Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

Purpose

How can I system admin let it be me, but another users and admins must be cannot access my database. My database located on customer server. I deleted all sql users, there's only sa user. This persons don't know my sa password. But this persons created sa similar users, and can access my database. I want block this users to my db.

share|improve this question

migrated from stackoverflow.com Jan 3 '13 at 12:27

This question came from our site for professional and enthusiast programmers.

1  
Don't give anyone else login credentials? –  Flimzy Jan 3 '13 at 7:31
2  
You want to block a customer from using their own server? Good luck with that. Whoever has physical access to the hardware is god. –  Flimzy Jan 3 '13 at 7:54
    
select * from sys.server_principals may help you understanding who get access to what (just a starting point) –  tschmit007 Jan 3 '13 at 9:21
1  
Not possible. See the list of possible issues here netlib.com/sa_lockout.asp (and I notice that they only say they "try" to guard against these) –  Martin Smith Jan 3 '13 at 12:37

2 Answers 2

  1. Ensure there are no unwanted groups like BUILT-IN\ADMINISTRATOR granted rights to the server & therefore your database, as that is a common backdoor for your windows Admin to get into your databases.

  2. Explicitly deny the user access to your database

    use [PrivateDatabaseName]; revoke connect from guest; revoke connect from user1; revoke connect from user2;

share|improve this answer
1  
Did you even bother to test this? Of course it doesn't work and even the syntax is wrong. –  ivanmp Jan 5 '13 at 9:12
    
I did not. My fault. I have updated the syntax. –  John DaCosta Jan 17 '13 at 3:15

You can only really hope to log this and raise alerts. Users who can administer the hardware can always stop the service and bring a database up in single user mode etc. They can give themselves elevated permissions etc.

It's a common requirement to segregate administrative duties so that server admins cannot see confidential files or confidential data.

However, because every administrative role can typically elevate their rights or create other users, requiring users to use least privilege accounts for their daily work and auditing what is done with elevated accounts is really the only way to deal with it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.