System Administration Authority Group Name (sysadm_group)

Configuration Type

Database manager

Applies to

• Database server with local and remote clients
• Client
• Database server with local clients
• Partitioned database server with local and remote clients
• Satellite database server with local clients

Parameter Type

Configurable

Default

Null

Related Parameters

• System Control Authority Group Name (sysctrl_group)
• System Maintenance Authority Group Name (sysmaint_group)

System administration (SYSADM) authority is the highest level of authority within the database manager and controls all database objects. This parameter defines the group name with SYSADM authority for the database manager instance.

SYSADM authority is determined by the security facilities used in a specific operating environment.

• In the Windows 95 or Windows 98 operating system the SYSADM group must be NULL.

  This parameter must be "NULL" for Windows 95 or Windows 98 clients when system security is used because the Windows 95 or Windows 98 operating system does not store group information, thereby providing no way of determining if a user is a member of a designated SYSADM group. When a group name is specified, no user can be a member of it.

• For the Windows NT and Windows 2000 operating system, this parameter can be set to any local group that has a name of 8 characters or fewer, and is defined in the Windows NT and Windows 2000 security database. If "NULL" is specified for this parameter, all members of the Administrators group have SYSADM authority.
• For UNIX-based systems, if "NULL" is specified as the value of this parameter, the SYSADM group defaults to the primary group of the instance owner.

  If the value is not "NULL", the SYSADM group can be any valid UNIX group name.

• In OS/2, if the value specified for this parameter is "NULL", users defined as administrators in user profile management have SYSADM authority.

  If a group name is specified for this parameter, only users who belong to the group have SYSADM authority. The group specified can be any of the User Profile Management (UPM) groups. For more information on User Profile Management (UPM) groups, see your Quick Beginnings book.

If DCE security is used and sysadm_group is "NULL", the default DCE group name DB2ADMIN is used. A valid DCE principal whose authid mapping is DB2ADMIN must already exist. You can specify a different group name.

To restore the parameter to its default (NULL) value, use UPDATE DBM CFG USING SYSADM_GROUP NULL. You must specify the keyword "NULL" in uppercase. You can also use the Configure Instance notebook in the DB2 Control Center.