Auditors have been wanting us to change the password on the SA sql id on a scheduled basis. Someone read a white paper :-) Even though our instances are setup for MIX security, we do not use SA when connecting to the instance.We do have SA as database and Job owners. However all are SYSADMIN work is done using window ids. Occasionally we get a vendor product whose installation just does not seem to work without using SA, which is sad!Is there any issue with disabling SA and still use it as database and job owners?Which is more secure disabling SA or changing its password to a random value on a scheduled basis?
↧