16

I am a beginner in database field and this question might sound too stupid but I want to know why there is a login called sa and can I delete it?

I want to delete it because it seems to have pretty serious privileges on database server!

If it matters, I am using SQL Server Express 2008.

Hemant
  • 19,486
  • 24
  • 91
  • 127

5 Answers5

28

You can't remove the sa account but you can rename and/or disable it. Arguably this is good practice as otherwise you have a known username that an attacker could launch a brute force password attack against.

Just make sure if you disable the sa account that you have another account with administrator privileges.

David Webb
  • 190,537
  • 57
  • 313
  • 299
  • 4
    First thing I do: disable sa. We have one public-facing SQL Server with low-priority databases on it and it is hit with *thousands* of sa attacks every single day, week after week, month after month, year after year. It just isn't worth it to leave sa enabled. – Mark Brittingham Mar 13 '09 at 18:49
4

sa is the admin account! do not delete it, give it a strong password that you provide to no one except the database admin and a backup person.

HLGEM
  • 94,695
  • 15
  • 113
  • 186
  • I was thinking that seperate accounts will be created for users such as administrator and backup person. Don't you think it is unwise to share password when you could handle the same by giving explicit rights to explicit person? – Hemant Mar 13 '09 at 13:25
  • I guess I've seen enough cases where nobody had admin rights because people left and didn't tell their personal passwords to want admin to only be known to one person. – HLGEM Mar 13 '09 at 13:36
1

sa is the main administrator account, it was the owner of master database (holding data for user roles,schema,etc), so it can't be deleted.

just change the password (and i think it was asked in installation progress) and create guest/public account with more restrictive privileges for use with your application a.k.a don't use sa in your application (application you develop)

Dels
  • 2,375
  • 9
  • 39
  • 59
0

Never do it . To understand more appropiately please refer http://blog.sqlauthority.com/2008/12/24/sql-server-disable-and-enable-user-sa/

shadab shah
  • 551
  • 1
  • 6
  • 8
0

Also, dependent on your environment you can just turn off SQL Server Authentication whatsoever.

There are two types of authentication supported by SQL Server - Windows Authentication and SQL Authentication - you can have both or one of them active. If you switch off SQL Authentication then only valid Windows (as defined in the system) users will be able to use the server (normal permissions still apply, so each account has to be added to SQL Server as well, the fact that somebody has an account in the system doesn't mean they can access the SQL Server instance).

You can configure this in the server settings from the Management Studio.

Pawel Krakowiak
  • 9,940
  • 3
  • 37
  • 55
  • Will it mean anyone can access the server or noone can access the server? Also I dont see an option to do that! – Hemant Mar 13 '09 at 14:00