application account sysadmin

could there ever be a valid reason why users with access to an application (drive by a backend SQL Server database) would be granted an account that is sysadmin in the underlying databasre.

We have a basic asp.net application and 2 users login to the system (to setup new accounts/add permissions to existing accounts) who have accounts which when you look in SQL have sysadmin accounts. Could the need to setup new accounts in this applcation mean they need an account with sysadmin permissions on the underlying DB or is this excessive?

LVL 4

pma111Asked: 2015-09-07

Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

Experts Exchange Solution brought to you by

Enjoy your complimentary solution view.

Get every solution instantly with Premium. Start your 7-day free trial.

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

LVL 18

Dennis AriesCEO @ Arkro ITCommented: 2015-09-07

Basicly? No, there should never be any reason for users to be a sysadmin. Being a sysadmin means that you can perform *any* action on the server which is not needed for every-day aplications.

Being a dbcreator makes sense but anything more privileged can result in unwanted results or pose serious security-issues if susch an account would be hacked.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial

LVL 55

Vitor MontalvãoMSSQL Senior EngineerCommented: 2015-09-07

Best practice is not to give more than Read, Write on data and Execute on SP and Functions.
Everything more than these rights should be justified.

LVL 22

plusone3055Commented: 2015-09-07

Have you considered creating a DBOWNER account and creating an ODBC connection to the Application. That way, The users in the application have all the rights to the Database and tables.

LVL 10

Dung DinhDBA and Business Intelligence DeveloperCommented: 2015-09-07

Agree with @Vitor Montalvão

Never assign more permissions than READ/WRITE to your application users if you dont have any special requirements. Use store procedures or views instead of doing on base-tables directly.

LVL 55

Vitor MontalvãoMSSQL Senior EngineerCommented: 2015-09-24

Strange that the comment that agreed with mine was chosen as Assisted Solution and mine doesn't.