1

https://learn.microsoft.com/en-us/sql/ssms/agent/select-an-account-for-the-sql-server-agent-service?view=sql-server-ver15#windows-domain-account-permissions

This link says that:

member of the Windows Administrators group on the local computer, and is therefore a member of the SQL Server sysadmin fixed server role

Does it mean that all members of local admin group or domain admin group automatically get sysadmin permission to the sql server and can connect and do absolutely anything?

Improve this question

2 Answers 2

Reset to default
4

Does it mean that all members of local admin group automatically get sysadmin permission to the sql server and can connect and do absolutely anything?

Before SQL Server 2008 yes after SQL Server 2008 No( By default). Starting from SQL Server 2008 a member of local windows admin needs to be added in SQL Server logins as administrator for unrestricted access on SQL Server because NT Authority\System account is not added by default as admin in SQL Server login. Windows local admin impersonate this login to get access to SQL Server (before SQL Server 2005). If you add system account as login in SQL Server windows admin would get access to SQL Server. The account which article is talking is NT Authority\System ( built in account) which has admin permissions.

Please note this is no full proof method even though if you dont add windows local admin to SQL Server login they can use PsExe Tool to get access to SQL Server. So basically you can say "A windows admin by hook or by crook have admin access to SQL Server"

Improve this answer
5
  • Does it matter if it were domain admin group?
    – variable
    Commented Aug 18, 2021 at 12:45
  • No matter what account, it has to be local windows admin. Even if it is domain admin but not added as admin in local windows group it would not get access. I have not tried this but that is what the logic says.
    – Shanky
    Commented Aug 18, 2021 at 14:55
  • So the msdn documentation is outdated?
    – variable
    Commented Aug 19, 2021 at 7:35
  • Not outdated but just not totally clear.
    – Shanky
    Commented Aug 19, 2021 at 11:34
  • Specifically the quote from my question suggests that the documentation is for pre 2008. Why do you say it isn't outdated?
    – variable
    Commented Aug 19, 2021 at 14:17
2

It sounds like that blurb might be outdated documentation from the SQL Server 2005 days. In SQL Server 2005 (and older versions), when you installed a new SQL instance, it would automatically add the Built-In\Administrators Windows Group to the sysadmin server role. Since SQL Server 2008 (and newer versions), the installer no longer does this.

You can find more information in this blog post regarding the change.

This other blog post lists out the default users and groups added to the sysadmin role, by SQL Server version, up to SQL Server 2012, for a little more (albeit dated) information and context.

Improve this answer
2
  • How about domain admin group?
    – variable
    Commented Aug 18, 2021 at 12:45
  • @variable No, it is not.
    – J.D.
    Commented Aug 18, 2021 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.