1

Our database server (Microsoft SQL Server 2008 R2) undergoes audit and they are requesting to set the value of Security\BuiltinAdminAreServerAdmins to false from default value of true

Now, since it is a production server, my worry is the effect of taking this action, can anyone tell me the effect when I set it to false?

These are the steps to go on said item.

  1. Open the SQL server management studio

  2. Connect to the "Microsoft Analysis Server"

  3. Right click on the "Microsoft Analysis Server" then select properties

  4. Tick the box for "Show Advanced (All) Properties"

  5. Scroll down till you find [Security \ BuiltinAdminsAreServerAdmins] and check the current value.

  6. If the value set to true then stand on the true and change it to false.

Thank you in advance. Please use the following image as a reference.

enter image description here

1

Ref:

Grant Server Administrator Permissions (Analysis Services)

You need see what accounts are member of local administrator group and determine if those accounts need the privilege mentioned in the document. If these privileges are required and you set to false you will have issues.

By default, members of the local Administrators group are also granted administrative rights in Analysis Server. Although the local group is not explicitly granted membership in the Analysis Services server administrator role, local administrators can create databases, add users and permissions, and perform any other task allowed to system administrators. This behavior is configurable. It is determined by the BuiltinAdminsAreServerAdmins server property, which is set to true by default. You can change this property in SQL Server Management Studio.

To look at the members of local admin group see this picture:

enter image description here

If not you can set to false. If some of those accounts need certain privilege you can create custom roles and add those accounts as member of those roles. See this article for details:

Roles and Permissions (Analysis Services)

  • meaning it's just a matter of access on DB? – Davees John Baclay Sep 13 '17 at 3:20
  • Yes. The risk is that you have some process connecting to SSAS as an administrator because of this privilege, and that will break when you change the setting. To minimize this risk, find all the local administrators on the server and add them explicitly as SSAS administrators. – David Browne - Microsoft Sep 13 '17 at 3:24
  • how to know the local admin access? – Davees John Baclay Sep 13 '17 at 3:57
  • Edited answer, if that is what you are asking. – SqlWorldWide Sep 13 '17 at 9:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.