Denying Access to Domain & BuiltIn Adminstrators

Question

Denying Access to Domain & BuiltIn Adminstrators

surbajit.shehri

SSC Journeyman

Points: 78
More actions
February 4, 2010 at 5:36 am

#210521

Hello All,
How I can I deny the Network Administrators and Local Administrators, as they are frequently changing maintenance plans etc.
I need to deny them any admin rights on my development server, How can this be done?? I know that I can remove the BUILTIN\Administrators Account, will that solve my problem??
Thanks for your time.

Viewing 5 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic. Login to reply

Lowell SSC Guru Points: 323504 More actions · Answer 1

the right thing to do is to go tell your other admins to not fiddle with your development server. Going behind their back and trying to lock them out is not a professional way to handle the situation.

If that happened and i'd end up going and re-giving myself access, wondering what the heck happened.

After a couple of iterations of you re-denying and them re-adding themselves until they figured out you were doing it, that might make for a stupid "I'm the admin" argument which serves no purpose.

they are probobably making maintenance plans and changes based on what they perceive is best for the company...making lots of backups everywhere, most likely. you can't fault them for that.

If they are overwriting a critical backup you need to keep reverting to for testing, for example (happens to me all the time), you can keep an extra backup specifically for yourself, outside of any maintenance, and restore from File when you need it.

Lowell

--help us help you! If you post a question, make sure you include a CREATE TABLE... statement and INSERT INTO... statement into that table to give the volunteers here representative data. with your description of the problem, we can provide a tested, verifiable solution to your question! asking the question the right way gets you a tested answer the fastest way possible!

Jack Corbett SSC Guru Points: 184393 More actions · Answer 2

In my opinion, this is the sort of thing that should be handled by your manager. Lowell is right that discussion needs to take place, but if your title is DBA, even junior, and the other employee's titles are Network/Server/Windows admin, then they should NOT be doing anything regarding SQL Server maintenance.

Jack Corbett
Consultant - Straight Path Solutions
Check out these links on how to get faster and more accurate answers:
Forum Etiquette: How to post data/code on a forum to get the best help
Need an Answer? Actually, No ... You Need a Question

surbajit.shehri SSC Journeyman Points: 78 More actions · Answer 3

Thanks for your replies,

However just to let you know, I have been down talking route and to avail therefore the IT manager

has advised me to take this action, and he is the senior DBA, but he wants me to implement all myself.

So any Ideas...?

Jack Corbett SSC Guru Points: 184393 More actions · Answer 4

If they are only gaining access via Builtin\Administrators then removing that access should stop them. Of course if your SQL Server is running under a Domain Account then they can always use that if they know the password.

Jack Corbett
Consultant - Straight Path Solutions
Check out these links on how to get faster and more accurate answers:
Forum Etiquette: How to post data/code on a forum to get the best help
Need an Answer? Actually, No ... You Need a Question