can we delete NT AUTHORITY\SYSTEM in sql server 2005?

Hi Folks,
In our sql server 2005 cluster server, we have a loginuser called
NT AUTHORITY\SYSTEM with sysadmin server role.
What is the purpose of that account?
Can we delete that login?
If we delete that will there be any problems?
We are using separate domain accounts for all sql services.
Please help.
Thank you
--KumarKumar,
Visit following link:
http://support.microsoft.com/kb/263712
NT AUTHORITY\SYSTEM restricts NT ADMIN and help to execute FullText as
FullText need builtin\administrators or NT AUTHORITY\SYSTEM.
Hope this will help.
"Kumar" wrote:
> Hi Folks,
> In our sql server 2005 cluster server, we have a loginuser called
> NT AUTHORITY\SYSTEM with sysadmin server role.
> What is the purpose of that account?
> Can we delete that login?
> If we delete that will there be any problems?
> We are using separate domain accounts for all sql services.
> Please help.
> Thank you
> --Kumarsql

Can user view objects they only have select permission on?

I have a user that belongs to a role. This role only has select permissions
on 10 views. When I log in as this user via Management Studio I cannot see
the views however I can execute queries against them.
On another server that I did not setup, that I'm supposed to be mimicking
the same security, this same user can see the views.
Any ideas what the difference is?
Thanks!Here's the commands that I'm executing in order:
CREATE ROLE [Customers_ROLE] Authorization dbo
CREATE SCHEMA [Customers_Schema] AUTHORIZATION [Customers_Role] Deny
View
Definition to [Customers_Role]
exec sp_adduser 'phenson', 'phenson', [Customers_Role]
GRANT SELECT ON [dbo].[PT_VIEW] TO [Customers_Role]
When I log in as phenson I do not see PT_View but I can query on it. I need
to be able to see it.
"SpankyATL" wrote:

> I have a user that belongs to a role. This role only has select permissio
ns
> on 10 views. When I log in as this user via Management Studio I cannot se
e
> the views however I can execute queries against them.
> On another server that I did not setup, that I'm supposed to be mimicking
> the same security, this same user can see the views.
> Any ideas what the difference is?
> Thanks!|||I thought I'd answer my own question for those of you who come across this
some day. I need to remove the "Deny View Definition" portion and that took
care of it. The user was able to see that view and execute it but could not
see the script.
"SpankyATL" wrote:
[vbcol=seagreen]
> Here's the commands that I'm executing in order:
> CREATE ROLE [Customers_ROLE] Authorization dbo
> CREATE SCHEMA [Customers_Schema] AUTHORIZATION [Customers_Role] De
ny View
> Definition to [Customers_Role]
> exec sp_adduser 'phenson', 'phenson', [Customers_Role]
> GRANT SELECT ON [dbo].[PT_VIEW] TO [Customers_Role]
>
> When I log in as phenson I do not see PT_View but I can query on it. I ne
ed
> to be able to see it.
> "SpankyATL" wrote:
>|||SpankyATL (SpankyATL@.discussions.microsoft.com) writes:
> Here's the commands that I'm executing in order:
> CREATE ROLE [Customers_ROLE] Authorization dbo
> CREATE SCHEMA [Customers_Schema] AUTHORIZATION [Customers_Role] De
ny View
> Definition to [Customers_Role]
> exec sp_adduser 'phenson', 'phenson', [Customers_Role]
> GRANT SELECT ON [dbo].[PT_VIEW] TO [Customers_Role]
>
> When I log in as phenson I do not see PT_View but I can query on it. I
> need to be able to see it.
Why then did you do DENY VIEW DEFINITION to a role that you made phenson a
member of?
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx|||I was working from a script that was given to me. The person who developed
it mistakenly thought deny view would only deny the user from viewing the
source code.
"Erland Sommarskog" wrote:

> SpankyATL (SpankyATL@.discussions.microsoft.com) writes:
> Why then did you do DENY VIEW DEFINITION to a role that you made phenson a
> member of?
>
> --
> Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
> Books Online for SQL Server 2005 at
> http://www.microsoft.com/technet/pr...oads/books.mspx
> Books Online for SQL Server 2000 at
> http://www.microsoft.com/sql/prodin...ions/books.mspx
>

can not view DTS Packages and Jobs

I have SQL 2k SP4 on Windows 2003
Can A sqlserver user, with out having SA role, see the DTS packages, Job and
their status ?
RK
Yes, partially, through some workarounds.
If you make a SQL Server user a member of the msdb database
TargetServersRole, they will be able to see all jobs and their statuses, but
will not be able to create or modify jobs. (So this does not work for
someone who should be able to create his own jobs. This is an undocumented
sideeffect of the role and will not work in SQL Server 2005. But 2005 has
specific new roles for granting various degrees of access to SQL Agent
jobs.)
If, instead of storing DTS packages as SQL Server objects, you store them as
files on a file share, then anyone who has rights to the file share
(read/only if you want that) can examine the contents of the DTS package, as
well. (If there is a workaround for examining DTS packages stored on the
server, I don't know it.)
RLF
"RK73" <RK73@.discussions.microsoft.com> wrote in message
news:4401345C-6ABC-44EA-9756-EDD1133CDCE1@.microsoft.com...
>I have SQL 2k SP4 on Windows 2003
> Can A sqlserver user, with out having SA role, see the DTS packages, Job
> and
> their status ?
> --
> RK
|||Thank you Russel
I stored the DTS as stuctures storage file. What application/viewer do you
use the examine the contents ?
RK
"Russell Fields" wrote:

> Yes, partially, through some workarounds.
> If you make a SQL Server user a member of the msdb database
> TargetServersRole, they will be able to see all jobs and their statuses, but
> will not be able to create or modify jobs. (So this does not work for
> someone who should be able to create his own jobs. This is an undocumented
> sideeffect of the role and will not work in SQL Server 2005. But 2005 has
> specific new roles for granting various degrees of access to SQL Agent
> jobs.)
> If, instead of storing DTS packages as SQL Server objects, you store them as
> files on a file share, then anyone who has rights to the file share
> (read/only if you want that) can examine the contents of the DTS package, as
> well. (If there is a workaround for examining DTS packages stored on the
> server, I don't know it.)
> RLF
> "RK73" <RK73@.discussions.microsoft.com> wrote in message
> news:4401345C-6ABC-44EA-9756-EDD1133CDCE1@.microsoft.com...
>
>
|||RK,
From Enterprise Manager you right-click on Data Transformation Services and
choose Open Package. It will then open a package from a structured storage
file into the DTS editor.
RLF
"RK73" <RK@.discussions.microsoft.com> wrote in message
news:7B708C46-D5CB-46B3-BCA8-9A91FA26C035@.microsoft.com...[vbcol=seagreen]
> Thank you Russel
> I stored the DTS as stuctures storage file. What application/viewer do you
> use the examine the contents ?
> --
> RK
>
> "Russell Fields" wrote:

can not view DTS Packages and Jobs

I have SQL 2k SP4 on Windows 2003
Can A sqlserver user, with out having SA role, see the DTS packages, Job and
their status ?
--
RKYes, partially, through some workarounds.
If you make a SQL Server user a member of the msdb database
TargetServersRole, they will be able to see all jobs and their statuses, but
will not be able to create or modify jobs. (So this does not work for
someone who should be able to create his own jobs. This is an undocumented
sideeffect of the role and will not work in SQL Server 2005. But 2005 has
specific new roles for granting various degrees of access to SQL Agent
jobs.)
If, instead of storing DTS packages as SQL Server objects, you store them as
files on a file share, then anyone who has rights to the file share
(read/only if you want that) can examine the contents of the DTS package, as
well. (If there is a workaround for examining DTS packages stored on the
server, I don't know it.)
RLF
"RK73" <RK73@.discussions.microsoft.com> wrote in message
news:4401345C-6ABC-44EA-9756-EDD1133CDCE1@.microsoft.com...
>I have SQL 2k SP4 on Windows 2003
> Can A sqlserver user, with out having SA role, see the DTS packages, Job
> and
> their status ?
> --
> RK|||Thank you Russel
I stored the DTS as stuctures storage file. What application/viewer do you
use the examine the contents ?
--
RK
"Russell Fields" wrote:

> Yes, partially, through some workarounds.
> If you make a SQL Server user a member of the msdb database
> TargetServersRole, they will be able to see all jobs and their statuses, b
ut
> will not be able to create or modify jobs. (So this does not work for
> someone who should be able to create his own jobs. This is an undocumented
> sideeffect of the role and will not work in SQL Server 2005. But 2005 has
> specific new roles for granting various degrees of access to SQL Agent
> jobs.)
> If, instead of storing DTS packages as SQL Server objects, you store them
as
> files on a file share, then anyone who has rights to the file share
> (read/only if you want that) can examine the contents of the DTS package,
as
> well. (If there is a workaround for examining DTS packages stored on the
> server, I don't know it.)
> RLF
> "RK73" <RK73@.discussions.microsoft.com> wrote in message
> news:4401345C-6ABC-44EA-9756-EDD1133CDCE1@.microsoft.com...
>
>|||RK,
From Enterprise Manager you right-click on Data Transformation Services and
choose Open Package. It will then open a package from a structured storage
file into the DTS editor.
RLF
"RK73" <RK@.discussions.microsoft.com> wrote in message
news:7B708C46-D5CB-46B3-BCA8-9A91FA26C035@.microsoft.com...[vbcol=seagreen]
> Thank you Russel
> I stored the DTS as stuctures storage file. What application/viewer do you
> use the examine the contents ?
> --
> RK
>
> "Russell Fields" wrote:
>

can not view DTS Packages and Jobs

I have SQL 2k SP4 on Windows 2003
Can A sqlserver user, with out having SA role, see the DTS packages, Job and
their status ?
--
RKYes, partially, through some workarounds.
If you make a SQL Server user a member of the msdb database
TargetServersRole, they will be able to see all jobs and their statuses, but
will not be able to create or modify jobs. (So this does not work for
someone who should be able to create his own jobs. This is an undocumented
sideeffect of the role and will not work in SQL Server 2005. But 2005 has
specific new roles for granting various degrees of access to SQL Agent
jobs.)
If, instead of storing DTS packages as SQL Server objects, you store them as
files on a file share, then anyone who has rights to the file share
(read/only if you want that) can examine the contents of the DTS package, as
well. (If there is a workaround for examining DTS packages stored on the
server, I don't know it.)
RLF
"RK73" <RK73@.discussions.microsoft.com> wrote in message
news:4401345C-6ABC-44EA-9756-EDD1133CDCE1@.microsoft.com...
>I have SQL 2k SP4 on Windows 2003
> Can A sqlserver user, with out having SA role, see the DTS packages, Job
> and
> their status ?
> --
> RK|||Thank you Russel
I stored the DTS as stuctures storage file. What application/viewer do you
use the examine the contents ?
--
RK
"Russell Fields" wrote:
> Yes, partially, through some workarounds.
> If you make a SQL Server user a member of the msdb database
> TargetServersRole, they will be able to see all jobs and their statuses, but
> will not be able to create or modify jobs. (So this does not work for
> someone who should be able to create his own jobs. This is an undocumented
> sideeffect of the role and will not work in SQL Server 2005. But 2005 has
> specific new roles for granting various degrees of access to SQL Agent
> jobs.)
> If, instead of storing DTS packages as SQL Server objects, you store them as
> files on a file share, then anyone who has rights to the file share
> (read/only if you want that) can examine the contents of the DTS package, as
> well. (If there is a workaround for examining DTS packages stored on the
> server, I don't know it.)
> RLF
> "RK73" <RK73@.discussions.microsoft.com> wrote in message
> news:4401345C-6ABC-44EA-9756-EDD1133CDCE1@.microsoft.com...
> >I have SQL 2k SP4 on Windows 2003
> > Can A sqlserver user, with out having SA role, see the DTS packages, Job
> > and
> > their status ?
> > --
> > RK
>
>|||RK,
From Enterprise Manager you right-click on Data Transformation Services and
choose Open Package. It will then open a package from a structured storage
file into the DTS editor.
RLF
"RK73" <RK@.discussions.microsoft.com> wrote in message
news:7B708C46-D5CB-46B3-BCA8-9A91FA26C035@.microsoft.com...
> Thank you Russel
> I stored the DTS as stuctures storage file. What application/viewer do you
> use the examine the contents ?
> --
> RK
>
> "Russell Fields" wrote:
>> Yes, partially, through some workarounds.
>> If you make a SQL Server user a member of the msdb database
>> TargetServersRole, they will be able to see all jobs and their statuses,
>> but
>> will not be able to create or modify jobs. (So this does not work for
>> someone who should be able to create his own jobs. This is an
>> undocumented
>> sideeffect of the role and will not work in SQL Server 2005. But 2005
>> has
>> specific new roles for granting various degrees of access to SQL Agent
>> jobs.)
>> If, instead of storing DTS packages as SQL Server objects, you store them
>> as
>> files on a file share, then anyone who has rights to the file share
>> (read/only if you want that) can examine the contents of the DTS package,
>> as
>> well. (If there is a workaround for examining DTS packages stored on the
>> server, I don't know it.)
>> RLF
>> "RK73" <RK73@.discussions.microsoft.com> wrote in message
>> news:4401345C-6ABC-44EA-9756-EDD1133CDCE1@.microsoft.com...
>> >I have SQL 2k SP4 on Windows 2003
>> > Can A sqlserver user, with out having SA role, see the DTS packages,
>> > Job
>> > and
>> > their status ?
>> > --
>> > RK
>>