HiveBrain v1.2.0
Get Started
← Back to all entries
patternsqlModerate

Should I drop dbo from the database role db_owner?

Submitted by: @import:stackexchange-dba··
0
Viewed 0 times
thedb_ownerdatabasedbodroproleshouldfrom

Problem

I did a Vulnerability Assessment for my database today. I found VA2108 and it suggests me to

ALTER ROLE [db_owner] DROP MEMBER [dbo]


But it's the default setting of any SQL instance.

Should I go for it? And is there any risk?

Thanks

Solution

Don't worry about it.

In fact, you cannot drop dbo from db_owner. There's a hard-wired blocker in the engine prohibiting you to do so. Try and you get the error:

Msg 15405, Level 16, State 1, Line 1
Cannot use the special principal 'dbo'.


Flagging dbo is a bug the assessment tool. The purpose of the assessment is to make sure one evaluates whether other members need those permissions.

Code Snippets

Msg 15405, Level 16, State 1, Line 1
Cannot use the special principal 'dbo'.

Context

StackExchange Database Administrators Q#284571, answer score: 14

Revisions (0)

No revisions yet.