1

I have a set of databases on a server.

  • Database_alpha
  • Database_beta
  • Database_gamma
  • Database_delta

Database_alpha houses a legacy CRM system which has an inbuilt dependency on the sa account to function. Problem is that overtime the db_owner of each database has been assigned to sa.

One mitigation that seems for at least is to enable the sa account for database_alpha so that any system\crm work can be carried out then. It improves on the current situation.

So what is the norm for other database owners. I know it has to be an account of least privilege at least and the name for each database be like this. Is something like this acceptable. Can the accounts then be disabled.

  • Database_alpha sa
  • Database_beta Database_beta_8fe0eaf0
  • Database_gamma Database_gamma_9b253adb
  • Database_delta Database_delta_d8ed5661

Appreciate your views or alternate strategies or general suggestions.

Improve this question
3
  • 1
    Please clarify your specific problem or provide additional details to highlight exactly what you need. As it's currently written, it's hard to tell exactly what you're asking.
    – Community Bot
    Commented Nov 29, 2023 at 19:07
  • And clarify why you're worried about having sa as the owner of all the databases.
    – David Browne - Microsoft
    Commented Nov 29, 2023 at 19:32
  • Mainly because we recently had SQL Server Vulns: VA2201, VA1058, VA1258 & VA2108 come across our desks for our SQL Server where these databases are held. We inherited the DB from the service supplier so it was pre-configured so now we have to hit these as part of internal audit responsibilities. So the goal is to close off these and also use it as a chance to implement best practice.
    – betelgeuce
    Commented Nov 30, 2023 at 1:28

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.