So I recently moved jobs - one piece of code I've spotted in our build scripts for new SQL Server installations is below.
IF EXISTS ( SELECT * FROM [sys].[syslogins] WHERE [name] = N'NT AUTHORITY\SYSTEM' ) BEGIN DROP LOGIN [NT AUTHORITY\SYSTEM]; END IF EXISTS ( SELECT * FROM [sys].[syslogins] WHERE [name] = N'NT SERVICE\SQLWriter' ) BEGIN DROP LOGIN [NT SERVICE\SQLWriter]; END IF EXISTS ( SELECT * FROM [sys].[syslogins] WHERE [name] = N'NT SERVICE\Winmgmt' ) BEGIN DROP LOGIN [NT SERVICE\Winmgmt]; END GO
These accounts are created during the SQL Server installation process by default.
Are dropping the above logins recommended? Are there any side effects this could cause? What are these logins used for?
I read Can I delete NT SERVICE\SQLWriter and NT SERVICE\Winmgmt logins? but it just isn't concrete enough - I can see what they're needed for but very little else. Do they need sysadmin access? etc.
As an example (taken from Configure Windows Service Accounts and Permissions):
Local System is a very high-privileged built-in account. It has extensive privileges on the local system and acts as the computer on the network. The actual name of the account is
How should I read this? Should it be left with these "high" privileges?