BUILTIN\Administrators got Sysadmin access on SCCM DB

Santhosh B S 126 Reputation points
2026-04-23T14:43:45.62+00:00

is it needed a sysadmin right on my SCCM DB for BUILTIN\Administrators account? Please guide

Windows for business | Windows Client for IT Pros | Devices and deployment | System management components
0 comments
Answer accepted by question author
Chen Tran 12,765 Reputation points Independent Advisor
2026-04-23T16:50:17.1233333+00:00

Hello Santhosh,

Thank you for posting question on Microsoft Windows Forum!

Based on your query of whether a sysadmin right is needed on your SCCM DB for BUILTIN\Administrators account. Well! The answer is NO. It is not a requirement for Microsoft Configuration Manager (SCCM) to have the BUILTIN\Administrators group assigned the sysadmin role on your SQL Server instance for ongoing operations. In fact, from a security and hardening perspective, it is a best practice to remove it to adhere to the principle of least privilege.

On the other hand, the primary site server / CAS computer account might need sysadmin on the SQL instance that hosts the site database, and users in the Full Administrator role also need sysadmin for setup, recovery, and SQL maintenance tasks.

The best practice is to grant sysadmin only to SCCM site server computer account, designated ConfigMgr admin accounts/groups. Considering to use JIT (Just-In-Time) access for SQL sysadmin if temporary elevation is needed and rely on ConfigMgr’s built-in SQL roles for day-to-day operations instead of broad server roles.

You can consult the following article for more information regarding your concerns.

Hope the above information is helpful! If it is. Free feel to hit "Accepted" for benefitting others in community having the same issue too.

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-04-23T14:44:01.0166667+00:00

    BUILTIN\Administrators does not need to be sysadmin on the Configuration Manager (SCCM) site database and should not be granted that level of access by default.

    Configuration Manager has specific, documented requirements for elevated permissions:

    1. The computer account of the site server (primary or CAS) requires:
      • Local Administrator on all site system servers
      • sysadmin on the SQL Server instance that hosts the site database
    2. User accounts in the Full Administrator role require:
      • Local Administrator on all site servers
      • sysadmin on the SQL Server instance for the site database, primarily for setup, recovery, and SQL maintenance operations
      • Some organizations remove permanent sysadmin and grant it only when needed (JIT access), while still allowing these users to read, update, and execute stored procedures on the ConfigMgr database.
    3. Configuration Manager also creates and uses its own SQL database roles (for example, smsdbrole_*, smsdbuser_ReadOnly, smsdbuser_ReadWrite) and Windows groups (for example, SMS Admins) to control access, rather than relying on broad server roles like BUILTIN\Administrators.

    Granting BUILTIN\Administrators the sysadmin role on the SCCM database would:

    • Go beyond the documented minimum requirements
    • Broaden high-privilege access to anyone who is a local admin on the SQL Server, which is not aligned with least-privilege and role-based administration principles

    Recommended approach:

    • Ensure the site server computer account and designated ConfigMgr admin accounts/groups have the required SQL sysadmin rights as documented.
    • Use Configuration Manager role-based administration (security roles and scopes) and the built-in SQL roles created by ConfigMgr instead of granting sysadmin to BUILTIN\Administrators.
    • If additional SQL access is needed, grant it explicitly to the relevant accounts or AD groups, not to BUILTIN\Administrators.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.