Policy Management: BUILTIN\Administrators are sysadmin's

Question

Policy Management: BUILTIN\Administrators are sysadmin's

Jon.Morisi

SSChampion

Points: 12846
More actions
April 29, 2011 at 12:19 pm

#236632

Hi,
I'm trying to create a policy to check that the Server Roles for BUILTIN\Administrators includes sysadmin. I've not been able to locate a Server Role facet or other facet that includes a property for Server Role.
So far I've got a condition on the login facet @Name = 'builtin\administrators'. I"m using this as the target for the policy, but that big missing piece is where to check the server role.
Anyone know where the needle is?

Viewing 6 posts - 1 through 5 (of 5 total)

You must be logged in to reply to this topic. Login to reply

Colleen M. Morrow SSCrazy Points: 2457 More actions · Answer 1

Take a look at this article[/url]. Though he doesn't say it, the @WindowsUsersAndGroupsInSysadminRole he talks about is in the Server Installation Settings facet. (Of course ;-))

Colleen M. Morrow
Cleveland DBA

Jon.Morisi SSChampion Points: 12846 More actions · Answer 2

Thanks I actually saw that and it doesn't do what I'm trying to do.

I've tried this:

Facet: Server Installation (not mentioned in that link)

@WindowsUsersAndGroupsInSysadminRole = Array('builtin\administrators')

The array that gets returned is all users and groups in the sysadmin role so it fails.

If you have many servers with different lists of sysadmins, this won't work.

Jon.Morisi SSChampion Points: 12846 More actions · Answer 3

I spent most of my day figuring this out so I decided to create a blogger account:

http://jonmorisissqlblog.blogspot.com/2011/04/configure-policy-to-checks-that.html

Jon.Morisi SSChampion Points: 12846 More actions · Answer 4