Home Forums SQL Server 2017 SQL Server 2017 - Administration How would you lock down a SQL DBA to have local admin on the SQL box RE: How would you lock down a SQL DBA to have local admin on the SQL box

  • February 22, 2018 at 11:25 am

    #1980816

    ffarouqi - Thursday, February 22, 2018 10:59 AM

    Steve Jones - SSC Editor - Thursday, February 22, 2018 9:51 AM

    For Perf counters, there are ways to let non-admins get them: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc771692(v=ws.10)
    For attach/detach, just SQL permissions are needed, though the admin might need access to the folders to move files in/out.

    For install, I think you'd need admin permissions. At least temporarily.  You have to set permissions and create service accounts. This won't be something you can easily do by proxy. Of course, you could move to Chef/Puppet/DevOps style installs, which might alleviate some issues.

    Stop/start services,  you can use sc (https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc742037(v=ws.10)), and assign some rights, but this wouldn't be as easy as using SSMS.

    Thanks! Steve. In short we do need admin privileges for some task if not all the task...right?

    No... only if you want the DBA to be able to do their jobs. 😉

    --Jeff Moden

    RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
    First step towards the paradigm shift of writing Set Based code:
    ________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

    Change is inevitable... Change for the better is not.

    Helpful Links:
    How to post code problems
    How to Post Performance Problems
    Create a Tally Function (fnTally)