Limiting DBA access to SQL servers

[RouterBot]

I have been tasked with removing the DBAs full administrative access to the servers running SQL. Is this possible or do they need full administrative access to do their jobs?

Common tasks they perform:

1. SQL backups and restores.
2. The occasional patch or service pack. This could be done by the System Administrators.
3. Creation, modification and deletion of scheduled tasks.
4. Starting and stopping services.

I may have answered my own question with the list above. Has anyone done it? If so, could you give me some pointers?

 

[mrdenny]

DBA need full access to the database. Technically they do not need full access to the server's OS.

However if the Server Admins are going to be installing the service packs they should be prepaired to troubleshoot the installs. (Not to mention in a correctly configured SQL Server the server admin won't have the rights to install a SQL service pack even if they are members of the Administrators group.)

Starting and stopping services can usually be deligated to users who are not members of the Administrators group.

All that being said, the DBAs already have full access to all of the data in the database (probably more than the Server Admin's have). There should be no reason that they can't have admin access to the servers OS.

Denny
MCSA (2003) / MCDBA (SQL 2000) / MCTS (SQL 2005)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com