Need to exclude Local Admins from admin access to Analysis Services

Question

Need to exclude Local Admins from admin access to Analysis Services

Marios Philippopoulos

SSC Guru

Points: 57190
More actions
July 14, 2008 at 10:43 am

#184615

Is it possible to exclude Local Admins from getting admin access to a SSAS 2005 instance, the same way it is done with the BuiltIn/Administrators group in the SQL Server database engine?
Is seems this kind of access is hardwired in the SSAS 2005 security framework, which makes it virtually impossible to prevent SSAS access to members of the Local Admins group!
I want to have full control on who to grant admin access on the SSAS instance.
I don't know what MS was thinking here...
__________________________________________________________________________________
SQL Server 2016 Columnstore Index Enhancements - System Views for Disk-Based Tables[/url]
Persisting SQL Server Index-Usage Statistics with MERGE[/url]
Turbocharge Your Database Maintenance With Service Broker: Part 2[/url]

Viewing 5 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic. Login to reply

Gift Peddie SSC Guru Points: 73570 More actions · Answer 1

I really don't understand your question but if you want to exclude anybody in SSAS you can do with DENY permissions because SSAS service permissions are more granular than relational engine permissions. There is a new project at Codeplex that can give you more flexibility and no I have not used it.

http://msdn.microsoft.com/en-us/library/ms174786.aspx

http://blogs.msdn.com/chrisfie/archive/2008/04/10/persist-sql-server-analysis-services-roles-settings-solution-starter-on-codeplex.aspx

Kind regards,
Gift Peddie

Marios Philippopoulos SSC Guru Points: 57190 More actions · Answer 2

Gift Peddie (7/14/2008)
I really don't understand your question but if you want to exclude anybody in SSAS you can do with DENY permissions because SSAS service permissions are more granular than relational engine permissions. There is a new project at Codeplex that can give you more flexibility and no I have not used it.
http://msdn.microsoft.com/en-us/library/ms174786.aspx
http://blogs.msdn.com/chrisfie/archive/2008/04/10/persist-sql-server-analysis-services-roles-settings-solution-starter-on-codeplex.aspx

Thanks for the response.

I know that Local Admins (members of the Local Admins Windows group) on the box on which SSAS is running have de facto admin access on the SSAS instance. I want to be able to remove that access. How does one apply those DENY permissions you are referring to? Can you provide a sample?

Thanks!

__________________________________________________________________________________
SQL Server 2016 Columnstore Index Enhancements - System Views for Disk-Based Tables[/url]
Persisting SQL Server Index-Usage Statistics with MERGE[/url]
Turbocharge Your Database Maintenance With Service Broker: Part 2[/url]

Gift Peddie SSC Guru Points: 73570 More actions · Answer 3

Hi,

I have very good news for you because your second post explains the problem in detail and it was not easy to find but Microsoft Isreal posted a one step solution here it is. Change the local Admins role in properties from true to false.

http://blogs.microsoft.co.il/blogs/bei/archive/2008/03/03/enhancing-analysis-2005-security-revoking-domain-admin-and-local-admin-from-built-in-admin-role.aspx

Kind regards,
Gift Peddie

Marios Philippopoulos SSC Guru Points: 57190 More actions · Answer 4

Gift Peddie (7/15/2008)
Hi,
I have very good news for you because your second post explains the problem in detail and it was not easy to find but Microsoft Isreal posted a one step solution here it is. Change the local Admins role in properties from true to false.
http://blogs.microsoft.co.il/blogs/bei/archive/2008/03/03/enhancing-analysis-2005-security-revoking-domain-admin-and-local-admin-from-built-in-admin-role.aspx

Thank you, that's great!

__________________________________________________________________________________
SQL Server 2016 Columnstore Index Enhancements - System Views for Disk-Based Tables[/url]
Persisting SQL Server Index-Usage Statistics with MERGE[/url]
Turbocharge Your Database Maintenance With Service Broker: Part 2[/url]