Creating and Using a SQL Server Privileged Account

Overview

This document enables a user to password change SQL accounts using a privileged account. Enabling the takeover of those accounts without knowing their password.

Procedure

Task 1: Creating an Account

1. Open SQL Server Management Studio and connect to your database server.

2. Expand the root level security folder.

3. Right click on the Logins folder and select New Login.

4. Type the account's login name in the Login Name text box.

5. Click to select the SQL Authentication selection button.

6. Go to Secret Server.

7. Create a secret using the SQL Server Account template.

8. Give it the same username as the login name you just created.

9. For best security, click the Generate button on the secret password field and copy that password to the account creation wizard in SQL Server Management Studio.

10. Click OK button to save your secret.

Task 2: Assigning Permissions

1. Return to SQL Server Management Studio and connect to your database server.

2. Right click the SQL login and click Properties.

3. Select Securables in the left column.

4. In the Permissions table on the Explicit tab, click to select the Grant check box for the Alter any login row.

5. Click the OK button.

Step 3: Using the Account

1. In Secret Server, select the SQL account secret for your new privileged account.

2. Select the Remote Password Changing tab.

3. Click the Edit button.

4. Click to select Privileged Account Credentials on the Change Password Using selection button.

5. Click the No Selected Secret link. The Select a Secret popup appears.

6. Locate and select the secret you created earlier in the folder tree.

7. Click the Save button. The popup disappears.

8. Click the Change Password Remotely button.

9. Provide or generate a new password.

10. Click the Change button. You have now successfully changed a SQL account password using a privileged account.