Sql-server – SQL 2008: Why is *any* user, with minimal permissions able to restart/stop the SQL instance through Management Studio

authenticationpermissionssql-server-2008

So I'm on a project that I need to help admin SQL 2008 .
I'm coming from a MySQL background.

Why is it that a basic user, with the most basic/default permissions, through Management Studio is able to restart or stop the entire instance of SQL but not view a simple table?

Best Answer

Correct Answer: It looks like SSMS looks at the context of the user who opens up SSMS itself, and not the user who connects to the DB engine.

I was able to log in to MS SQL Server as a SQL Server user and I was still able to restart the service under these 2 conditions:

  1. Logged in directly into the server via RDP as a user with admin or start/stop services rights, opened up SSMS, and was able to restart it

  2. Opened up SSMS across a different domain impersonating a domain user which has admin rights on that box using /runas netuse.

Original Answer (Partially Correct): It seems you might be confusing "MS SQL Server" permissions and "Windows" permissions. The MS SQL Server user permissions don't control access to Windows Services, a MS Windows domain or local user server controls who can or cannot restart the services. You can modify these settings through secpol.msc.

If you log in to MS SQL Server as a SQL Server user (even sa or a sa equivalent user) the 'restart' option is greyed out. If you log in to it as a "Windows User" who also has admin or restart services to the Windows machine, then you can restart it.

Related Question