Matt Miller (#4) (2/18/2010)
Lynn Pettis (2/18/2010)
First, make sure you have at least two ways to login with sys admin rights. One way is to have a group created and have the DBA's assigned to that group and give that group sys admin rights. The second, have a privileged account for each of the DBA's created and add those to the database with sys admin rights. Once you have that done, you can delete the Builtin\administrator account (group) and this will take away the ability of local admins from getting into SQL Server (unless they add themselves to your DBA group)...until they invoke the DAC.....
If you have that enabled. It is disabled by default. Which reminds me, I should check that on the new servers. So much going on in such a short time.
Also, hopefully they don't know how to access SQL Server via the DAC. I've used it once, and that was more of a test to see how it worked and what I could do.