Full Text Indexing security

I've seen a few posts where it's been said that to get FTI set-up you should
run :
exec sp_grantlogin N'NT Authority\System'
exec sp_defaultdb N'NT Authority\System', N'master'
exec sp_defaultlanguage N'NT Authority\System','us_english'
exec sp_addsrvrolemember N'NT Authority\System', sysadmin
My question is, is there any way at all to run FTI without either the
Builtin or Nt authority accounts as sysadmin? It just strikes me as odd that
what is essentially a data read requires such high level permissions. It
means either the network guys in my company who don't know SQL but are admins
of the box becomes SQL admins, or the other services on the box can in theory
gain admin rights. Are there no registry keys, OS permissions or anything
else which can get this working without SA permissions? We try to secure
boxes as much as we can at the server and OS level and then do the same
within SQL. We've build policies specifically so that the domain account
running sql isn't an admin on its box, so ideally we'd avoid giving out sql
admin rights.
Thanks
The NT Authority\System account is a system account, in otherwords there is
no user attached to it, no user can logon using this account and it has no
shell.
By removing the BuiltIn\admins no admin will be able to administer SQL
Server.
AFAIK - there are no registry tweaks that will help with this.
Hilary Cotter
Looking for a SQL Server replication book?
Now available for purchase at:
http://www.nwsu.com/0974973602.html
"DaveK" <DaveK@.discussions.microsoft.com> wrote in message
news:0F6FEC09-9336-4F36-8EF2-D81D7164BA16@.microsoft.com...
> I've seen a few posts where it's been said that to get FTI set-up you
should
> run :
> exec sp_grantlogin N'NT Authority\System'
> exec sp_defaultdb N'NT Authority\System', N'master'
> exec sp_defaultlanguage N'NT Authority\System','us_english'
> exec sp_addsrvrolemember N'NT Authority\System', sysadmin
> My question is, is there any way at all to run FTI without either the
> Builtin or Nt authority accounts as sysadmin? It just strikes me as odd
that
> what is essentially a data read requires such high level permissions. It
> means either the network guys in my company who don't know SQL but are
admins
> of the box becomes SQL admins, or the other services on the box can in
theory
> gain admin rights. Are there no registry keys, OS permissions or anything
> else which can get this working without SA permissions? We try to secure
> boxes as much as we can at the server and OS level and then do the same
> within SQL. We've build policies specifically so that the domain account
> running sql isn't an admin on its box, so ideally we'd avoid giving out
sql
> admin rights.
> Thanks
>
>
>
>