Have SA account out of sysadmin

Question

We have lots of scripts and applications connecting to SQL 2000 using SA account. We also have a lot of people connecting directly from their stations using the SA account.

We need to migrate to 2008r2 but we can't have these users have a privilege account and we don't want to change all the connections.

We can't remove SA from SysAdmin because SQL won't let us. Is there something we can do to remove privilege without changing all the connections?

Answer 1

You can rename actual SA account to say SA_RENAMED, then create a new SA account with no privileges.

You may have to lookup the SA password in one of your scripts and test it right away.

You can then change the SA_RENAMED password or disable it.

Note1:You might have to debug some scripts that were really needing the sysadmin privilege. You should try that in a TEST environment first.

Note2:Doing this might also create a lot of confusion when it will be supported by operations. In large Corporations where support is done in India, you'll need a good communication plan.