Hi all,

Have been dealing with BES all the while, and seen on the SQL server the "built-in" group "BUILTIN\Administrators". What is the composite for this particular group? Am not really into Microsoft, so could someone educate me on it? Thanks in advance.

Gotcha, penguin man. I knew you would response. Cool site redirection to Google (with animation so more)! Thanks for being soooo.... "nice" (KNS).

Update: Here's a good guide for BES admins to understand better about BUILTIN\Administrators, one which your annoying DBAs are talking full of shits to have it removal. Not very HARD to just lend a helping hand by posting an abstract and provide a good link to assist all fellow admins here, rather than just asking people to Google ;)

Link: http://www.mssqltips.com/tip.asp?tip=1017

Summary
With SQL Server 2000 and 2005 one area that does not seem to follow this principal is related to the default rights for the BUILTIN\Administrators group. By default this group has SQL Server System Administrator rights to SQL Server when it is installed. The same level of default rights are also granted to BUILTIN\Administrators group in SQL Server 2005 during the installation. What this means is that any account in the Windows Local Administrators group has SQL Server System Administrator rights.

The BUILTIN\Administrators can easily be removed from SQL Server to prevent this security issue, but heed the warnings below prior to removing the group from SQL Server.

What steps should I take prior to considering removing this group?

1. Verify that you know the "sa" password by logging into the SQL Server with the "sa" account with either Query Analyzer or Management Studio on the SQL Server you want to modify.
2. Validate other Windows groups or Windows logins are assigned SQL Server System Administrator rights on this SQL Server.
3. Review the rights assigned to the BUILTIN\Administrators group.
4. Research the members of the Windows Local Administrators group.
5. Figure out if an additional group should be created in Active Directory and assigned rights in SQL Server or if specific logins should be assigned rights to SQL Server.
6. If necessary, create the additional logins and groups in Active Directory and assign rights in SQL Server to ensure a minimum of 1 login and/or the "sa" login has SQL Server System Administrator rights.
7. Validate that the members of the BUILTIN\Administrators group do not own any databases, objects, Jobs, etc and that none of the logins are connected to SQL Server.
8. If any of these steps were not completed, repeat the needed steps. If all of these steps have been followed and you are confident that removing the BUILTIN\Administrators group will not cause any issues proceed to the next set of directions.

Hope this helps others too.