Locking Out The Sa Account.

Hi,





I need to secure an sqlserver database such that it can only be accessed from an application and to prevent anyone with full admin rights on their local machine and an sqlserver licence from getting in to the database.





I am struggling with controlling access to the database from the sa account. If I attach to the database from a second instance of sqlserver which is different than that where the database was created then I am able to gain full access no problems, which is of course The Problem.





From what I can work out.





1. sa is dbo (and this cannot be changed)


2. dbo has the role of db_owner (and this cannot be changed)


3. the permissions for the db_owner role cannot be changed.


4. the password for sa is set at the level of sqlserver and not per database





.....so any sa can access any database.





I don't believe this so have to be missing something significant, any light on the subject would be gratefully received.





KeithT