Link to home
Start Free TrialLog in
Avatar of barnesco
barnesco

asked on

Removing BUILTIN/Administrators causes clustered SQL 2000 jobs to fail

Similar, but different, to a previous question asked about removing builtin/admin from a 2005 instance (https://www.experts-exchange.com/questions/23142739/Removing-BUILTIN-Administrators-causes-SQL-2005-agent-to-not-start.html), I attempted to remove the builtin/admin user from a 2000 clustered instance and it caused the jobs to fail. The clustered jobs are owned by the same domain admin account that the agent services is running. How do I remove the builtin/admin account without effecting the jobs?
Avatar of chapmandew
chapmandew
Flag of United States of America image

They may be owned by them, but are they running under the account you have removed?  Open up the job and see who they are running under.  You may need to add teh account back, but remove any admin permissions.
Avatar of barnesco
barnesco

ASKER

The job is owned by the domain admin account, not the buitin/admin account. SQL agent is also running under the same domain admin account.

I could change the owner of the jobs to another SA account. Could that work? Unfortunately, I can't "play" with process too much...it's a heavy prod server.
Yes, it is worth a shot if they are failing.  Switch the owner to SA.
The problem I'm having now is that builtin\admin is a dbo owner, yet all the databases show they're owned by SA. I even tried resetting sp_changedbowner to SA again, but the when I attempt to remove the builtin\admin I receive the error message: The database owner cannot be dropped. Also, if I attempt to remove the dbo role from builtin\admin, I get the message Error 15405: Cannot use the reserved user or role name dbo.
Don't remove the account then.  Just remove all privledges from the account.  That is what we did on our cluster...I think the cluster uses that account.
Thanks. I removed sysadmin rights for builtin, but all the jobs still fail despite using sa as the owner.
So, what is the reason they are failing for?  If you look at the history of the job it should give you some sort of description why it is failing.
ASKER CERTIFIED SOLUTION
Avatar of barnesco
barnesco

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
So, is it a big deal if that user accounts remains as an admin?  I wouldn't think that it would be, as long as the network admins keep a pretty tight control over who are admins on the network.
Yes. It's huge.