7

I'm setting up a server that my company will be managing for one of our clients. This server runs an application that is managed by a 3rd party. We are responsible for the server and OS and the 3rd-party is responsible for the application and the MS SQL databases. I'm wondering if the 3rd party is given SA rights to SQL if this will allow them any sort of control over the OS side. SQL is not my forte. We would be using Server 2008 R2 with MS SQL Server 2008.

Thanks.

Improve this question

2 Answers 2

Reset to default
10

sysadmin rights allow the use of things like xp_cmdshell and the sp_OA% stored procs which can affect the underlying OS, but it depends on the service account used

If you limit the service account permissions (eg not local system, not local admin and certainly not domain admin) then it's pretty much OK. The SQL installer limits the permissions of the service account during install, of course this assumes you don't escalate permissions yourself.

Improve this answer
2
  • So the vendor would need an OS level account capable of assigning elevated permissions to the service account in order for this to be an issue (they will not have such an account)? Out of the box the service account should be secure?
    – D43m0n
    Commented May 31, 2013 at 14:16
  • 1
    @D43m0n: yes, stock service account is OK. Note, as a sysadmin in SQL Server they don't need OS access anyway, except (I would allow it) to the SQL Server data/log/backup folders for well, dba, work. Nowhere else.
    – gbn
    Commented May 31, 2013 at 14:19
0

The short answer, is no. Granting the local SQL SA account rights to a SQL instance/databases does not have any bearing on the Operating System itself.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.