2

There has been a security audit for many of our sql servers and per script there are many findings.

One of them says "SA Account has not been disabled"

I know it can be disabled, but can it be renamed.

Please confirm what should i go with "Remove, rename or disable the SA account" and whats he best practise?

3

Yes, sa can be renamed and disabled since SQL Server 2005. It can't be removed

You can then if you wish, create a dummy sa account with, say, a GUID as password and then disable that or for any software that needs it.

Note that this will let you see the new name of the original sa account

SELECT SUSER_NAME(0x01)

  • Thanks , but would renaming in the very first place would make any impact on the application, in case it is using sa somewhere. – KASQLDBA Dec 5 '14 at 13:42
  • Yes, it will break an application that uses it: if an app does, I'd suggest it's a badly writtn app. It won't break SQL Server the application though – gbn Dec 5 '14 at 13:43
  • Thanks , you're answers explained what i was looking for, but i would like to know on elast about its password expiration policy, report says, passwd expiration check not applied. any idea on this ? – KASQLDBA Dec 5 '14 at 13:48
  • See msdn.microsoft.com/en-us/library/ms189828.aspx for CHECK_POLICY etc – gbn Dec 5 '14 at 14:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.