I have taken the descision to remove
'BUILTIN\Administrators' group from my clustered instances. This is not done before I inherited this environment and some violation in my oppinion is happening on the SQL Servers.
To do this Im asked to generate a risk assesment report.
I have a couple of questions, but first my intended aproach.
Today SA pwd is unknown to everyone, even me. If it's needed pwd is reset to something temporary, and a job resetting the pwd is created. To secure access I will
create a AD group, add this group to the sql server and grant this domain group the sysadmin server role. I will also generate a new SA pwd and redesign the temporary SA pwd solution to reset the pwd back to whatever I generate. This pwd will go into a safe.
I know how to fix it if I loose all access to SQL Server, by using a startup flag and then adding another domain group, should some clumsy admin drop the one I created.
To my question, does the cluster service account need to be a member in this SQL access account?
The SQL Service account, and SQL Agent is to be incorporated into this new domain group. My account and some other DBA will have their accounts added. No accidental
DBA's will then have access from this point forward.
What kind of application errors can I expect? The cluster hosts the databases for about 60 different applications. Can I Trace who logs on with the
View Complete Post