do DBAS need local system admin privileges? and why?

Question

do DBAS need local system admin privileges? and why?

Viewing 10 posts - 16 through 24 (of 24 total)

You must be logged in to reply to this topic. Login to reply

cbaker-591171 SSC Veteran Points: 248 More actions · Answer 1

Without SysAdmin rights on the Windows box, you can't use Performance Monitor or view the Event Logs. In my previous job, I did not have SysAdmin on the Windows box, but at my current job I do. I can do a lot more monitoring and troubleshooting now.

Cathy

george sibbald SSC Guru Points: 104210 More actions · Answer 2

need to be sensible here. who knows what the DBA might need to do or look at to troubleshoot a problem, so give him/her local admin (on SQL servers only).

Could need to view logs, registry, task manager, stop\start services, apply a hotfix etc etc. You gonna call a windows admin and talk him thru it every time? Do that in the middle of the night a few times and the rules tend to relax (or common sense is used as I prefer to think of it).

Windows admin have to trust DBA not to interfere with OS stuff not their business and DBA has to trust windows admin not to interfere with SQL (e.g. resolve a 9002 by deleting a transaction log file as has happened to me more than once).

But there is an overlap in responsibilities so work together!

As someone who has lost a whole nights sleep and a SQL instance because I was told my id had local admin but it turned out some restrictions had been placed on it and a service pack went BADLY wrong, and the windows admin went AWOL, no admin privileges, no guarantees on support provided!

anyway, as your DBA has the ability to wipe out your companies precious data, why are you worrying about tweaking some windows parameters?

Aaaah, feels better to get that off my chest.

---------------------------------------------------------------------

rnandhal Valued Member Points: 57 More actions · Answer 3

As part of duty seperation big companies will not allow to give both OS & DB admin to single person.

If DBA need to do something in the OS then he need to sit with OS Admin and should get the things done.

My suggestion is DBA does not need OS Admin access.

SQL ORACLE One Orange Chip Points: 27807 More actions · Answer 4

I work in a company as a DBA with several thousand IT employees. I have both SQL admin and OS admin on each database server box.

One of our obligations is to pin the problem as fast as we can when any database server has any issue. When any issue exists, our team is the first for the users to look for help. After finding problems, we will discuss with OS team, if it is an OS-related issue, to go further because they may have more knowlege than we do in general and also because of company's policy. Without the OS admin privilege, everything will be slowed down.

Steve Jones - SSC Editor SSC Guru Points: 734459 More actions · Answer 5

I agree things move slowly and if you page out the Windows guy a few times at night, things might change. Or if you don't get a db working fast enough, your boss might change them.

However, the separation of duties makes sense and is mandated in some cases, so having them separate might mean two people have to work together. If that's the case, then work with it. You can do your job for the most part without sysadmin privileges. The parts that you can't, make sure someone is on call and your boss knows they are needed for some things.

Keep it professional and work together. Don't get petty or page them unnecessarily.

tvu4251 Mr or Mrs. 500 Points: 510 More actions · Answer 6

Many thanks for the feedbacks.

First of all, I'd like to appologize to Jeff and those that were misled to beleive that I am the other guy.

I am the poor sod who has to "tango" and play politics with the OS/Server admin guy. It has never been like this before. Most of those OS/serveradmin guys are decent human beings and understand DBAs and we usually get our work done.

This new place I am at, I have to deal with an ever-so-sweet guy but only on the surface. If he is normal, I will take Steve's and others' advices to bid my time and earn my trust. or, heaven forbids, a few disasters may intervene..

Thanks again. This site is great.

Key DBA SSCertifiable Points: 6029 More actions · Answer 7

tvu4251,

I had a similar situation with a Server Admin at a previous company. He was nice and friendly in meetings, in front of others, etc. When I would send work requests to him (via email) he would literally put me last on his priority list, BUT if I caught him in the hallway within earshot of someone of importance, he would "see what he could do" and viola, said work would be completed in a reasonable amount of time.

It took me a couple of months to figure out what was the best political way get better response times from him. My soultion was to include both our Bosses in all correspondence between him and myself. After that, I never had a problem "waiting" on him to complete a task. Hopefully you can use a similar method in your position at your new company.

Best of luck!

"Key"
MCITP: DBA, MCSE, MCTS: SQL 2005, OCP

tvu4251 Mr or Mrs. 500 Points: 510 More actions · Answer 8

Damon,

You just describe my guy to a T.

great advice! thanks.

Maybe you did work at the place I am currently employed.

I will try your solution.

Jeff Moden SSC Guru Points: 1003869 More actions · Answer 9

First of all, I'd like to appologize to Jeff and those that were misled to beleive that I am the other guy. I am the poor sod who has to "tango" and play politics with the OS/Server admin guy.

Absolutely no problem... we've all had to go through that bit of heaven before. That's why I say the DBA should have privs, as well. His system is the most important one on the whole box... he should have the rights to at least check the oil.

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)

Jeff Moden SSC Guru Points: 1003869 More actions · Answer 10

It took me a couple of months to figure out what was the best political way get better response times from him. My soultion was to include both our Bosses in all correspondence between him and myself. After that, I never had a problem "waiting" on him to complete a task.

We are fortunate... we have a very high visibility "ticketing" system. Everyone up to the owners of the company can see it. If work doesn't get done, you better have a pretty decent reason... and I don't mean excuse, either.

Me? If the work doesn't get done, I go to the rack of (political) bats I keep in my cube and select one with his name on it... 😛 When I place a ticket, you can bet something is really broke and needs attention, asap... I usually don't assign the ticket to the SysOp, either... I assign to his boss.

Of course, I earned some pretty serious stripes with the company long ago... people have the tendency to actually listen when I say something is wrong. Takes a bit of time to build up a good reputation and you'd better be pretty much spot on every time you open your mouth.

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)