application account sysadmin
could there ever be a valid reason why users with access to an application (drive by a backend SQL Server database) would be granted an account that is sysadmin in the underlying databasre.
We have a basic asp.net application and 2 users login to the system (to setup new accounts/add permissions to existing accounts) who have accounts which when you look in SQL have sysadmin accounts. Could the need to setup new accounts in this applcation mean they need an account with sysadmin permissions on the underlying DB or is this excessive?
We have a basic asp.net application and 2 users login to the system (to setup new accounts/add permissions to existing accounts) who have accounts which when you look in SQL have sysadmin accounts. Could the need to setup new accounts in this applcation mean they need an account with sysadmin permissions on the underlying DB or is this excessive?
Do more with
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Basicly? No, there should never be any reason for users to be a sysadmin. Being a sysadmin means that you can perform *any* action on the server which is not needed for every-day aplications.
Being a dbcreator makes sense but anything more privileged can result in unwanted results or pose serious security-issues if susch an account would be hacked.
Being a dbcreator makes sense but anything more privileged can result in unwanted results or pose serious security-issues if susch an account would be hacked.
Best practice is not to give more than Read, Write on data and Execute on SP and Functions.
Everything more than these rights should be justified.
Everything more than these rights should be justified.
Have you considered creating a DBOWNER account and creating an ODBC connection to the Application. That way, The users in the application have all the rights to the Database and tables.
Premium Content
You need an Expert Office subscription to comment.Start Free Trial