Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I'm setting up a server that my company will be managing for one of our clients. This server runs an application that is managed by a 3rd party. We are responsible for the server and OS and the 3rd-party is responsible for the application and the MS SQL databases. I'm wondering if the 3rd party is given SA rights to SQL if this will allow them any sort of control over the OS side. SQL is not my forte. We would be using Server 2008 R2 with MS SQL Server 2008.

Thanks.

share|improve this question

migrated from serverfault.com May 31 '13 at 14:05

This question came from our site for professional system and network administrators.

2 Answers 2

up vote 10 down vote accepted

sysadmin rights allow the use of things like xp_cmdshell and the sp_OA% stored procs which can affect the underlying OS, but it depends on the service account used

If you limit the service account permissions (eg not local system, not local admin and certainly not domain admin) then it's pretty much OK. The SQL installer limits the permissions of the service account during install, of course this assumes you don't escalate permissions yourself.

share|improve this answer
    
So the vendor would need an OS level account capable of assigning elevated permissions to the service account in order for this to be an issue (they will not have such an account)? Out of the box the service account should be secure? –  D43m0n May 31 '13 at 14:16
1  
@D43m0n: yes, stock service account is OK. Note, as a sysadmin in SQL Server they don't need OS access anyway, except (I would allow it) to the SQL Server data/log/backup folders for well, dba, work. Nowhere else. –  gbn May 31 '13 at 14:19
    
Thanks very much! –  D43m0n May 31 '13 at 19:35

The short answer, is no. Granting the local SQL SA account rights to a SQL instance/databases does not have any bearing on the Operating System itself.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.