Hi
I need to manage a SQL cluster, monitor database and O.S performance and
apply database patches. Do I require local admin rights for this? If not
what is the workaround please?
Problem is, my organisation is very reluctant to grant local admin rights.
Is there a Microsoft article on this type of issue (I couldn't find one).
Thanks!
MilesHI
Use the SQL server account if you need local admin privilege on server.
Andras Jakus MCDBA
"Miles" wrote:
> Hi
> I need to manage a SQL cluster, monitor database and O.S performance and
> apply database patches. Do I require local admin rights for this? If not
> what is the workaround please?
> Problem is, my organisation is very reluctant to grant local admin rights.
> Is there a Microsoft article on this type of issue (I couldn't find one).
> Thanks!
> Miles
>
Showing posts with label dba. Show all posts
Showing posts with label dba. Show all posts
Monday, February 20, 2012
local administrator access for DBA's - is this required?
Hi
I need to manage a SQL cluster, monitor database and O.S performance and
apply database patches. Do I require local admin rights for this? If not
what is the workaround please?
Problem is, my organisation is very reluctant to grant local admin rights.
Is there a Microsoft article on this type of issue (I couldn't find one).
Thanks!
MilesHI
Use the SQL server account if you need local admin privilege on server.
Andras Jakus MCDBA
"Miles" wrote:
> Hi
> I need to manage a SQL cluster, monitor database and O.S performance and
> apply database patches. Do I require local admin rights for this? If not
> what is the workaround please?
> Problem is, my organisation is very reluctant to grant local admin rights.
> Is there a Microsoft article on this type of issue (I couldn't find one).
> Thanks!
> Miles
>
I need to manage a SQL cluster, monitor database and O.S performance and
apply database patches. Do I require local admin rights for this? If not
what is the workaround please?
Problem is, my organisation is very reluctant to grant local admin rights.
Is there a Microsoft article on this type of issue (I couldn't find one).
Thanks!
MilesHI
Use the SQL server account if you need local admin privilege on server.
Andras Jakus MCDBA
"Miles" wrote:
> Hi
> I need to manage a SQL cluster, monitor database and O.S performance and
> apply database patches. Do I require local admin rights for this? If not
> what is the workaround please?
> Problem is, my organisation is very reluctant to grant local admin rights.
> Is there a Microsoft article on this type of issue (I couldn't find one).
> Thanks!
> Miles
>
local administrator access for DBA's - is this required?
Hi
I need to manage a SQL cluster, monitor database and O.S performance and
apply database patches. Do I require local admin rights for this? If not
what is the workaround please?
Problem is, my organisation is very reluctant to grant local admin rights.
Is there a Microsoft article on this type of issue (I couldn't find one).
Thanks!
Miles
HI
Use the SQL server account if you need local admin privilege on server.
Andras Jakus MCDBA
"Miles" wrote:
> Hi
> I need to manage a SQL cluster, monitor database and O.S performance and
> apply database patches. Do I require local admin rights for this? If not
> what is the workaround please?
> Problem is, my organisation is very reluctant to grant local admin rights.
> Is there a Microsoft article on this type of issue (I couldn't find one).
> Thanks!
> Miles
>
I need to manage a SQL cluster, monitor database and O.S performance and
apply database patches. Do I require local admin rights for this? If not
what is the workaround please?
Problem is, my organisation is very reluctant to grant local admin rights.
Is there a Microsoft article on this type of issue (I couldn't find one).
Thanks!
Miles
HI
Use the SQL server account if you need local admin privilege on server.
Andras Jakus MCDBA
"Miles" wrote:
> Hi
> I need to manage a SQL cluster, monitor database and O.S performance and
> apply database patches. Do I require local admin rights for this? If not
> what is the workaround please?
> Problem is, my organisation is very reluctant to grant local admin rights.
> Is there a Microsoft article on this type of issue (I couldn't find one).
> Thanks!
> Miles
>
Local admin needed for DBA??
Its been proposed at my company that the DBA's no longer have WINNT Admin
rights to the SQL Servers. I don't know that Im totally opposed to it as long
as I can get my job done. What things would a DBA not be able to do if he was
not an Admin on the box? The two things Im really not sure of are replication
and performance monitor, but wouldnt be shocked if other people came up with
other ideas.
All thoughts are greatly appreciated.
TIA, ChrisRFull Text Search is hosed.
http://support.microsoft.com/kb/295051/en-us
There are encryption problems
http://support.microsoft.com/kb/314636/en-us
Replication will work if you use push subscriptions (change your snapshot
share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
pull, use a non administrator share snapshot share, i.e. don't use
\\publisher\c$ rather use something like \\publisher\temp where temp maps to
c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
--
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"ChrisR" <ChrisR@.discussions.microsoft.com> wrote in message
news:54D91F30-D23A-4D28-B685-AAD0AD4C654E@.microsoft.com...
> Its been proposed at my company that the DBA's no longer have WINNT Admin
> rights to the SQL Servers. I don't know that Im totally opposed to it as
> long
> as I can get my job done. What things would a DBA not be able to do if he
> was
> not an Admin on the box? The two things Im really not sure of are
> replication
> and performance monitor, but wouldnt be shocked if other people came up
> with
> other ideas.
> All thoughts are greatly appreciated.
> TIA, ChrisR|||This is a multi-part message in MIME format.
--080001010205040905060400
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Plus you wouldn't be able to start & stop services on the SQL boxes
(something I think every production DBA should be able to do) or
troubleshoot many O/S level problems. Setting up & troubleshooting
backup plans would become harder (but not impossible I guess) and
setting up log shipping would also become more troublesome.
Pretty much anything that deals with the O/S or filesystem on the SQL
box would become, if not impossible, more complicated to do. I'm all
for minimum-required privileges but a database administrator, I would
think, ought to be able to administer his or her database servers. I
guess it comes down to how you define "database administrator". Many
people categorise users who I would refer to as developers or analysts
as "database administrators". There's no way I would grant those type
of users local admin rights or sysadmin membership to SQL boxes. But
you need to put at least a little trust in the staff you hire to look
after your database servers methinks.
--
*mike hodgson*
blog: http://sqlnerd.blogspot.com
Hilary Cotter wrote:
>Full Text Search is hosed.
>http://support.microsoft.com/kb/295051/en-us
>There are encryption problems
>http://support.microsoft.com/kb/314636/en-us
>Replication will work if you use push subscriptions (change your snapshot
>share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
>to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
>pull, use a non administrator share snapshot share, i.e. don't use
>\\publisher\c$ rather use something like \\publisher\temp where temp maps to
>c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
>
>
--080001010205040905060400
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<tt>Plus you wouldn't be able to start & stop services on the SQL
boxes (something I think every production DBA should be able to do) or
troubleshoot many O/S level problems. Setting up & troubleshooting
backup plans would become harder (but not impossible I guess) and
setting up log shipping would also become more troublesome.<br>
<br>
Pretty much anything that deals with the O/S or filesystem on the SQL
box would become, if not impossible, more complicated to do. I'm all
for minimum-required privileges but a database administrator, I would
think, ought to be able to administer his or her database servers. I
guess it comes down to how you define "database administrator". Many
people categorise users who I would refer to as developers or analysts
as "database administrators". There's no way I would grant those type
of users local admin rights or sysadmin membership to SQL boxes. But
you need to put at least a little trust in the staff you hire to look
after your database servers methinks.<br>
</tt>
<div class="moz-signature">
<title></title>
<meta http-equiv="Content-Type" content="text/html; ">
<p><span lang="en-au"><font face="Tahoma" size="2">--<br>
</font></span> <b><span lang="en-au"><font face="Tahoma" size="2">mike
hodgson</font></span></b><span lang="en-au"><br>
<font face="Tahoma" size="2">blog:</font><font face="Tahoma" size="2"> <a
href="http://links.10026.com/?link=http://sqlnerd.blogspot.com</a></font></span>">http://sqlnerd.blogspot.com">http://sqlnerd.blogspot.com</a></font></span>
</p>
</div>
<br>
<br>
Hilary Cotter wrote:
<blockquote cite="midee8xk9xFGHA.532@.TK2MSFTNGP15.phx.gbl" type="cite">
<pre wrap="">Full Text Search is hosed.
<a class="moz-txt-link-freetext" href="http://links.10026.com/?link=http://support.microsoft.com/kb/295051/en-us</a>">http://support.microsoft.com/kb/295051/en-us">http://support.microsoft.com/kb/295051/en-us</a>
There are encryption problems
<a class="moz-txt-link-freetext" href="http://links.10026.com/?link=http://support.microsoft.com/kb/314636/en-us</a>">http://support.microsoft.com/kb/314636/en-us">http://support.microsoft.com/kb/314636/en-us</a>
Replication will work if you use push subscriptions (change your snapshot
share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
pull, use a non administrator share snapshot share, i.e. don't use
\\publisher\c$ rather use something like \\publisher\temp where temp maps to
c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
</pre>
</blockquote>
</body>
</html>
--080001010205040905060400--
rights to the SQL Servers. I don't know that Im totally opposed to it as long
as I can get my job done. What things would a DBA not be able to do if he was
not an Admin on the box? The two things Im really not sure of are replication
and performance monitor, but wouldnt be shocked if other people came up with
other ideas.
All thoughts are greatly appreciated.
TIA, ChrisRFull Text Search is hosed.
http://support.microsoft.com/kb/295051/en-us
There are encryption problems
http://support.microsoft.com/kb/314636/en-us
Replication will work if you use push subscriptions (change your snapshot
share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
pull, use a non administrator share snapshot share, i.e. don't use
\\publisher\c$ rather use something like \\publisher\temp where temp maps to
c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
--
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"ChrisR" <ChrisR@.discussions.microsoft.com> wrote in message
news:54D91F30-D23A-4D28-B685-AAD0AD4C654E@.microsoft.com...
> Its been proposed at my company that the DBA's no longer have WINNT Admin
> rights to the SQL Servers. I don't know that Im totally opposed to it as
> long
> as I can get my job done. What things would a DBA not be able to do if he
> was
> not an Admin on the box? The two things Im really not sure of are
> replication
> and performance monitor, but wouldnt be shocked if other people came up
> with
> other ideas.
> All thoughts are greatly appreciated.
> TIA, ChrisR|||This is a multi-part message in MIME format.
--080001010205040905060400
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Plus you wouldn't be able to start & stop services on the SQL boxes
(something I think every production DBA should be able to do) or
troubleshoot many O/S level problems. Setting up & troubleshooting
backup plans would become harder (but not impossible I guess) and
setting up log shipping would also become more troublesome.
Pretty much anything that deals with the O/S or filesystem on the SQL
box would become, if not impossible, more complicated to do. I'm all
for minimum-required privileges but a database administrator, I would
think, ought to be able to administer his or her database servers. I
guess it comes down to how you define "database administrator". Many
people categorise users who I would refer to as developers or analysts
as "database administrators". There's no way I would grant those type
of users local admin rights or sysadmin membership to SQL boxes. But
you need to put at least a little trust in the staff you hire to look
after your database servers methinks.
--
*mike hodgson*
blog: http://sqlnerd.blogspot.com
Hilary Cotter wrote:
>Full Text Search is hosed.
>http://support.microsoft.com/kb/295051/en-us
>There are encryption problems
>http://support.microsoft.com/kb/314636/en-us
>Replication will work if you use push subscriptions (change your snapshot
>share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
>to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
>pull, use a non administrator share snapshot share, i.e. don't use
>\\publisher\c$ rather use something like \\publisher\temp where temp maps to
>c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
>
>
--080001010205040905060400
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<tt>Plus you wouldn't be able to start & stop services on the SQL
boxes (something I think every production DBA should be able to do) or
troubleshoot many O/S level problems. Setting up & troubleshooting
backup plans would become harder (but not impossible I guess) and
setting up log shipping would also become more troublesome.<br>
<br>
Pretty much anything that deals with the O/S or filesystem on the SQL
box would become, if not impossible, more complicated to do. I'm all
for minimum-required privileges but a database administrator, I would
think, ought to be able to administer his or her database servers. I
guess it comes down to how you define "database administrator". Many
people categorise users who I would refer to as developers or analysts
as "database administrators". There's no way I would grant those type
of users local admin rights or sysadmin membership to SQL boxes. But
you need to put at least a little trust in the staff you hire to look
after your database servers methinks.<br>
</tt>
<div class="moz-signature">
<title></title>
<meta http-equiv="Content-Type" content="text/html; ">
<p><span lang="en-au"><font face="Tahoma" size="2">--<br>
</font></span> <b><span lang="en-au"><font face="Tahoma" size="2">mike
hodgson</font></span></b><span lang="en-au"><br>
<font face="Tahoma" size="2">blog:</font><font face="Tahoma" size="2"> <a
href="http://links.10026.com/?link=http://sqlnerd.blogspot.com</a></font></span>">http://sqlnerd.blogspot.com">http://sqlnerd.blogspot.com</a></font></span>
</p>
</div>
<br>
<br>
Hilary Cotter wrote:
<blockquote cite="midee8xk9xFGHA.532@.TK2MSFTNGP15.phx.gbl" type="cite">
<pre wrap="">Full Text Search is hosed.
<a class="moz-txt-link-freetext" href="http://links.10026.com/?link=http://support.microsoft.com/kb/295051/en-us</a>">http://support.microsoft.com/kb/295051/en-us">http://support.microsoft.com/kb/295051/en-us</a>
There are encryption problems
<a class="moz-txt-link-freetext" href="http://links.10026.com/?link=http://support.microsoft.com/kb/314636/en-us</a>">http://support.microsoft.com/kb/314636/en-us">http://support.microsoft.com/kb/314636/en-us</a>
Replication will work if you use push subscriptions (change your snapshot
share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
pull, use a non administrator share snapshot share, i.e. don't use
\\publisher\c$ rather use something like \\publisher\temp where temp maps to
c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
</pre>
</blockquote>
</body>
</html>
--080001010205040905060400--
Local admin needed for DBA??
Its been proposed at my company that the DBA's no longer have WINNT Admin
rights to the SQL Servers. I don't know that Im totally opposed to it as lon
g
as I can get my job done. What things would a DBA not be able to do if he wa
s
not an Admin on the box? The two things Im really not sure of are replicatio
n
and performance monitor, but wouldnt be shocked if other people came up with
other ideas.
All thoughts are greatly appreciated.
TIA, ChrisRFull Text Search is hosed.
http://support.microsoft.com/kb/295051/en-us
There are encryption problems
http://support.microsoft.com/kb/314636/en-us
Replication will work if you use push subscriptions (change your snapshot
share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
pull, use a non administrator share snapshot share, i.e. don't use
\\publisher\c$ rather use something like \\publisher\temp where temp maps to
c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"ChrisR" <ChrisR@.discussions.microsoft.com> wrote in message
news:54D91F30-D23A-4D28-B685-AAD0AD4C654E@.microsoft.com...
> Its been proposed at my company that the DBA's no longer have WINNT Admin
> rights to the SQL Servers. I don't know that Im totally opposed to it as
> long
> as I can get my job done. What things would a DBA not be able to do if he
> was
> not an Admin on the box? The two things Im really not sure of are
> replication
> and performance monitor, but wouldnt be shocked if other people came up
> with
> other ideas.
> All thoughts are greatly appreciated.
> TIA, ChrisR|||Plus you wouldn't be able to start & stop services on the SQL boxes
(something I think every production DBA should be able to do) or
troubleshoot many O/S level problems. Setting up & troubleshooting
backup plans would become harder (but not impossible I guess) and
setting up log shipping would also become more troublesome.
Pretty much anything that deals with the O/S or filesystem on the SQL
box would become, if not impossible, more complicated to do. I'm all
for minimum-required privileges but a database administrator, I would
think, ought to be able to administer his or her database servers. I
guess it comes down to how you define "database administrator". Many
people categorise users who I would refer to as developers or analysts
as "database administrators". There's no way I would grant those type
of users local admin rights or sysadmin membership to SQL boxes. But
you need to put at least a little trust in the staff you hire to look
after your database servers methinks.
*mike hodgson*
blog: http://sqlnerd.blogspot.com
Hilary Cotter wrote:
>Full Text Search is hosed.
>http://support.microsoft.com/kb/295051/en-us
>There are encryption problems
>http://support.microsoft.com/kb/314636/en-us
>Replication will work if you use push subscriptions (change your snapshot
>share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
>to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
>pull, use a non administrator share snapshot share, i.e. don't use
>\\publisher\c$ rather use something like \\publisher\temp where temp maps t
o
>c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
>
>
rights to the SQL Servers. I don't know that Im totally opposed to it as lon
g
as I can get my job done. What things would a DBA not be able to do if he wa
s
not an Admin on the box? The two things Im really not sure of are replicatio
n
and performance monitor, but wouldnt be shocked if other people came up with
other ideas.
All thoughts are greatly appreciated.
TIA, ChrisRFull Text Search is hosed.
http://support.microsoft.com/kb/295051/en-us
There are encryption problems
http://support.microsoft.com/kb/314636/en-us
Replication will work if you use push subscriptions (change your snapshot
share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
pull, use a non administrator share snapshot share, i.e. don't use
\\publisher\c$ rather use something like \\publisher\temp where temp maps to
c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"ChrisR" <ChrisR@.discussions.microsoft.com> wrote in message
news:54D91F30-D23A-4D28-B685-AAD0AD4C654E@.microsoft.com...
> Its been proposed at my company that the DBA's no longer have WINNT Admin
> rights to the SQL Servers. I don't know that Im totally opposed to it as
> long
> as I can get my job done. What things would a DBA not be able to do if he
> was
> not an Admin on the box? The two things Im really not sure of are
> replication
> and performance monitor, but wouldnt be shocked if other people came up
> with
> other ideas.
> All thoughts are greatly appreciated.
> TIA, ChrisR|||Plus you wouldn't be able to start & stop services on the SQL boxes
(something I think every production DBA should be able to do) or
troubleshoot many O/S level problems. Setting up & troubleshooting
backup plans would become harder (but not impossible I guess) and
setting up log shipping would also become more troublesome.
Pretty much anything that deals with the O/S or filesystem on the SQL
box would become, if not impossible, more complicated to do. I'm all
for minimum-required privileges but a database administrator, I would
think, ought to be able to administer his or her database servers. I
guess it comes down to how you define "database administrator". Many
people categorise users who I would refer to as developers or analysts
as "database administrators". There's no way I would grant those type
of users local admin rights or sysadmin membership to SQL boxes. But
you need to put at least a little trust in the staff you hire to look
after your database servers methinks.
*mike hodgson*
blog: http://sqlnerd.blogspot.com
Hilary Cotter wrote:
>Full Text Search is hosed.
>http://support.microsoft.com/kb/295051/en-us
>There are encryption problems
>http://support.microsoft.com/kb/314636/en-us
>Replication will work if you use push subscriptions (change your snapshot
>share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
>to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
>pull, use a non administrator share snapshot share, i.e. don't use
>\\publisher\c$ rather use something like \\publisher\temp where temp maps t
o
>c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
>
>
Local admin needed for DBA??
Its been proposed at my company that the DBA's no longer have WINNT Admin
rights to the SQL Servers. I don't know that Im totally opposed to it as long
as I can get my job done. What things would a DBA not be able to do if he was
not an Admin on the box? The two things Im really not sure of are replication
and performance monitor, but wouldnt be shocked if other people came up with
other ideas.
All thoughts are greatly appreciated.
TIA, ChrisR
Full Text Search is hosed.
http://support.microsoft.com/kb/295051/en-us
There are encryption problems
http://support.microsoft.com/kb/314636/en-us
Replication will work if you use push subscriptions (change your snapshot
share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
pull, use a non administrator share snapshot share, i.e. don't use
\\publisher\c$ rather use something like \\publisher\temp where temp maps to
c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"ChrisR" <ChrisR@.discussions.microsoft.com> wrote in message
news:54D91F30-D23A-4D28-B685-AAD0AD4C654E@.microsoft.com...
> Its been proposed at my company that the DBA's no longer have WINNT Admin
> rights to the SQL Servers. I don't know that Im totally opposed to it as
> long
> as I can get my job done. What things would a DBA not be able to do if he
> was
> not an Admin on the box? The two things Im really not sure of are
> replication
> and performance monitor, but wouldnt be shocked if other people came up
> with
> other ideas.
> All thoughts are greatly appreciated.
> TIA, ChrisR
|||Plus you wouldn't be able to start & stop services on the SQL boxes
(something I think every production DBA should be able to do) or
troubleshoot many O/S level problems. Setting up & troubleshooting
backup plans would become harder (but not impossible I guess) and
setting up log shipping would also become more troublesome.
Pretty much anything that deals with the O/S or filesystem on the SQL
box would become, if not impossible, more complicated to do. I'm all
for minimum-required privileges but a database administrator, I would
think, ought to be able to administer his or her database servers. I
guess it comes down to how you define "database administrator". Many
people categorise users who I would refer to as developers or analysts
as "database administrators". There's no way I would grant those type
of users local admin rights or sysadmin membership to SQL boxes. But
you need to put at least a little trust in the staff you hire to look
after your database servers methinks.
*mike hodgson*
blog: http://sqlnerd.blogspot.com
Hilary Cotter wrote:
>Full Text Search is hosed.
>http://support.microsoft.com/kb/295051/en-us
>There are encryption problems
>http://support.microsoft.com/kb/314636/en-us
>Replication will work if you use push subscriptions (change your snapshot
>share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
>to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
>pull, use a non administrator share snapshot share, i.e. don't use
>\\publisher\c$ rather use something like \\publisher\temp where temp maps to
>c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
>
>
rights to the SQL Servers. I don't know that Im totally opposed to it as long
as I can get my job done. What things would a DBA not be able to do if he was
not an Admin on the box? The two things Im really not sure of are replication
and performance monitor, but wouldnt be shocked if other people came up with
other ideas.
All thoughts are greatly appreciated.
TIA, ChrisR
Full Text Search is hosed.
http://support.microsoft.com/kb/295051/en-us
There are encryption problems
http://support.microsoft.com/kb/314636/en-us
Replication will work if you use push subscriptions (change your snapshot
share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
pull, use a non administrator share snapshot share, i.e. don't use
\\publisher\c$ rather use something like \\publisher\temp where temp maps to
c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"ChrisR" <ChrisR@.discussions.microsoft.com> wrote in message
news:54D91F30-D23A-4D28-B685-AAD0AD4C654E@.microsoft.com...
> Its been proposed at my company that the DBA's no longer have WINNT Admin
> rights to the SQL Servers. I don't know that Im totally opposed to it as
> long
> as I can get my job done. What things would a DBA not be able to do if he
> was
> not an Admin on the box? The two things Im really not sure of are
> replication
> and performance monitor, but wouldnt be shocked if other people came up
> with
> other ideas.
> All thoughts are greatly appreciated.
> TIA, ChrisR
|||Plus you wouldn't be able to start & stop services on the SQL boxes
(something I think every production DBA should be able to do) or
troubleshoot many O/S level problems. Setting up & troubleshooting
backup plans would become harder (but not impossible I guess) and
setting up log shipping would also become more troublesome.
Pretty much anything that deals with the O/S or filesystem on the SQL
box would become, if not impossible, more complicated to do. I'm all
for minimum-required privileges but a database administrator, I would
think, ought to be able to administer his or her database servers. I
guess it comes down to how you define "database administrator". Many
people categorise users who I would refer to as developers or analysts
as "database administrators". There's no way I would grant those type
of users local admin rights or sysadmin membership to SQL boxes. But
you need to put at least a little trust in the staff you hire to look
after your database servers methinks.
*mike hodgson*
blog: http://sqlnerd.blogspot.com
Hilary Cotter wrote:
>Full Text Search is hosed.
>http://support.microsoft.com/kb/295051/en-us
>There are encryption problems
>http://support.microsoft.com/kb/314636/en-us
>Replication will work if you use push subscriptions (change your snapshot
>share from \\publisher\c$\Program Files\Microsoft SQL server\MSSQL\ReplData
>to c:\Program Files\Microsoft SQL server\MSSQL\ReplData), if you are using
>pull, use a non administrator share snapshot share, i.e. don't use
>\\publisher\c$ rather use something like \\publisher\temp where temp maps to
>c:\Program Files\Microsoft SQL server\MSSQL\ReplData.
>
>
Local Admin group necessary for DBA's?
Assume that the DBA's windows login is in the sysadmin fixed server role, if
a DBA uses Windows Authentication to manage a SQL Server Enteriprise
(6.5,7.0,200), are there any problems with removing the DBA's account from
the local administrators group of each SQL Server?
Any supporting documentation or articles for removing the DBA from the admin
Group?
Any expected annoyances for the DBA?Hi,
You can't restrict the OS administrators fully, because they have full
rights on all folders and registry keys inwhich SQL server resides.
But, you can restrict them to an extend by removing "System Admin" role
from BUILTIN/ADMINISTRATORS account.
" I had problems in the below when I removed "Syadmin role" from
BuildIN/Administrators. So I have given back the sysadmin role to solve the
issue.
1. FULL Text Indexing
2. Maintenance Plans
So do a test in test server for couple of weeks and then implement in
Production server.
Known issues after removal , Some things to be aware of:
Q237604 PRB: SQL Server Agent Does Not Start and Displays Error 18456
Q295034 FIX: MSSearch Takes 100% CPU if BUILTIN\Administrators Removed
Q317746 PRB: SQL Server Full-Text Search Does Not Populate Catalogs "
Did i answer ur question?
Thanks
Hari
SQL Server MVP
"Johnnie Scott" <JohnnieScott@.discussions.microsoft.com> wrote in message
news:84A82B7C-6244-45C1-94A2-C64DE85C31FD@.microsoft.com...
> Assume that the DBA's windows login is in the sysadmin fixed server role,
> if
> a DBA uses Windows Authentication to manage a SQL Server Enteriprise
> (6.5,7.0,200), are there any problems with removing the DBA's account from
> the local administrators group of each SQL Server?
> Any supporting documentation or articles for removing the DBA from the
> admin
> Group?
> Any expected annoyances for the DBA?|||No, the question I'm really trying to answer is regarding removing the DBA's
windows account from the Local Administrators Group on the the server.
"Hari Prasad" wrote:
> Hi,
> You can't restrict the OS administrators fully, because they have full
> rights on all folders and registry keys inwhich SQL server resides.
> But, you can restrict them to an extend by removing "System Admin" role
> from BUILTIN/ADMINISTRATORS account.
>
> " I had problems in the below when I removed "Syadmin role" from
> BuildIN/Administrators. So I have given back the sysadmin role to solve t
he
> issue.
> 1. FULL Text Indexing
> 2. Maintenance Plans
> So do a test in test server for couple of weeks and then implement in
> Production server.
> Known issues after removal , Some things to be aware of:
> Q237604 PRB: SQL Server Agent Does Not Start and Displays Error 18456
> Q295034 FIX: MSSearch Takes 100% CPU if BUILTIN\Administrators Removed
> Q317746 PRB: SQL Server Full-Text Search Does Not Populate Catalogs "
> Did i answer ur question?
> --
> Thanks
> Hari
> SQL Server MVP
> "Johnnie Scott" <JohnnieScott@.discussions.microsoft.com> wrote in message
> news:84A82B7C-6244-45C1-94A2-C64DE85C31FD@.microsoft.com...
>
>|||We have this situation on some servers and it works to varying degree's.
There are "annoyances" - you have to work closely with the Windows admins to
define the required shares so that the DBA's can manage database
files,backups,logs etc. Management of a server "by committee" is tricky so
make sure you have the processes in place for the windows + sql admins to be
able to do their jobs. And remember that if the SQL Server Service account
is a member of the local admins group on the server so are the DBA's (via
xp_cmdshell) regardless of whether they are in the local admins group or not
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Johnnie Scott" <JohnnieScott@.discussions.microsoft.com> wrote in message
news:84A82B7C-6244-45C1-94A2-C64DE85C31FD@.microsoft.com...
> Assume that the DBA's windows login is in the sysadmin fixed server role,
> if
> a DBA uses Windows Authentication to manage a SQL Server Enteriprise
> (6.5,7.0,200), are there any problems with removing the DBA's account from
> the local administrators group of each SQL Server?
> Any supporting documentation or articles for removing the DBA from the
> admin
> Group?
> Any expected annoyances for the DBA?
a DBA uses Windows Authentication to manage a SQL Server Enteriprise
(6.5,7.0,200), are there any problems with removing the DBA's account from
the local administrators group of each SQL Server?
Any supporting documentation or articles for removing the DBA from the admin
Group?
Any expected annoyances for the DBA?Hi,
You can't restrict the OS administrators fully, because they have full
rights on all folders and registry keys inwhich SQL server resides.
But, you can restrict them to an extend by removing "System Admin" role
from BUILTIN/ADMINISTRATORS account.
" I had problems in the below when I removed "Syadmin role" from
BuildIN/Administrators. So I have given back the sysadmin role to solve the
issue.
1. FULL Text Indexing
2. Maintenance Plans
So do a test in test server for couple of weeks and then implement in
Production server.
Known issues after removal , Some things to be aware of:
Q237604 PRB: SQL Server Agent Does Not Start and Displays Error 18456
Q295034 FIX: MSSearch Takes 100% CPU if BUILTIN\Administrators Removed
Q317746 PRB: SQL Server Full-Text Search Does Not Populate Catalogs "
Did i answer ur question?
Thanks
Hari
SQL Server MVP
"Johnnie Scott" <JohnnieScott@.discussions.microsoft.com> wrote in message
news:84A82B7C-6244-45C1-94A2-C64DE85C31FD@.microsoft.com...
> Assume that the DBA's windows login is in the sysadmin fixed server role,
> if
> a DBA uses Windows Authentication to manage a SQL Server Enteriprise
> (6.5,7.0,200), are there any problems with removing the DBA's account from
> the local administrators group of each SQL Server?
> Any supporting documentation or articles for removing the DBA from the
> admin
> Group?
> Any expected annoyances for the DBA?|||No, the question I'm really trying to answer is regarding removing the DBA's
windows account from the Local Administrators Group on the the server.
"Hari Prasad" wrote:
> Hi,
> You can't restrict the OS administrators fully, because they have full
> rights on all folders and registry keys inwhich SQL server resides.
> But, you can restrict them to an extend by removing "System Admin" role
> from BUILTIN/ADMINISTRATORS account.
>
> " I had problems in the below when I removed "Syadmin role" from
> BuildIN/Administrators. So I have given back the sysadmin role to solve t
he
> issue.
> 1. FULL Text Indexing
> 2. Maintenance Plans
> So do a test in test server for couple of weeks and then implement in
> Production server.
> Known issues after removal , Some things to be aware of:
> Q237604 PRB: SQL Server Agent Does Not Start and Displays Error 18456
> Q295034 FIX: MSSearch Takes 100% CPU if BUILTIN\Administrators Removed
> Q317746 PRB: SQL Server Full-Text Search Does Not Populate Catalogs "
> Did i answer ur question?
> --
> Thanks
> Hari
> SQL Server MVP
> "Johnnie Scott" <JohnnieScott@.discussions.microsoft.com> wrote in message
> news:84A82B7C-6244-45C1-94A2-C64DE85C31FD@.microsoft.com...
>
>|||We have this situation on some servers and it works to varying degree's.
There are "annoyances" - you have to work closely with the Windows admins to
define the required shares so that the DBA's can manage database
files,backups,logs etc. Management of a server "by committee" is tricky so
make sure you have the processes in place for the windows + sql admins to be
able to do their jobs. And remember that if the SQL Server Service account
is a member of the local admins group on the server so are the DBA's (via
xp_cmdshell) regardless of whether they are in the local admins group or not
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Johnnie Scott" <JohnnieScott@.discussions.microsoft.com> wrote in message
news:84A82B7C-6244-45C1-94A2-C64DE85C31FD@.microsoft.com...
> Assume that the DBA's windows login is in the sysadmin fixed server role,
> if
> a DBA uses Windows Authentication to manage a SQL Server Enteriprise
> (6.5,7.0,200), are there any problems with removing the DBA's account from
> the local administrators group of each SQL Server?
> Any supporting documentation or articles for removing the DBA from the
> admin
> Group?
> Any expected annoyances for the DBA?
Local Admin access
Hi,
Can you give me reason why a SQL server DBA needs local admin access to the
server it self. This is to convinece auditors. As a SQL DBA I feel we need
to have full admin access.
thksHi
"stoney" wrote:
> Hi,
> Can you give me reason why a SQL server DBA needs local admin access to the
> server it self. This is to convinece auditors. As a SQL DBA I feel we need
> to have full admin access.
> thks
If you are just doing database administration then having local admin rights
should not be necessary, it can provide inconvenient if you don't have decent
support from the system administrators, but that would not be a satisfactory
reason for the auditors.
John
Can you give me reason why a SQL server DBA needs local admin access to the
server it self. This is to convinece auditors. As a SQL DBA I feel we need
to have full admin access.
thksHi
"stoney" wrote:
> Hi,
> Can you give me reason why a SQL server DBA needs local admin access to the
> server it self. This is to convinece auditors. As a SQL DBA I feel we need
> to have full admin access.
> thks
If you are just doing database administration then having local admin rights
should not be necessary, it can provide inconvenient if you don't have decent
support from the system administrators, but that would not be a satisfactory
reason for the auditors.
John
Subscribe to:
Posts (Atom)