I'll keep service broker in mind.

However we do have sql 7, 2000 in place so I'd prefer to develop a 1 size fits all system as much as possible due to very short timeline. I'm still opened to both direct access or web services as they are basically the same request with very little modifications. However I barely know how to speel broker so I'm not too sure I'd want to include that learning curve in the project... The idea sounds simple enough but I'm pretty sure this could snowball quite a bit with all I don't know that I don't know.

What I did like about direct linked server without using express as in between is that I could shoot a mail to the system's admin with a single script to execute and bam, the whole thing was done (after exposing sql to the net of course). From a time consuming point of view and budget that was the single best solution, but not from a security aspect. It's like saying I can do that pretty, good, and cheap... pick 2 out of 3. I'm pretty sure I won't get away with that for all clients :w00t:.

Asking everybody to upgrade to 2k5 is just out of the question... it's an even bigger demand than adding another server with express on it. In our case, we are actually requiring direct access to the companie's ERP system, which they would need to upgrade (assuming they can).

Many network admins are going to see this as a very big deal / security risk hence my need for a solid solution to propose.