Solved

Need help gaining SA access to Backup Exec 2005 SQL Database?

Posted on 2013-01-24
1
702 Views
Last Modified: 2013-02-03
A vulnerabilty scanner reported ; Attackers could potentially gain arbitrary access to the file or registry system on the SQL Server host.  This vulnerability could possibly lead to further compromise of the SQL Server's integity.

One of the the sugesstion was to usw SQL Server Management Studio Express remove the BUILTIN\Administrator for the SQL 2005 Database login while keeping the SA account. After I deleted the BUILTIN\Administrator group access. My SA account login will login before but now I get an error " Login failed for user 'sa' The user is not associated with a trusted SQL server connection Error 18452.

When I tried to change the SQL server properties  for security from just Windows Authenication  to SQL and Windows Authenication I get an error; The  Execute permissions is denied for object 'xp_instance_regwrite' database mssqlsystemresource, schema 'sys' Microsoft Error :229

 Can someone help me switch modes to gain SA access ?
0
Comment
Question by:355LT1
1 Comment
 
LVL 28

Accepted Solution

by:
Ryan McCauley earned 500 total points
ID: 38819543
You're getting that error because the user you're logged in as doesn't have SA, which you need to in order to change that configuration setting. Luckily, you can change this with a registry setting and an instance restart:

http://www.mssqltips.com/sqlservertip/1441/correct-the-sql-server-authentication-mode-in-the-windows-registry/

Essentially, stop the instance, navigate to the appropriate key in your registry (Usually "HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\MSSQL.1\MSSQLServer\LoginMode" for your default instance or "HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\MSSQL.n\MSSQLServer\LoginMode" for a named instance), and change the "LoginMode" value to 2 (it's set to 1 now - that signifies Integrated Authentication Only).

Start up the SQL instance again and your SA account should now be able to connect without that error message.

Note: I definitely advocate removing the "BUILTIN\Administrators" group's default SA permissions (and likely that group's permissions altogether), especially when you're in an environment when the servers are managed by a different group of people than the DBA group. However, always make sure you've explicitly added yourself as a sysadmin before you revoke the default rights :)
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

This article explains how to reset the password of the sa account on a Microsoft SQL Server.  The steps in this article work in SQL 2005, 2008, 2008 R2, 2012, 2014 and 2016.
Ever wondered why sometimes your SQL Server is slow or unresponsive with connections spiking up but by the time you go in, all is well? The following article will show you how to install and configure a SQL job that will send you email alerts includ…
Via a live example, show how to set up a backup for SQL Server using a Maintenance Plan and how to schedule the job into SQL Server Agent.
Viewers will learn how to use the SELECT statement in SQL to return specific rows and columns, with various degrees of sorting and limits in place.

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now