application account sysadmin

could there ever be a valid reason why users with access to an application (drive by a backend SQL Server database) would be granted an account that is sysadmin in the underlying databasre.

We have a basic asp.net application and 2 users login to the system (to setup new accounts/add permissions to existing accounts) who have accounts which when you look in SQL have sysadmin accounts. Could the need to setup new accounts in this applcation mean they need an account with sysadmin permissions on the underlying DB or is this excessive?
LVL 3
pma111Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dennis AriesCEO @ Arkro ITCommented:
Basicly? No, there should never be any reason for users to be a sysadmin. Being a sysadmin means that you can perform *any* action on the server which is not needed for every-day aplications.

Being a dbcreator makes sense but anything more privileged can result in unwanted results or pose serious security-issues if susch an account would be hacked.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Vitor MontalvãoMSSQL Senior EngineerCommented:
Best practice is not to give more than Read, Write on data and Execute on SP and Functions.
Everything more than these rights should be justified.
0
plusone3055Commented:
Have you considered creating a DBOWNER account and creating an ODBC connection to the Application. That way, The users in the application have all the rights to the Database and tables.
0
Dung DinhDBA and Business Intelligence DeveloperCommented:
Agree with @Vitor Montalvão

Never assign more permissions than READ/WRITE to your application users if you dont have any special requirements. Use store procedures or views instead of doing on base-tables directly.
0
Vitor MontalvãoMSSQL Senior EngineerCommented:
Strange that the comment that agreed with mine was chosen as Assisted Solution and mine doesn't.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft SQL Server

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.