Networks

Ask something
Question Locked

SQL Server take ownership

0 helpful
3 replies

by werewolf_

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi

This week, an external consultant ran a script on our SQL Server with a owner right on one database and no SA rights. The SA password was kind of impossible to break, something like '9dkchal$1SDxka12356k*a!h'. But with only rights on his DB and a script, he take ownership of the entire server (change the SA password)... How can a script do that? I mean, without windows rights and being limited to his db ... I'm confused about this. This is related to SQL Server 2000 SP4 and SQL Server 2005 SP2. Thank you for your ideas...

3 replies

by justdave

You have to check to see if he was granted any server roles. There are server roles, like backup operator that can override the security that is at a database level.

by builder

That the server is setup to use mixed mode security (Windows & SQL) and he was logged in as a local administrator.

With this he could had done just about anything.

This discussion is closed to new replies.