Re: Local Admin group necessary for DBA's?

• Previous message: John Harbison: "Re: Help with user accounts"
• In reply to: Johnnie Scott: "Local Admin group necessary for DBA's?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Wed, 3 Nov 2004 18:36:15 -0000

We have this situation on some servers and it works to varying degree's.
There are "annoyances" - you have to work closely with the Windows admins to
define the required shares so that the DBA's can manage database
files,backups,logs etc. Management of a server "by committee" is tricky so
make sure you have the processes in place for the windows + sql admins to be
able to do their jobs. And remember that if the SQL Server Service account
is a member of the local admins group on the server so are the DBA's (via
xp_cmdshell) regardless of whether they are in the local admins group or not

-- 
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Johnnie Scott" <JohnnieScott@discussions.microsoft.com> wrote in message 
news:84A82B7C-6244-45C1-94A2-C64DE85C31FD@microsoft.com...
> Assume that the DBA's windows login is in the sysadmin fixed server role, 
> if
> a DBA uses Windows Authentication to manage a SQL Server Enteriprise
> (6.5,7.0,200), are there any problems with removing the DBA's account from
> the local administrators group of each SQL Server?
>
> Any supporting documentation or articles for removing the DBA from the 
> admin
> Group?
>
> Any expected annoyances for the DBA? 

• Previous message: John Harbison: "Re: Help with user accounts"
• In reply to: Johnnie Scott: "Local Admin group necessary for DBA's?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]