I'm working on a database server hardening project for a client of mine. I'm getting into ownership issues when it comes to the following:

.mdf & .ldf
HKEY--> tree from Microsoft SQL Server on down

So my question is.....who should own the above items? I do know that sa/dbo would be the easy answer, but I'm trying to give the least amount of privileges to these items.


Please see Security SQL Server on MSDN for a great resource on how to properly secure SQL Server.

Security is a very large topic, and needs a lot of thought to be done well. The page linked above contains a large amount of resources from Microsoft about this topic.

From the above page, this is just a sample of topics:

Physical Security

Best practices for physical security strictly limit access to the physical server and hardware components. For example, use locked rooms with restricted access for the database server hardware and networking devices. In addition, limit access to backup media by storing it at a secure offsite location.

Implementing physical network security starts with keeping unauthorized users off the network. The following table contains more information about networking security information.

Operating System Security

Operating system service packs and upgrades include important security enhancements. Apply all updates and upgrades to the operating system after you test them with the database applications.

Firewalls also provide effective ways to implement security. Logically, a firewall is a separator or restrictor of network traffic, which can be configured to enforce your organization's data security policy.

Principals and Database Object Security

Principals are the individuals, groups, and processes granted access to SQL Server. “Securables” are the server, database, and objects the database contains. Each has a set of permissions that can be configured to help reduce the SQL Server surface area.

Database files, including data and log files, as well as backup files, should be owned by the SQL Server Service Account, or in the very least that account should have full control over them. See this MSDN page for more details about that, including for SQL Server executables, and the Registry.

| improve this answer | |
  • 1
    Hi Max, I have been through the Security for SQL Server 2016 section in MSDN and I have a very detailed plan for my hardening project. I also have read Dennis Cherry's "Securing SQL Server" book to help build up the tasks that I will be performing to complete the project. However, I'm kind of stuck on the question I asked here. Any help would be appreciated. Warm Regards, KimTessereau-SQLology – KimTessereau-SQLology Mar 15 '17 at 19:06
  • Hi @Kim - I've added a link at the bottom of my answer directly to a section in MSDN than should have all the answers. – Max Vernon Mar 15 '17 at 19:16
  • You may want to provide further clarification in your question about exactly what concerns you have, or exactly what you are considering doing. As it stands your question is not very well scoped. – Max Vernon Mar 15 '17 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.