Can we disable SA Account in SQL Server.

Hi,
I am running SQL Server 2000 SP3. For Security purpose i want to
disable SA Account.
But i am not sure that, we can disable SA account.
Please give me reply.
Thanks & Regards,
Sajid C.Hi
You cannot disable SA account. You can remove BUILTIN/Administrators login
to ensure that users of Windows admin group do not get autamically access
to SQL Server
<csajid@.gmail.com> wrote in message
news:1155022050.211678.192190@.b28g2000cwb.googlegroups.com...
> Hi,
> I am running SQL Server 2000 SP3. For Security purpose i want to
> disable SA Account.
> But i am not sure that, we can disable SA account.
> Please give me reply.
> Thanks & Regards,
> Sajid C.
>|||Uri Dimant wrote:
[vbcol=seagreen]
> Hi
> You cannot disable SA account. You can remove BUILTIN/Administrators login
> to ensure that users of Windows admin group do not get autamically access
> to SQL Server
>
> <csajid@.gmail.com> wrote in message
> news:1155022050.211678.192190@.b28g2000cwb.googlegroups.com...
If you are usin SQL Server 2005 you can disable it by
alter login sa disable
even you can rename it
alter login sa with name = <new name for sa>
Regards
Amish Shah
http://shahamishm.tripod.com|||amish
> disable SA Account.
Yep, but he is using SQL Server 2000
"amish" <shahamishm@.gmail.com> wrote in message
news:1155030451.500469.238540@.m73g2000cwd.googlegroups.com...
> Uri Dimant wrote:
>
> If you are usin SQL Server 2005 you can disable it by
> alter login sa disable
> even you can rename it
> alter login sa with name = <new name for sa>
> Regards
> Amish Shah
> http://shahamishm.tripod.com
>|||With SQL 2000, Give the sa account a complex and strong password, lock the
password in a safe, and don't allow anyone to use the sa account.
Arnie Rowland, Ph.D.
Westwood Consulting, Inc
Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous
<csajid@.gmail.com> wrote in message
news:1155022050.211678.192190@.b28g2000cwb.googlegroups.com...
> Hi,
> I am running SQL Server 2000 SP3. For Security purpose i want to
> disable SA Account.
> But i am not sure that, we can disable SA account.
> Please give me reply.
> Thanks & Regards,
> Sajid C.
>|||Hi all,
Thanks for your Reply.
Thanks & Regards,
Sajid C.
Arnie Rowland wrote:[vbcol=seagreen]
> With SQL 2000, Give the sa account a complex and strong password, lock the
> password in a safe, and don't allow anyone to use the sa account.
> --
> Arnie Rowland, Ph.D.
> Westwood Consulting, Inc
> Most good judgment comes from experience.
> Most experience comes from bad judgment.
> - Anonymous
>
> <csajid@.gmail.com> wrote in message
> news:1155022050.211678.192190@.b28g2000cwb.googlegroups.com...

Can we disable SA Account in SQL Server.

Hi,
I am running SQL Server 2000 SP3. For Security purpose i want to
disable SA Account.
But i am not sure that, we can disable SA account.
Please give me reply.
Thanks & Regards,
Sajid C.Hi
You cannot disable SA account. You can remove BUILTIN/Administrators login
to ensure that users of Windows admin group do not get autamically access
to SQL Server
<csajid@.gmail.com> wrote in message
news:1155022050.211678.192190@.b28g2000cwb.googlegroups.com...
> Hi,
> I am running SQL Server 2000 SP3. For Security purpose i want to
> disable SA Account.
> But i am not sure that, we can disable SA account.
> Please give me reply.
> Thanks & Regards,
> Sajid C.
>|||Uri Dimant wrote:
> Hi
> You cannot disable SA account. You can remove BUILTIN/Administrators login
> to ensure that users of Windows admin group do not get autamically access
> to SQL Server
>
> <csajid@.gmail.com> wrote in message
> news:1155022050.211678.192190@.b28g2000cwb.googlegroups.com...
> > Hi,
> >
> > I am running SQL Server 2000 SP3. For Security purpose i want to
> > disable SA Account.
> >
> > But i am not sure that, we can disable SA account.
> >
> > Please give me reply.
> >
> > Thanks & Regards,
> > Sajid C.
> >
> >
If you are usin SQL Server 2005 you can disable it by
alter login sa disable
even you can rename it
alter login sa with name = <new name for sa>
Regards
Amish Shah
http://shahamishm.tripod.com|||amish
>> I am running SQL Server 2000 SP3. For Security purpose i want to
> disable SA Account.
Yep, but he is using SQL Server 2000
"amish" <shahamishm@.gmail.com> wrote in message
news:1155030451.500469.238540@.m73g2000cwd.googlegroups.com...
> Uri Dimant wrote:
>> Hi
>> You cannot disable SA account. You can remove BUILTIN/Administrators
>> login
>> to ensure that users of Windows admin group do not get autamically
>> access
>> to SQL Server
>>
>> <csajid@.gmail.com> wrote in message
>> news:1155022050.211678.192190@.b28g2000cwb.googlegroups.com...
>> > Hi,
>> >
>> > I am running SQL Server 2000 SP3. For Security purpose i want to
>> > disable SA Account.
>> >
>> > But i am not sure that, we can disable SA account.
>> >
>> > Please give me reply.
>> >
>> > Thanks & Regards,
>> > Sajid C.
>> >
>> >
> If you are usin SQL Server 2005 you can disable it by
> alter login sa disable
> even you can rename it
> alter login sa with name = <new name for sa>
> Regards
> Amish Shah
> http://shahamishm.tripod.com
>|||With SQL 2000, Give the sa account a complex and strong password, lock the
password in a safe, and don't allow anyone to use the sa account.
--
Arnie Rowland, Ph.D.
Westwood Consulting, Inc
Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous
<csajid@.gmail.com> wrote in message
news:1155022050.211678.192190@.b28g2000cwb.googlegroups.com...
> Hi,
> I am running SQL Server 2000 SP3. For Security purpose i want to
> disable SA Account.
> But i am not sure that, we can disable SA account.
> Please give me reply.
> Thanks & Regards,
> Sajid C.
>|||Hi all,
Thanks for your Reply.
Thanks & Regards,
Sajid C.
Arnie Rowland wrote:
> With SQL 2000, Give the sa account a complex and strong password, lock the
> password in a safe, and don't allow anyone to use the sa account.
> --
> Arnie Rowland, Ph.D.
> Westwood Consulting, Inc
> Most good judgment comes from experience.
> Most experience comes from bad judgment.
> - Anonymous
>
> <csajid@.gmail.com> wrote in message
> news:1155022050.211678.192190@.b28g2000cwb.googlegroups.com...
> > Hi,
> >
> > I am running SQL Server 2000 SP3. For Security purpose i want to
> > disable SA Account.
> >
> > But i am not sure that, we can disable SA account.
> >
> > Please give me reply.
> >
> > Thanks & Regards,
> > Sajid C.
> >

Can someone, MS?, please explain the Reporting Server security?

I just installed the evaluation version and am comparing it to Crystal
Reports. I can't seem to figure out the user level security.
My set-up:
Web server Win2003: Has IIS6 and Report server
DB SQL Server Win 2003: has Sql Server 2k
These boxes are not on a domain, they are test machines.
I open the report server up and get the home page, I can add folder, files,
etc but I no user level security. I went into site settings and all I can
find is roles, but no logins, etc.' I can go to the site and do everything
with no login?
Help.you are correct. Where you've gone awry is the difference between
authentication and authorization.
authentication is the process of determining who you are, most commonly done
via a username and password.
authorization is the process of determining what you can do now that we know
who you are.
In the Reporting Services world, RS relies on external authentication. In
other words, somebody other than RS has to authenticate the user. In most
cases that will be windows. So all user accounts are created in windows.
Users are managed there as per normal.
In the security settings you then create roles. Those roles have specific
permissions on report items etc. You then assign windows users and groups
these roles.
So if we take Joe User... His user account is maintained in windows (userID,
Password etc) either at the domain or the server level. Joe's account is
then assigned to roles in RS which determine what he can do with RS.
Make sense?
Regards,
Rob Labbé, MCP, MCAD, MCSD, MCT
Lead Architect/Trainer
Fidelis
Blog: http://spaces.msn.com/members/roblabbe
"Chris" <Chris@.discussions.microsoft.com> wrote in message
news:B6C6072D-63BC-422F-9DF9-A4400B300EF8@.microsoft.com...
>I just installed the evaluation version and am comparing it to Crystal
> Reports. I can't seem to figure out the user level security.
> My set-up:
> Web server Win2003: Has IIS6 and Report server
> DB SQL Server Win 2003: has Sql Server 2k
> These boxes are not on a domain, they are test machines.
> I open the report server up and get the home page, I can add folder,
> files,
> etc but I no user level security. I went into site settings and all I can
> find is roles, but no logins, etc.' I can go to the site and do
> everything
> with no login?
> Help.|||then why is there several tables that house roles, users, and their assigned
roles then is Sql Server?
Also, Crystal take sit to the lowest level via a "Universe" to a record
level. Does MS Report Serv. not do this either?
Are you saying that I have to add everyone to the windows box? That doesn't
make sense for web reporting, the IUSR account can access everything?
thanx.
"Rob Labbe (Lowney)" wrote:
> you are correct. Where you've gone awry is the difference between
> authentication and authorization.
> authentication is the process of determining who you are, most commonly done
> via a username and password.
> authorization is the process of determining what you can do now that we know
> who you are.
> In the Reporting Services world, RS relies on external authentication. In
> other words, somebody other than RS has to authenticate the user. In most
> cases that will be windows. So all user accounts are created in windows.
> Users are managed there as per normal.
> In the security settings you then create roles. Those roles have specific
> permissions on report items etc. You then assign windows users and groups
> these roles.
> So if we take Joe User... His user account is maintained in windows (userID,
> Password etc) either at the domain or the server level. Joe's account is
> then assigned to roles in RS which determine what he can do with RS.
> Make sense?
> Regards,
>
> --
> Rob Labbé, MCP, MCAD, MCSD, MCT
> Lead Architect/Trainer
> Fidelis
> Blog: http://spaces.msn.com/members/roblabbe
> "Chris" <Chris@.discussions.microsoft.com> wrote in message
> news:B6C6072D-63BC-422F-9DF9-A4400B300EF8@.microsoft.com...
> >I just installed the evaluation version and am comparing it to Crystal
> > Reports. I can't seem to figure out the user level security.
> > My set-up:
> > Web server Win2003: Has IIS6 and Report server
> > DB SQL Server Win 2003: has Sql Server 2k
> >
> > These boxes are not on a domain, they are test machines.
> >
> > I open the report server up and get the home page, I can add folder,
> > files,
> > etc but I no user level security. I went into site settings and all I can
> > find is roles, but no logins, etc.' I can go to the site and do
> > everything
> > with no login?
> >
> > Help.
>
>|||As you've discovered, the security model is vastly different in RS as
compared to Crystal. You're going to drive yourself nuts if you try to do a
one-to-one mapping of security features between the two.
You're best bet is to look at the end result you're after, not "how" it was
implemented in Crystal. Then look at RS security and set it up to get the
same end result. If you describe your scenario, and what the result you're
after is, we may be able to help you out here.
Regards,
Rob Labbé, MCP, MCAD, MCSD, MCT
Lead Architect/Trainer
Fidelis
Blog: http://spaces.msn.com/members/roblabbe
"Chris" <Chris@.discussions.microsoft.com> wrote in message
news:65196924-819E-4F4E-AD10-78D60F4A729C@.microsoft.com...
> then why is there several tables that house roles, users, and their
> assigned
> roles then is Sql Server?
> Also, Crystal take sit to the lowest level via a "Universe" to a record
> level. Does MS Report Serv. not do this either?
> Are you saying that I have to add everyone to the windows box? That
> doesn't
> make sense for web reporting, the IUSR account can access everything?
> thanx.
> "Rob Labbe (Lowney)" wrote:
>> you are correct. Where you've gone awry is the difference between
>> authentication and authorization.
>> authentication is the process of determining who you are, most commonly
>> done
>> via a username and password.
>> authorization is the process of determining what you can do now that we
>> know
>> who you are.
>> In the Reporting Services world, RS relies on external authentication.
>> In
>> other words, somebody other than RS has to authenticate the user. In
>> most
>> cases that will be windows. So all user accounts are created in windows.
>> Users are managed there as per normal.
>> In the security settings you then create roles. Those roles have
>> specific
>> permissions on report items etc. You then assign windows users and
>> groups
>> these roles.
>> So if we take Joe User... His user account is maintained in windows
>> (userID,
>> Password etc) either at the domain or the server level. Joe's account is
>> then assigned to roles in RS which determine what he can do with RS.
>> Make sense?
>> Regards,
>>
>> --
>> Rob Labbé, MCP, MCAD, MCSD, MCT
>> Lead Architect/Trainer
>> Fidelis
>> Blog: http://spaces.msn.com/members/roblabbe
>> "Chris" <Chris@.discussions.microsoft.com> wrote in message
>> news:B6C6072D-63BC-422F-9DF9-A4400B300EF8@.microsoft.com...
>> >I just installed the evaluation version and am comparing it to Crystal
>> > Reports. I can't seem to figure out the user level security.
>> > My set-up:
>> > Web server Win2003: Has IIS6 and Report server
>> > DB SQL Server Win 2003: has Sql Server 2k
>> >
>> > These boxes are not on a domain, they are test machines.
>> >
>> > I open the report server up and get the home page, I can add folder,
>> > files,
>> > etc but I no user level security. I went into site settings and all I
>> > can
>> > find is roles, but no logins, etc.' I can go to the site and do
>> > everything
>> > with no login?
>> >
>> > Help.
>>|||if there is no central login then how do you restrict it as a web app in the
manager? The roles don't appear to be machine or AD roles?
Are we saying that all users get "everything".
I'm still not seeing this. I thought maybe the eval version doesn't have
login dilaogs or something?
thanx.
"Rob Labbe (Lowney)" wrote:
> As you've discovered, the security model is vastly different in RS as
> compared to Crystal. You're going to drive yourself nuts if you try to do a
> one-to-one mapping of security features between the two.
> You're best bet is to look at the end result you're after, not "how" it was
> implemented in Crystal. Then look at RS security and set it up to get the
> same end result. If you describe your scenario, and what the result you're
> after is, we may be able to help you out here.
> Regards,
>
> --
> Rob Labbé, MCP, MCAD, MCSD, MCT
> Lead Architect/Trainer
> Fidelis
> Blog: http://spaces.msn.com/members/roblabbe
> "Chris" <Chris@.discussions.microsoft.com> wrote in message
> news:65196924-819E-4F4E-AD10-78D60F4A729C@.microsoft.com...
> > then why is there several tables that house roles, users, and their
> > assigned
> > roles then is Sql Server?
> > Also, Crystal take sit to the lowest level via a "Universe" to a record
> > level. Does MS Report Serv. not do this either?
> >
> > Are you saying that I have to add everyone to the windows box? That
> > doesn't
> > make sense for web reporting, the IUSR account can access everything?
> >
> > thanx.
> >
> > "Rob Labbe (Lowney)" wrote:
> >
> >> you are correct. Where you've gone awry is the difference between
> >> authentication and authorization.
> >>
> >> authentication is the process of determining who you are, most commonly
> >> done
> >> via a username and password.
> >>
> >> authorization is the process of determining what you can do now that we
> >> know
> >> who you are.
> >>
> >> In the Reporting Services world, RS relies on external authentication.
> >> In
> >> other words, somebody other than RS has to authenticate the user. In
> >> most
> >> cases that will be windows. So all user accounts are created in windows.
> >> Users are managed there as per normal.
> >>
> >> In the security settings you then create roles. Those roles have
> >> specific
> >> permissions on report items etc. You then assign windows users and
> >> groups
> >> these roles.
> >>
> >> So if we take Joe User... His user account is maintained in windows
> >> (userID,
> >> Password etc) either at the domain or the server level. Joe's account is
> >> then assigned to roles in RS which determine what he can do with RS.
> >>
> >> Make sense?
> >>
> >> Regards,
> >>
> >>
> >> --
> >> Rob Labbé, MCP, MCAD, MCSD, MCT
> >> Lead Architect/Trainer
> >> Fidelis
> >>
> >> Blog: http://spaces.msn.com/members/roblabbe
> >>
> >> "Chris" <Chris@.discussions.microsoft.com> wrote in message
> >> news:B6C6072D-63BC-422F-9DF9-A4400B300EF8@.microsoft.com...
> >> >I just installed the evaluation version and am comparing it to Crystal
> >> > Reports. I can't seem to figure out the user level security.
> >> > My set-up:
> >> > Web server Win2003: Has IIS6 and Report server
> >> > DB SQL Server Win 2003: has Sql Server 2k
> >> >
> >> > These boxes are not on a domain, they are test machines.
> >> >
> >> > I open the report server up and get the home page, I can add folder,
> >> > files,
> >> > etc but I no user level security. I went into site settings and all I
> >> > can
> >> > find is roles, but no logins, etc.' I can go to the site and do
> >> > everything
> >> > with no login?
> >> >
> >> > Help.
> >>
> >>
> >>
>
>|||Role and groups are two different things. I do the following. I create a
local group called Reports. For that group I add either individual users or
I add domain groups. Then in the home page of Report Manager, Properties,
New Role Assignment. For the user/group I put in Reports (the local group I
created previously) and I give it Browse rights.
RS is totally integrated with Windows security. If you are not going to be
using that (for instance over the internet) then you need to create your own
authentication that you integrate in with Reporting Service. Search the
books on line on authentication. Lots of good info. Just remember,
authentication and roles are two different thing. Once someone is
authenticated to be in a particular group (or authenticated to be a
particular user) then RS allows them rights based on the role assignment for
that group/user.
Bruce Loehle-Conger
MVP SQL Server Reporting Services
"Chris" <Chris@.discussions.microsoft.com> wrote in message
news:7DABBC90-778B-4991-8177-1E7495A87788@.microsoft.com...
> if there is no central login then how do you restrict it as a web app in
the
> manager? The roles don't appear to be machine or AD roles?
> Are we saying that all users get "everything".
> I'm still not seeing this. I thought maybe the eval version doesn't have
> login dilaogs or something?
> thanx.
> "Rob Labbe (Lowney)" wrote:
> > As you've discovered, the security model is vastly different in RS as
> > compared to Crystal. You're going to drive yourself nuts if you try to
do a
> > one-to-one mapping of security features between the two.
> >
> > You're best bet is to look at the end result you're after, not "how" it
was
> > implemented in Crystal. Then look at RS security and set it up to get
the
> > same end result. If you describe your scenario, and what the result
you're
> > after is, we may be able to help you out here.
> >
> > Regards,
> >
> >
> > --
> > Rob Labbé, MCP, MCAD, MCSD, MCT
> > Lead Architect/Trainer
> > Fidelis
> >
> > Blog: http://spaces.msn.com/members/roblabbe
> >
> > "Chris" <Chris@.discussions.microsoft.com> wrote in message
> > news:65196924-819E-4F4E-AD10-78D60F4A729C@.microsoft.com...
> > > then why is there several tables that house roles, users, and their
> > > assigned
> > > roles then is Sql Server?
> > > Also, Crystal take sit to the lowest level via a "Universe" to a
record
> > > level. Does MS Report Serv. not do this either?
> > >
> > > Are you saying that I have to add everyone to the windows box? That
> > > doesn't
> > > make sense for web reporting, the IUSR account can access everything?
> > >
> > > thanx.
> > >
> > > "Rob Labbe (Lowney)" wrote:
> > >
> > >> you are correct. Where you've gone awry is the difference between
> > >> authentication and authorization.
> > >>
> > >> authentication is the process of determining who you are, most
commonly
> > >> done
> > >> via a username and password.
> > >>
> > >> authorization is the process of determining what you can do now that
we
> > >> know
> > >> who you are.
> > >>
> > >> In the Reporting Services world, RS relies on external
authentication.
> > >> In
> > >> other words, somebody other than RS has to authenticate the user.
In
> > >> most
> > >> cases that will be windows. So all user accounts are created in
windows.
> > >> Users are managed there as per normal.
> > >>
> > >> In the security settings you then create roles. Those roles have
> > >> specific
> > >> permissions on report items etc. You then assign windows users and
> > >> groups
> > >> these roles.
> > >>
> > >> So if we take Joe User... His user account is maintained in windows
> > >> (userID,
> > >> Password etc) either at the domain or the server level. Joe's
account is
> > >> then assigned to roles in RS which determine what he can do with RS.
> > >>
> > >> Make sense?
> > >>
> > >> Regards,
> > >>
> > >>
> > >> --
> > >> Rob Labbé, MCP, MCAD, MCSD, MCT
> > >> Lead Architect/Trainer
> > >> Fidelis
> > >>
> > >> Blog: http://spaces.msn.com/members/roblabbe
> > >>
> > >> "Chris" <Chris@.discussions.microsoft.com> wrote in message
> > >> news:B6C6072D-63BC-422F-9DF9-A4400B300EF8@.microsoft.com...
> > >> >I just installed the evaluation version and am comparing it to
Crystal
> > >> > Reports. I can't seem to figure out the user level security.
> > >> > My set-up:
> > >> > Web server Win2003: Has IIS6 and Report server
> > >> > DB SQL Server Win 2003: has Sql Server 2k
> > >> >
> > >> > These boxes are not on a domain, they are test machines.
> > >> >
> > >> > I open the report server up and get the home page, I can add
folder,
> > >> > files,
> > >> > etc but I no user level security. I went into site settings and all
I
> > >> > can
> > >> > find is roles, but no logins, etc.' I can go to the site and do
> > >> > everything
> > >> > with no login?
> > >> >
> > >> > Help.
> > >>
> > >>
> > >>
> >
> >
> >|||There is a Reporting Services 2005 book screaming to be written, here -
I know I'd buy multiple copies for work if someone could clearly
present this topic.
As is, it would make Oppenheimer stagger across the room for a
Tylenol...

Can see Service Broker queue with SQL Server Login

I have an application that is reading a message from a Service Broker Queue. When I use integrated security with an NT account it works fine. When I use a SQL Server User through Management Studio I can select from the Queue however, when I use this same account through the web app with the SQL Server User, I cannot see the Queue. Is there a grant that I must do to this account to get it to see the Service Broker Objects?

Gary

Service broker doesn't use any special security/access checks other than the normal SQL Server security/ access restrictions. If the queue is visible from the SSMS, but not from the Web app, it means that the Web app it connects with different settings/credentials than the SSMS.

Can Not View Reports (Please Help)

I am running RS on a W2K3 server. I have a report setup with a datasource to
use sql security. When I try to run the report from the server or from a
client I get a login failed for user "userid"
I am not sure what to check and have been toying with this for 3 days now. I
would appreciate any help!
Thank You.Andy,
I have nearly the exaxt same problem.
SQL Server 2000 SP3
SQL Reporting Services SP1 on the server and Report Designer client
W2K3 Server OS.
In Report Manager, I created a new role called View Reports Only which has
View Reports and View Folders permissions. I have assigned authenticated
users to have the View Reports Only role at the Home folder, which propagates
down through all folders and reports. Yet, the users get prompted with a
login / password dialogue when they try to view a report via a url link from
our intranet web page.
So far, the only way a user can run one of the reports is to be a member of
the Local Administrators group on the W2K3 server.
I have not loaded W2K3 Server SP1 yet. I wonder if any fixes for this
situation would be included with it. My company does not want to install
W2K3 Server SP1 on any of our live servers until we have time to do some
testing for any ill side affects.
I also have not loaded Reporting Services SP2 yet until I see fewer negative
posts on here about ill side affects. Unless it gurantees a fix for this
security issue.
Hopefully, someone on here can shed some light on this W2K3 security problem.
I have the exact same setup running on another server without any problems.
The only main difference is the server that behaves correctly is running W2K
Server OS, not W2K3 Server.
--
Owen B
SQL Report Writer
"Andy Jones" wrote:
> I am running RS on a W2K3 server. I have a report setup with a datasource to
> use sql security. When I try to run the report from the server or from a
> client I get a login failed for user "userid"
> I am not sure what to check and have been toying with this for 3 days now. I
> would appreciate any help!
> Thank You.
>
>|||Bump
--
Owen B
SQL Report Writer
"Owen B" wrote:
> Andy,
> I have nearly the exaxt same problem.
> SQL Server 2000 SP3
> SQL Reporting Services SP1 on the server and Report Designer client
> W2K3 Server OS.
>
> In Report Manager, I created a new role called View Reports Only which has
> View Reports and View Folders permissions. I have assigned authenticated
> users to have the View Reports Only role at the Home folder, which propagates
> down through all folders and reports. Yet, the users get prompted with a
> login / password dialogue when they try to view a report via a url link from
> our intranet web page.
> So far, the only way a user can run one of the reports is to be a member of
> the Local Administrators group on the W2K3 server.
> I have not loaded W2K3 Server SP1 yet. I wonder if any fixes for this
> situation would be included with it. My company does not want to install
> W2K3 Server SP1 on any of our live servers until we have time to do some
> testing for any ill side affects.
> I also have not loaded Reporting Services SP2 yet until I see fewer negative
> posts on here about ill side affects. Unless it gurantees a fix for this
> security issue.
> Hopefully, someone on here can shed some light on this W2K3 security problem.
> I have the exact same setup running on another server without any problems.
> The only main difference is the server that behaves correctly is running W2K
> Server OS, not W2K3 Server.
> --
> Owen B
> SQL Report Writer
>
> "Andy Jones" wrote:
> > I am running RS on a W2K3 server. I have a report setup with a datasource to
> > use sql security. When I try to run the report from the server or from a
> > client I get a login failed for user "userid"
> >
> > I am not sure what to check and have been toying with this for 3 days now. I
> > would appreciate any help!
> >
> > Thank You.
> >
> >
> >

Can not remove user from SQL database....

Hello,
I have a Db that has user name of 'dbo' and login name of 'sa'. For
security reasons, I want this gone.
This user was the owner, but I changed the owner to another user and verified.
After doing this, I still cannot remove the dbo - sa user from the DB. I
get errors:
"Selected user cannot be dropped because the user owns objects"
I cannot remove the public or owner roles from this user either.
Any Ideas?
Thanks much,
MarkThe new owner *is* dbo, so you can't remove that.
You cannot remove the sa login either, since this is a special login. In 2005, you can disable it
and rename it (see ALTER LOGIN).
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://sqlblog.com/blogs/tibor_karaszi
"Mrpush" <Mrpush@.discussions.microsoft.com> wrote in message
news:A8C854BD-4307-4557-8479-4EC9CE34353B@.microsoft.com...
> Hello,
> I have a Db that has user name of 'dbo' and login name of 'sa'. For
> security reasons, I want this gone.
> This user was the owner, but I changed the owner to another user and verified.
> After doing this, I still cannot remove the dbo - sa user from the DB. I
> get errors:
> "Selected user cannot be dropped because the user owns objects"
> I cannot remove the public or owner roles from this user either.
> Any Ideas?
> Thanks much,
> Mark|||Tibor,
I'm not sure I understand.
I have many DB's and most of them do not have a "DBO" user attached to them
(especially dbo with sa login name).
I added another user to the DB, SQLADMIN, and made that user the owner.
I now want to remove the dbo user with login name of "sa". Or, I at least I
want to change the "sa" on the dbo user to "SQLADMIN" user login name. I get
the errors when I try to remove the dbo-sa user/login name.
I'm doing this from the DB USERS folder, I am not trying to remove the SA
LOGIN from the logins folder.
How to do it?
Thanks much,
Mark
"Tibor Karaszi" wrote:
> The new owner *is* dbo, so you can't remove that.
> You cannot remove the sa login either, since this is a special login. In 2005, you can disable it
> and rename it (see ALTER LOGIN).
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://sqlblog.com/blogs/tibor_karaszi
>
> "Mrpush" <Mrpush@.discussions.microsoft.com> wrote in message
> news:A8C854BD-4307-4557-8479-4EC9CE34353B@.microsoft.com...
> > Hello,
> >
> > I have a Db that has user name of 'dbo' and login name of 'sa'. For
> > security reasons, I want this gone.
> >
> > This user was the owner, but I changed the owner to another user and verified.
> >
> > After doing this, I still cannot remove the dbo - sa user from the DB. I
> > get errors:
> >
> > "Selected user cannot be dropped because the user owns objects"
> >
> > I cannot remove the public or owner roles from this user either.
> >
> > Any Ideas?
> >
> > Thanks much,
> >
> > Mark
>|||> I have many DB's and most of them do not have a "DBO" user attached to them
> (especially dbo with sa login name).
I find the terminology " have a "DBO" user attached to them" confusing. What do you mean by
"attached"? Are you saying that there is no user named dbo in these databases? Note: I'm referring
to the "users" folder! If you have databases in which there is no dbo user, then you have something
strange going on!
> I added another user to the DB, SQLADMIN, and made that user the owner.
Above confuses me even more. You don't add a user to a database. You add a login *as a user in the
database*. Also, how did you make that user the owner of the database? Exactly what steps did you
do, or what commands did you run. If possible please communicate using TSQL commands, as we can run
thses to see whether we get the same result or not.
> I now want to remove the dbo user with login name of "sa".
So you want to change the owner of the database from the login "sa" to some other login? OK, that is
fine, no problems. Use sp_changedbowner for that (you can also use ALTER AUTHORIZATION if you are on
2005).
> Or, I at least I
> want to change the "sa" on the dbo user to "SQLADMIN" user login name.
Again, the terminology used above confuses me. Are you saying that you want to change the owner of
the database from the login "sa" to some other login? If so, see my above comment.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://sqlblog.com/blogs/tibor_karaszi
"Mrpush" <Mrpush@.discussions.microsoft.com> wrote in message
news:510EE746-48E4-4A9C-8D36-84EB0B5F432B@.microsoft.com...
> Tibor,
> I'm not sure I understand.
> I have many DB's and most of them do not have a "DBO" user attached to them
> (especially dbo with sa login name).
> I added another user to the DB, SQLADMIN, and made that user the owner.
> I now want to remove the dbo user with login name of "sa". Or, I at least I
> want to change the "sa" on the dbo user to "SQLADMIN" user login name. I get
> the errors when I try to remove the dbo-sa user/login name.
> I'm doing this from the DB USERS folder, I am not trying to remove the SA
> LOGIN from the logins folder.
> How to do it?
> Thanks much,
> Mark
>
>
> "Tibor Karaszi" wrote:
>> The new owner *is* dbo, so you can't remove that.
>> You cannot remove the sa login either, since this is a special login. In 2005, you can disable it
>> and rename it (see ALTER LOGIN).
>> --
>> Tibor Karaszi, SQL Server MVP
>> http://www.karaszi.com/sqlserver/default.asp
>> http://sqlblog.com/blogs/tibor_karaszi
>>
>> "Mrpush" <Mrpush@.discussions.microsoft.com> wrote in message
>> news:A8C854BD-4307-4557-8479-4EC9CE34353B@.microsoft.com...
>> > Hello,
>> >
>> > I have a Db that has user name of 'dbo' and login name of 'sa'. For
>> > security reasons, I want this gone.
>> >
>> > This user was the owner, but I changed the owner to another user and verified.
>> >
>> > After doing this, I still cannot remove the dbo - sa user from the DB. I
>> > get errors:
>> >
>> > "Selected user cannot be dropped because the user owns objects"
>> >
>> > I cannot remove the public or owner roles from this user either.
>> >
>> > Any Ideas?
>> >
>> > Thanks much,
>> >
>> > Mark|||Tibor,
Sorry about that, I got a little mixed up. There are dbo users on my DB's.
What I want to do is get rid of the "sa" login name and change it to
something else like my "SQLadmin" user.
I tried the sp_changedbowner to change my DB owner to this other user, and
now the "sa" is gone. I believe there was some delay however as it still
showed "sa" after I ran the sp_changedbowner and that is why I was confused.
All seems well now!
Thanks!
Mark
"Tibor Karaszi" wrote:
> > I have many DB's and most of them do not have a "DBO" user attached to them
> > (especially dbo with sa login name).
> I find the terminology " have a "DBO" user attached to them" confusing. What do you mean by
> "attached"? Are you saying that there is no user named dbo in these databases? Note: I'm referring
> to the "users" folder! If you have databases in which there is no dbo user, then you have something
> strange going on!
>
> > I added another user to the DB, SQLADMIN, and made that user the owner.
> Above confuses me even more. You don't add a user to a database. You add a login *as a user in the
> database*. Also, how did you make that user the owner of the database? Exactly what steps did you
> do, or what commands did you run. If possible please communicate using TSQL commands, as we can run
> thses to see whether we get the same result or not.
>
> > I now want to remove the dbo user with login name of "sa".
> So you want to change the owner of the database from the login "sa" to some other login? OK, that is
> fine, no problems. Use sp_changedbowner for that (you can also use ALTER AUTHORIZATION if you are on
> 2005).
>
> > Or, I at least I
> > want to change the "sa" on the dbo user to "SQLADMIN" user login name.
> Again, the terminology used above confuses me. Are you saying that you want to change the owner of
> the database from the login "sa" to some other login? If so, see my above comment.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://sqlblog.com/blogs/tibor_karaszi
>
> "Mrpush" <Mrpush@.discussions.microsoft.com> wrote in message
> news:510EE746-48E4-4A9C-8D36-84EB0B5F432B@.microsoft.com...
> > Tibor,
> >
> > I'm not sure I understand.
> >
> > I have many DB's and most of them do not have a "DBO" user attached to them
> > (especially dbo with sa login name).
> >
> > I added another user to the DB, SQLADMIN, and made that user the owner.
> >
> > I now want to remove the dbo user with login name of "sa". Or, I at least I
> > want to change the "sa" on the dbo user to "SQLADMIN" user login name. I get
> > the errors when I try to remove the dbo-sa user/login name.
> >
> > I'm doing this from the DB USERS folder, I am not trying to remove the SA
> > LOGIN from the logins folder.
> >
> > How to do it?
> >
> > Thanks much,
> >
> > Mark
> >
> >
> >
> >
> > "Tibor Karaszi" wrote:
> >
> >> The new owner *is* dbo, so you can't remove that.
> >>
> >> You cannot remove the sa login either, since this is a special login. In 2005, you can disable it
> >> and rename it (see ALTER LOGIN).
> >>
> >> --
> >> Tibor Karaszi, SQL Server MVP
> >> http://www.karaszi.com/sqlserver/default.asp
> >> http://sqlblog.com/blogs/tibor_karaszi
> >>
> >>
> >> "Mrpush" <Mrpush@.discussions.microsoft.com> wrote in message
> >> news:A8C854BD-4307-4557-8479-4EC9CE34353B@.microsoft.com...
> >> > Hello,
> >> >
> >> > I have a Db that has user name of 'dbo' and login name of 'sa'. For
> >> > security reasons, I want this gone.
> >> >
> >> > This user was the owner, but I changed the owner to another user and verified.
> >> >
> >> > After doing this, I still cannot remove the dbo - sa user from the DB. I
> >> > get errors:
> >> >
> >> > "Selected user cannot be dropped because the user owns objects"
> >> >
> >> > I cannot remove the public or owner roles from this user either.
> >> >
> >> > Any Ideas?
> >> >
> >> > Thanks much,
> >> >
> >> > Mark
> >>
>
>