Differences between ALTER ANY LOGIN & securityadmin Server level role?

Question

Differences between ALTER ANY LOGIN & securityadmin Server level role?

techresearch7777777 1,961

Hello, what are the differences between ALTER ANY LOGIN & securityadmin Server level role?

Think I have an idea that securityadmin Server level role probably has higher permissions but would like to know more specifics.

Thanks in advance.

Seeya Xi-MSFT 16,761 Reputation points

2022-07-06T05:55:13.407+00:00

Hi @techresearch7777777 ,

We have not received a response from you. Did the reply could help you? If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. By doing so, it will benefit all community members who are having this similar issue. Your contribution is highly appreciated.

Best regards,
Seeya

4 answers

Your answer

Seeya Xi-MSFT 16,761 Reputation points

2022-07-06T05:55:13.407+00:00

Hi @techresearch7777777 ,

We have not received a response from you. Did the reply could help you? If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. By doing so, it will benefit all community members who are having this similar issue. Your contribution is highly appreciated.

Best regards,
Seeya

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 2

techresearch7777777 1,961

I had a feeling securityadmin was more higher than ALTER ANY LOGIN but didn't realize the gap was that big.

Just pondering further if there's anything else different under the hood of differences (i.e. maybe ALTER ANY LOGIN has access to any of the system DBs = master, msdb, model, tempdb and their Stored Procedures that securityadmin does not)

Thanks bunch Erland for your quick and informative info.

Erland Sommarskog 137.7K Reputation points MVP Volunteer Moderator

2022-07-05T08:31:20.94+00:00

(i.e. maybe ALTER ANY LOGIN has access to any of the system DBs = master, msdb, model, tempdb and their Stored Procedures that securityadmin does not)

As the query with fn_my_permissions shows. the securityadmin role comes with the permission ALTER ANY LOGIN. So that's unlikely.

On the other hand, there can be more things with securityadmin that I did not cover here. The one with granting server-level permissions was easy to spot, because it is covered in the Docs:

Members of the securityadmin fixed server role manage logins and their properties. They can GRANT, DENY, and REVOKE server-level permissions. They can also GRANT, DENY, and REVOKE database-level permissions if they have access to a database. Additionally, they can reset passwords for SQL Server logins.

IMPORTANT: The ability to grant access to the Database Engine and to configure user permissions allows the security admin to assign most server permissions. The securityadmin role should be treated as equivalent to the sysadmin role

But there can be more things hiding that is not spelled out in the docs. Then again, granting server-level permissions like CONTROL SERVER in combinations with being able to create logins is heavy-duty enough.

Answer 3

Hi @techresearch7777777 ,

Agree with Erland. Here is a related thread you can refer to: https://dba.stackexchange.com/questions/199440/why-securityadmin-does-not-have-enough-permission
In additon, here is an article about Access Control: https://satoricyber.com/sql-server-security/sql-server-roles/
Hope these could give you some help.

Best regards,
Seeya

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

techresearch7777777 1,961

Thanks everyone for the helpful infos.

0 comments