none
What is BILTIN\administrator and can we change it RRS feed

  • Question

  • Hi experts

    Only want to ask some simple questions

    I have clustered Environment with two nodes and two other servers with NLB installed Moss 2007. I want to know

    1-      What is BILTIN\administrator account in SQL server 2008

    2-      Can I change this account with another if yes than how? And what will be effected with MOSS 2007

     


    Regards DILDAR-SharePoint Developer

    Thursday, April 11, 2013 6:20 AM

All replies

  • Hi,

    Are the BUILTIN\Administrators found in the Logins? What kind of change you want to make for this account?

    As far as I know, the BUILTIN\Administrators is the default group in AD. It is added as a windows login in SQL Server 2008. If you want to change the members inside the group, you need to modify it in Active Directory. If you want add more logins, you can add a new login.

    Thanks,

    Entan Ming

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contacttnmff@microsoft.com.


    Entan Ming
    TechNet Community Support

    Friday, April 12, 2013 3:26 AM
    Moderator
  • hi,

    i want to change name for example name\administrator or local\administrator. don't want to use BUILTIN. how can i change it and after changing what will be effected on MOSS 2007 because MOSS is install and i check this account using SharePoint Config Database. which is backbone of Moss 2007


    Regards DILDAR-SharePoint Developer

    Friday, April 12, 2013 7:20 AM
  • Hi,

    Thank you for your post.
    I'm trying to involve someone familiar with this topic to further look at this issue. There might be some time delay. Appreciate your patience.

    Thanks ,
    Entan Ming


    Entan Ming
    TechNet Community Support

    Friday, April 12, 2013 9:47 AM
    Moderator
  • Hi Dildar,

    SharePoint have the feature to change the service account, for example the user login was expired at AD, and need to be updated, then we can update this by updatefarmcredentials.: http://support.microsoft.com/kb/934838.

    Based on your enquiry, builtin/administrator is a default user login that being added, but, sharepoint 2007 is using service account to make the connections to the SQL. if you use this builtin/administrator at your farm as service account, then you remove it, it will have impact. so its better to add another service account first then you edit/remove the builtin/administrator.

    it is suggested that not to remove this builtin/administrator, but add another service account to be a service account.

    here is some article regarding the user login :

    http://support.microsoft.com/kb/926320

    http://technet.microsoft.com/en-us/library/cc263445(v=office.12).aspx


    Regards,
    Aries
    Microsoft Online Community Support


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Friday, April 12, 2013 10:25 AM
  • Hi DILDAR,

    No, you cannot rename the Builtin\Administrators Security Group but the Builtin\Administrators can be removed from SQL Server.

    The Builtin\Administrators Group is a Legacy Group that you find on DCs, it is the equivalent of a Domain Admin when used on DCs. However, it is not added to the Local Servers Administrators Group like the Domain Admin group is.

    Kids know that most people never look in their Builtin\Administrators group and will sometimes add their username into this group which is essentially Domain Admin but only on other DCs.

    Note: you can not add the Builtin\Administrators group to a SQL Server that is not installed on a DC, it doesn't exist.

    However, please read the next steps below prior to removing the BUILTIN\Administrators group from SQL Server.

    Next Steps
    1. Verify that you know the "sa" password by logging into the SQL Server with the "sa" account with either Query Analyzer or Management Studio on the SQL Server you want to modify.
    2. Validate other Windows groups or Windows logins are assigned SQL Server System Administrator rights on this SQL Server.
    3. Review the rights assigned to the BUILTIN\Administrators group.
    4. Research the members of the Windows Local Administrators group.
    5. If necessary, create the additional logins and groups in Active Directory and assign rights in SQL Server to ensure a minimum of 1 login and/or the "sa" login has SQL Server System Administrator rights.
    6. Validate that the members of the BUILTIN\Administrators group do not own any databases, objects, Jobs, etc and that none of the logins are connected to SQL Server.

    *** WARNING *** - Do not remove the BUILTIN\Administrators group from SQL Server if other logins or groups do not have SQL Server System Administrator rights or if you do not know the "sa" password.

    Using a SQL Query

    DROP LOGIN [BUILTIN\Administrators]

    OR using the GUI

    1. Open SSMS (SQL Server Management Studio > Go to the Security folder >
    2. Expand (+) the Logins folder, find the BUILTIN\Administrators Group
    3. Right click on the BUILTIN\Administrators group and select the Delete
    4. Confirm and if you agree and press 'OK'.
    5. Refresh, to verify the login has been dropped.  

     

    -Ivan  


    Ivan Sanders My LinkedIn Profile, My Blog, @iasanders.

    • Proposed as answer by Aries - MSFT Friday, April 19, 2013 9:13 AM
    Friday, April 12, 2013 10:49 AM
  • Thanks all of you I removed account in my test environment and MOSS 2007 stopped running and after reading some blogs i was trying to back this account but i was surprised it's not recovered, that’s why i am worry to delete this account from my live environment. What you all suggest me. <o:p></o:p>

    One more thing I want to ask is any security issue if we don’t delete BUILT account. <o:p></o:p>



    Regards DILDAR-SharePoint Developer

    Friday, April 12, 2013 5:13 PM
  • If SharePoint stopped working did you review the rights assigned to the BUILTIN\Administrators group in the Group??

    -Ivan


    Ivan Sanders My LinkedIn , My Blog, @iasanders, BI in SP2013, SP2013 Content Packs.

    Saturday, April 13, 2013 3:51 PM
  • Yes.. only rights are public and owner. and one database is using which is SharePoint_Config.

    Regards DILDAR-SharePoint Developer

    Saturday, April 13, 2013 3:55 PM
  • Hi,

    Who are the members of the builtin\administrators group. if you have or create another group with the same permissions and the same members you should be albe to remove the group...

    -Ivan


    Ivan Sanders My LinkedIn , My Blog, @iasanders, BI in SP2013, SP2013 Content Packs.

    Saturday, April 13, 2013 4:24 PM
  • It's in Administrator group. yes i follow above steps to delet this user, but after deleting my moss 2007 working stops in my test enviroment..


    Regards DILDAR-SharePoint Developer

    Saturday, April 13, 2013 4:27 PM
  • I will repeat the question. Did you add the users to a different group with the same permissions and remove the group or did you remove the group and nothing else. if there are users in the group with user rights to SharePoint then they will need the same rights after you remove the group...

    -Ivan


    Ivan Sanders My LinkedIn , My Blog, @iasanders, BI in SP2013, SP2013 Content Packs.

    Monday, April 15, 2013 3:01 PM