Home Forums SQL Server 2017 SQL Server 2017 - Administration How would you lock down a SQL DBA to have local admin on the SQL box RE: How would you lock down a SQL DBA to have local admin on the SQL box

  • February 21, 2018 at 6:55 am

    #1980608

    ffarouqi - Tuesday, February 20, 2018 1:53 PM

    I would like to know if we can create a separate group or what permissions on the server should be granted for the DBA to make sure he/she can perform the duties such as the ones listed below in case if we lock down local admin rights on the box due to management and security reasons.

    - SQL database attach/detach
    - SQL installation, service pack updates etc.
    - Monitoring performance metrics
    - restarting and stopping sql server

    Just attaching/detaching a database requires either sysadmin privs or DBO privs, which I'm thinking is beyond the level of privs that you want such folks to have because it will allow them do either do anything to the server or anything to the database they're assigned.

    --Jeff Moden

    RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
    First step towards the paradigm shift of writing Set Based code:
    ________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

    Change is inevitable... Change for the better is not.

    Helpful Links:
    How to post code problems
    How to Post Performance Problems
    Create a Tally Function (fnTally)