application account sysadmin

pma111
pma111 used Ask the Experts™
on
could there ever be a valid reason why users with access to an application (drive by a backend SQL Server database) would be granted an account that is sysadmin in the underlying databasre.

We have a basic asp.net application and 2 users login to the system (to setup new accounts/add permissions to existing accounts) who have accounts which when you look in SQL have sysadmin accounts. Could the need to setup new accounts in this applcation mean they need an account with sysadmin permissions on the underlying DB or is this excessive?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Commented:
Basicly? No, there should never be any reason for users to be a sysadmin. Being a sysadmin means that you can perform *any* action on the server which is not needed for every-day aplications.

Being a dbcreator makes sense but anything more privileged can result in unwanted results or pose serious security-issues if susch an account would be hacked.
Vitor MontalvãoIT Engineer
Distinguished Expert 2017

Commented:
Best practice is not to give more than Read, Write on data and Execute on SP and Functions.
Everything more than these rights should be justified.
Have you considered creating a DBOWNER account and creating an ODBC connection to the Application. That way, The users in the application have all the rights to the Database and tables.
Dung DinhDBA and Business Intelligence Developer
Commented:
Agree with @Vitor Montalvão

Never assign more permissions than READ/WRITE to your application users if you dont have any special requirements. Use store procedures or views instead of doing on base-tables directly.
Vitor MontalvãoIT Engineer
Distinguished Expert 2017

Commented:
Strange that the comment that agreed with mine was chosen as Assisted Solution and mine doesn't.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial