RPC on SQL Server Accounts

Overview

This address using a Secret Server privileged account to change SQL Server accounts. This enables taking over those accounts without knowing their password.

Creating the Account

  1. Open SQL Server Management Studio.

  2. Connect to your database server.

  3. Expand the root-level security folder.

  4. Right-click the Logins folder and select New Login.

  5. Give the account a log on name.

  6. Select SQL authentication.

  7. Go to Secret Server.

  8. Create a secret using the SQL Server Account template.

  9. Assign it the desired username .

  10. Click the Generate button on the secret password field to create a password.

  11. Copy that password to the account creation wizard in SQL Server Management Studio.

  12. Click the OK button to save the secret.

Assign Permissions

  1. In SQL Server Management Studio, go to Security > Logins in the object explorer.
  2. Right click on the SQL login object and select Properties. The Login Properties dialog box appears.
  3. Select Securables in the Select a page list.
  4. Find the Alter any login permission on the Explicit tab at the bottom of the dialog box.
  5. Click to select the Grant check box for that permission.
  6. Click the OK button.
  7. Similarly, enable the Control Server permission. This is for changing the target logins that are members of the sysadmin fixed server role or grantees of this permission.

Using the Account

  1. In Secret Server, open the SQL Server secret that you created.

  2. Click the Remote Password Changing tab.

  3. Click the Edit link.

  4. Click to select Privileged Account Credentials in the Change Password Using selection buttons. The Privileged Account section appears.

  5. Click the No Secret Selected link.

  6. Select the secret you created earlier. The secret appears in the Privileged Account section.

  7. Click the Save button.

  8. Click the Change password remotely button.

  9. Provide or generate a new password.

  10. Click the Change button. You have now successfully changed a SQL Server account password using a privileged account.

You can also assign the account for use by multiple secrets by creating a secret policy and applying that policy to a folder.