Environment: DB2 Personal Editon V8 on Windows XP

I was doing some experiments with authorities and discovered some unexpected
behaviour. I had not yet touched the SYSADM_GROUP, SYSCTRL_GROUP, or
SYSMAINT_GROUP settings on a new instance, i.e. all three were blank when I
did "get dbm cfg". The only groups I had set up in Windows were the standard
Windows ones, like Administrator and Users.

I was rather surprised to find that when a user who was in the Windows
Administrators group attempted to access some tables in one of the
databases, she was able to do so. For example, Wilma, who belonged only the
Windows Administrators group and the Windows Users group, connected to one
of the databases with her own userid and password and was able to read the
data in one of the tables without having been granted any authority whatever
by me, the sole SYSADM.

I had the very strong impression that she was able to read the table simply
by virtue of being in the Administrators group, _even though I hadn't set up
ANY group as the SYSADM_GROUP, SYSCTRL_GROUP, or SYSMAINT_GROUP_!! (Another
user, Betty, who belonged only to the Users group, was NOT able to read the
same tables.)

Am I correct in believing that DB2's default behaviour in Windows is to
treat everyone in the Administrators group as a Sysadm, even though no
SYSADM_GROUP has been set within the instance??

This seems like a rather gaping security hole to me! If I am understanding
this correctly, I would be highly inclined to advise all DB2 administrators
on Windows to set up groups explicitly for DB2 Sysadm, Sysmaint and Sysctrl
immediately upon installing DB2 and make sure that their various DB2 users
belong _only_ to those groups. Am I going overboard or is that a reasonable
way to set things up?

--

Rhino