I am trying to implement some better security practices for our database systems. Right now, dbo is owned by SA. I plan to create new accounts on each server, with differing passwords, and assign SysAdmin to that local user. For many databases, dbo user is linked to the SA login. I can change these using ALTER AUTHORIZATION... no biggie.

My question is, I see MASTER and some other DB's have this mapping of DBO to SA. I don't believe that the DB Owner can be set to anything but SA on these db's.

Will disabling the SA account have impact on the opperation of the system databases when DBO is mapped to SA?

Thank you!



No, DBO is essentially just a default schema and you can make other accounts with different privileges that have separate schemas. Even though, not quite sure how disabling the SA would help in elevating security

  • It's always been my understanding that disabling the default SA login is best practice since everyone out there knows that sid 0x01 is SA and has SysAdmin permissions on a server... ...Creating an alternate login with SysAdmin en lieu of the SA login provides added security of an unknown SID being the designated, local, SysAdmin login. – Wes Jan 25 '17 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.