sa password reset, and BUILTIN/Administrators group gone from sysadmin

[tommyh1]

A SQL SERVER 7 machine on my network was used and abused by a user, who reset the sa password and removed the NT/Administrator user from the SQL server sysadmins group, rendering it inaccessable to any sysadmins.

How can I get sysadmin privileges back on the sql server?

I have tried,
1) starting it in single user mode and trying to connect to it. (i think there is some scope for more investigation here, but im not sure what to try)
2) trying to connect to it using NT privileges.
3) a brute force sa password hack - but this was only check 5 passwords a second, and would have taken many years to get to 8 chars

 

[SemperFiDownUnda]

if you have physical access to the files just copy them to another server and attach them onto that server.

 

[tlbroadbent]

If there is no one that can get into the server as an administrator, you'll have to rebuild the master database. SQL BOL contains the details. You'll then have to create the logins and attach the user databases. Hope you have backups and scripts available. If you want to get the best answer for your question read faq183-874 and faq183-3179.
Terry L. Broadbent - DBA
SQL Server Page:

http://tlbroadbent.home.attbi.com/sql/sql_articles.htm

 

[tommyh1]

i used a brute force program to get the sa password,
fortunately the person responsible chose a dictionary password.

i got it from here;

http://www.sqlsecurity.com/DesktopDefault.aspx?tabindex=5&tabid=7

 

[SQLSister]

May we at least presume you fired this person?