USE master;
GO

ALTER LOGIN sa DISABLE;
GO

-- create a login without privileges to act as database owner
CREATE LOGIN SecureDBOwner
	WITH PASSWORD = 'pass@w0rd',
	DEFAULT_DATABASE = master, CHECK_EXPIRATION = OFF, CHECK_POLICY = OFF;
GO
DENY CONNECT SQL TO SecureDBOwner;
GO
ALTER LOGIN SecureDBOwner DISABLE;
GO

USE <database_name>;
GO

-- check database owner
SELECT
	SUSER_SNAME(owner_sid)
FROM sys.databases
WHERE database_id = DB_ID();
GO

-- change the database owner to the least privileged owner
ALTER AUTHORIZATION ON DATABASE::<database_name> TO SecureDBOwner;
GO

-- check database owner again
SELECT
	SUSER_SNAME(owner_sid)
FROM sys.databases
WHERE database_id = DB_ID();