I did a Vulnerability Assessment for my database today. I found VA2108 and it suggests me to

ALTER ROLE [db_owner] DROP MEMBER [dbo]

But it's the default setting of any SQL instance.

Should I go for it? And is there any risk?

enter image description here



2 Answers 2


Don't worry about it.

In fact, you cannot drop dbo from db_owner. There's a hard-wired blocker in the engine prohibiting you to do so. Try and you get the error:

Msg 15405, Level 16, State 1, Line 1
Cannot use the special principal 'dbo'.

Flagging dbo is a bug the assessment tool. The purpose of the assessment is to make sure one evaluates whether other members need those permissions.

  • 1
    Yeah people keep saying "don't worry about it" but not why, because it appears as though there is a user on my db that I don't want that has ownership rights of the db and I've no idea how to control or remove it, which is a SERIOUS security problem for me. I'd like to know why this isn't a problem, I've been told about this every week by Azure for nearly two years and still have no idea why, I'm not just approving the baseline and ignoring it, I want to know what it means. Microsoft told me they were going to fix it over a year ago.
    – ataraxia
    Commented Jul 14, 2021 at 14:48

It sounds like the vulnerability audit tool you use just always flags whenever a User, is mapped to the db_owner role, which in this case is the default dbo.

I believe there has to always be one db_owner of a database and as previously mentioned dbo is the default. So you won't be able to change this without first setting another User as the db_owner, which will get flagged by your audit anyway.

All things considered, this isn't the end of the world to leave as the default, as you can disable the Login associated with the dbo User.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.