Secure Symmetric key from sa

Question

Can I secure SQL Server symmetric key from [sa] account? Can I create symmetric key using local user certificate via MMC?

Thanks

Answer 1

Can I secure SQL Server symmetric key from [sa] account?

Nope. The best you can do (and should be doing) is to:

1. Rename SA
2. Use Windows authentication only
3. Disable SA (also see #2)

However, SA is just a login. The server roles of sysadmins gives full privileges over the system.

The only way to secure a symmetric key using SQL Server against a sysadmins is to use multiple encryption techniques involving the users and/or the application.

Note that always encrypted and HSMs use Asymmetric keys.

Can I create symmetric key using local user certificate via MMC?

That's not going to help you with this issue.