2010-03-17 12:03:35
@James B: good point, it is about the login not the service account
gbn
2010-03-17 12:05:05
Logging into SQL Server Instance using the Domain Admin account via Windows Authentication.
Ardman
2010-03-17 12:06:10
@gbn, BTW, I totally agree with what you're saying about running the service under a domain admin account - that xp_cmdshell command would leave you wide open!
James B
2010-03-17 12:08:07
Brilliant. Thanks for the additional information. I wasn't 100% sure whether the Domain Admin would grant more permissions, but you've cleared it up :o)
Ardman
2010-03-17 12:37:34
+1
A:
I think some of the posts have assumed you mean to run the SQL Server service under a domain administrator account (which I agree, would be a security hole), but as you have said in your clarification, it is just to log in to do stuff against the database, I don't see a problem with it....As long as the user in question (I'm guessing it's you here), knows not to drop the production database etc.!
Certain things you need to do against an install require DBA priveleges, if you acquire those by being a domain admin, then what difference does it make?
James B
2010-03-17 12:06:33