LocalSystem and the sysadmin role

During SQL Server 2005 installation, three logins (in addition to the
service accounts) are added by default to SQL Server's sysadmin role :
- local administrator group (BUILTIN\Administrators),
- Local System (NT AUTHORITY\SYSTEM), and
- sa (assumming mixed mode install).

A common hardening practice is to later remove the local administrator group
from the sysadmin role, thereby separating server administration from DBMS
administration. However, I don't recall ever seeing the recommendation to
also remove the LocalSystem account from the sysadmin role.

One possible reason for this omission -- many layered products (including
Microsoft's Volume Shadow Copy writer for SQL2005) run under LocalSystem and
need to retain the sysadmin role (KB 919023).

Has anyone seen recommendations to remove BOTH local administrators and
LocalSystem from the sysadmin role for hardening purposes, and - if this
were to be done - what are the consequences?

Thanks in advance (and apologies for re-posting a weekend message in hopes
of a response),
Drew


.

Relevant Pages

  • Effect of removing LocalSystem from sysadmin role?
    ... service accounts) are added to the sysadmin role: ... A common hardening practice is to later remove the local administrator group ... from the sysadmin role, thereby separating server administration from DBMS ...
    (microsoft.public.sqlserver.security)
  • Re: LocalAdmins, LocalSystem, and the sysadmin role
    ... generally we remove local administrator group from sysadmin role which ... actually prevent accessing sql server who is having system admini privilages ...
    (microsoft.public.sqlserver.security)
  • LocalSystem and the sysadmin role
    ... During SQL Server 2005 installation, several logins are added to SQL ... A common hardening practice is to later remove the local administrator group ... from the sysadmin role, thereby separating server administration from DBMS ...
    (microsoft.public.sqlserver.security)
  • LocalAdmins, LocalSystem, and the sysadmin role
    ... A common hardening practice is to later remove the local administrator group ... from the sysadmin role, thereby separating server administration from DBMS ...
    (microsoft.public.sqlserver.security)
  • Re: Question on software install and event log security
    ... to install software continuously throughout the day. ... The policy only allows. ... > those packages to be installed without the user being local administrator. ... >> However by adding them to the local administrator group they are allowed ...
    (microsoft.public.windows.group_policy)