7

Don't worry about it, as J.D. says. In fact, you cannot drop dbo from db_owner. There's a hard-wired blocker in the engine prohibiting you to do so. Try and you get the error: Msg 15405, Level 16, State 1, Line 1 Cannot use the special principal 'dbo'.


6

It sounds like the vulnerability audit tool you use just always flags whenever a User, is mapped to the db_owner role, which in this case is the default dbo. I believe there has to always be one db_owner of a database and as previously mentioned dbo is the default. So you won't be able to change this without first setting another User as the db_owner, which ...


4

No, it isn't possible. SQL needs to contact the DC to collect the user/group SID and needs to save it inside the sys.server_principals table in master database.


4

I found the Data Discovery and Classification recommendation suppressions in sys.extended_properties with the property name sys_data_classification_recommendation_disabled. Copying these extended properties to another database successfully suppresses the recommendations. I wrote the following SQL to be run in a database in which classification rules and ...


2

When creating Logins or Users based on a Windows account, that Windows Login or Windows Group needs to be accessible as it's the source of the SID. Now, it is possible to create a Login by supplying an SID, but that only works for SIDs that are for SQL Server accounts. Also, Users created using WITHOUT LOGIN aren't simply orphaned Users that can be connected ...


2

The user is identified by the SID, not the name. See sys.database_principals. If the SID isn't possible to get to (either because it doesn't exist as a login or as in your case a domain controller isn't available), then it isn't possible to create the user. MS could allow us to specify a SID in the CREATE USER command, just as we can do in the CREATE LOGIN ...


2

Analysis the sql comes from sql log only, trying to find out which sql statement has risk of sql injection. By the time the SQL reaches your database, it's probably too late to tell. By the time the SQL reaches the sql log (having been executed), it's definitely too late! If you see lots of placeholders ('?' or ':name'), then your SQL is using Prepared ...


1

Damn, my sleep() idea was oversimplistic! SELECT * FROM users WHERE secure_compare(token, 'abcdef') or... SELECT * FROM users WHERE token = 'abcdef' You'll want to index that to make it fast, which means timing information can be leaked not just from the string comparison, but also from the btree index walk. Can we actually do that? CREATE UNLOGGED TABLE ...


1

As you saw my answer and Tibor's to Should I drop dbo from the database role db_owner? you shouldn't be too concerned about the legacy dbo User. For your ACME User, I agree you should follow the least privileges security principal and therefore if it doesn't need as wide of access as a db_owner then remove it from that role and add only the roles or ...


1

I don't believe it's possible, as MBuschi mentioned the SID of the Domain User is required to create the Login on the server such that a User can be created in the database you're trying to add them to. (A Database User needs a correlating SQL Server Login inside the SQL instance.) So you'd have to have access to the domain from your Dev environment at least ...


Only top voted, non community-wiki answers of a minimum length are eligible