Wednesday, July 15, 2009



Do Logins with sysadmin role require User Mapping to be done for each database in the Instance?

The answer is no. A Login with sysadmin role does not need user mapping at the database level to be able to perform any tasks on those databases.
If a user would gain access to SQL Server on that Login and creates a database, the Login would be mapped to the built-in dbo database user as seen in the example below; Login BCEDU\agonzal2 (Windows Authentication) created three databases including the Management database.





The following Q&A is in the context of using the BUILTIN\Administrators local built-in account for the Windows host as a SQL Server Login.

Note: In some cases a Login with sysadmin role must be granted explicit rights (database roles). An example is when working multiserver environments and the TargetServerRole must be granted to the Login on the Target server.
Question
system administrators role and dbo rights - Jaso
26-Mar-08 10:31:12

I noticed that the built in admin account is given sysadmin role, but it is
also given dbo on every database. Isn̢۪t this redundant? I thought sysadmin
role automatically gives a user dbo rights on any db it uses.

When I add the new group of dbas to replace the built-in admin group, I only
need to give it the sysadmin role, correct?
Answer
26-Mar-08 11:31:39

Hi Jason,
In addition to Tibor's suggestion, I would like to add more comments for
your first question here.

I think that it is not redundant but necessary. You know that database
level access is based on users but not logins, so there must be a user in
each database mapping to a specific login, even a sysadmin login account
without exception. Now let us first look at the definition about dbo in SQL
Server Books Online:
--------------------------------------------------------------
The dbo is a user that has implied permissions to perform all activities in
the database. Any member of the sysadmin fixed server role who uses a
database is mapped to the special user inside each database called dbo.
Also, any object created by any member of the sysadmin fixed server role
belongs to dbo automatically.

For example, if user Andrew is a member of the sysadmin fixed server role
and creates a table T1, T1 belongs to dbo and is qualified as dbo.T1, not
as Andrew.T1. Conversely, if Andrew is not a member of the sysadmin fixed
server role but is a member only of the db_owner fixed database role and
creates a table T1, T1 belongs to Andrew and is qualified as Andrew.T1. The
table belongs to Andrew because he did not qualify the table as dbo.T1.

The dbo user cannot be deleted and is always present in every database.

Only objects created by members of the sysadmin fixed server role (or by
the dbo user) belong to dbo. Objects created by any other user who is not
also a member of the sysadmin fixed server role (including members of the
db_owner fixed database role):
- Belong to the user creating the object, not dbo.
- Are qualified with the name of the user who created the object.
---------------------------------------------------------------

You said that your built-in admin account was given dbo on every database,
so I believe that all of the databases were created by your built-in admin
account. If one database was created by another login account with sysadmin
fixed server role, the dbo should have been mapped to that login and in
this case, your build-in admin account would map to another user, by
default same as the login name, who is assigned with the db_owner database
role.

If you have any other questions or concerns, please feel free to let me
know.

Best regards,
Charles Wang
Microsoft Online Community Support

(Source: http://www.eggheadcafe.com )

No comments:

Post a Comment