RE: Domain admin?

From: Kevin McDonnell [MSFT] (kevmc_at_online.microsoft.com)
Date: 05/01/04 

Date: Sat, 01 May 2004 00:00:29 GMT

This is defined by granting access to the server. Remove domain admins
from the local admins if they are part of that group.
Add either individual nt users or create a new group and grant them
restricted permissions, like only select rights from a table. There is no
"read only " attribute for SQL. The closest thing we have is select access
to a view.

See this link for our best practices.
http://www.microsoft.com/technet/prodtechnol/sql/2000/maintain/sp3sec00.mspx

Hope this helps.

Thanks,

Kevin McDonnell
Microsoft Corporation

This posting is provided AS IS with no warranties, and confers no rights.

Relevant Pages

  • Re: Ensuring Domain Admins is always in the Local Admins group
    ... confers no rights. ... >> is always in the Local Admins group of every computer ... >> I am looking for a way to have the domain admins added ...
    (microsoft.public.win2000.security)
  • Re: any help installing KB840374 yet?
    ... It seems crazy to give local admins ... rights that will override domain admins. ... > A domain admin was able to install this patch where a local admin can't. ...
    (microsoft.public.windowsupdate)
  • Re: ASP.NET - Windows Authentication Problem
    ... Can you provide the <authorization> ... Then it won't let anyone in, including the domain admins or ... > local admins. ... I do not have much knowledge of groups and rights, ...
    (microsoft.public.dotnet.security)
  • Re: Unable to prevent OU deletion by Domain Admins?
    ... That's how ACLs work, or at ... Microsoft's own guidelines for parsing ACLs states that DENY ACLs ... I understand that domain admins have the delete and delete subtree ... I have a folder where Domain Users have Full control rights. ...
    (microsoft.public.win2000.active_directory)
  • Re: Prevent changes to Administrator password
    ... To add to what I already said: *ANY* member of a Domain Admins group *MUST* be trusted in what he does with his account. ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... * This posting is provided "AS IS" with no warranties and confers no rights! ...
    (microsoft.public.windows.server.active_directory)
Quantcast