Solved

Need help gaining SA access to Backup Exec 2005 SQL Database?

Posted on 2013-01-24
1
709 Views
Last Modified: 2013-02-03
A vulnerabilty scanner reported ; Attackers could potentially gain arbitrary access to the file or registry system on the SQL Server host.  This vulnerability could possibly lead to further compromise of the SQL Server's integity.

One of the the sugesstion was to usw SQL Server Management Studio Express remove the BUILTIN\Administrator for the SQL 2005 Database login while keeping the SA account. After I deleted the BUILTIN\Administrator group access. My SA account login will login before but now I get an error " Login failed for user 'sa' The user is not associated with a trusted SQL server connection Error 18452.

When I tried to change the SQL server properties  for security from just Windows Authenication  to SQL and Windows Authenication I get an error; The  Execute permissions is denied for object 'xp_instance_regwrite' database mssqlsystemresource, schema 'sys' Microsoft Error :229

 Can someone help me switch modes to gain SA access ?
0
Comment
Question by:355LT1
1 Comment
 
LVL 28

Accepted Solution

by:
Ryan McCauley earned 500 total points
ID: 38819543
You're getting that error because the user you're logged in as doesn't have SA, which you need to in order to change that configuration setting. Luckily, you can change this with a registry setting and an instance restart:

http://www.mssqltips.com/sqlservertip/1441/correct-the-sql-server-authentication-mode-in-the-windows-registry/

Essentially, stop the instance, navigate to the appropriate key in your registry (Usually "HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\MSSQL.1\MSSQLServer\LoginMode" for your default instance or "HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft SQL Server\MSSQL.n\MSSQLServer\LoginMode" for a named instance), and change the "LoginMode" value to 2 (it's set to 1 now - that signifies Integrated Authentication Only).

Start up the SQL instance again and your SA account should now be able to connect without that error message.

Note: I definitely advocate removing the "BUILTIN\Administrators" group's default SA permissions (and likely that group's permissions altogether), especially when you're in an environment when the servers are managed by a different group of people than the DBA group. However, always make sure you've explicitly added yourself as a sysadmin before you revoke the default rights :)
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is an update and follow-up of my previous article:   Storage 101: common concepts in the IT enterprise storage This time, I expand on more frequently used storage concepts.
Are you looking to recover an email message or a contact you just deleted mistakenly? Or you are searching for a contact that you erased from your MS Outlook ‘Contacts’ folder and now realized that it was important.
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
Viewers will learn how to use the INSERT statement to insert data into their tables. It will also introduce the NULL statement, to show them what happens when no value is giving for any given column.

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now