Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 3 down vote favorite
1

I'm looking for a Microsoft Document or Article or Whitepaper on What OS level permissions are needed for SQL DBA (not SQL Service Account). There is a general assumption that SQL DBA's need Local Administrator Privilege but AFAIK it's needed only during SQL Install.

Any pointers to such document(s) will be appreciated.

share|improve this question

6 Answers

up vote 4 down vote

It's pretty common to give the DBA god rights over an SQL server for the following reasons:

  • The SQL server is usually just a SQL server, hence the only service a DBA can impact is the one he's responsible for.
  • DBAs sometimes need to reboot the server and reconfigure the OS.
  • For practical purposes where the DBA would otherwise have to wake an admin up on an overnight callout.

That said, it really depends on the organisation, and the kind of DBAs you have. Plus, you can grant a DBA administrative access over the SQL instance, without also granting administrative access to the OS. This is preferred if you don't/can't trust the DBA to maintain the OS, and you'll have to shoulder rebooting/maintenance responsibilities yourself.

You've asked a loaded question though, since MS doesn't really have a fixed position on this issue. You might find some technet discussions on the issue but I can't see them issuing a white paper. The closest I can get you is the security best-practices doco: http://download.microsoft.com/download/8/5/e/85eea4fa-b3bb-4426-97d0-7f7151b2011c/SQL2005SecBestPract.doc

share|improve this answer
up vote 2 down vote

AFAIK the assumption is supposed to be the other way around. You should have to prove that you need admin access. Clearly you would need it during an install (although I'd be the one doing the install with my account according to their specs). DBA's need admin access to SQL server. SQL server management studio should be run from their workstation, using their windows credentials and should give them all the access they need.

Edit: I took this take in my answer not because there is an absolute answer but because the OP states "There is a general assumption that SQL DBA's need Local Administrator Privilege"

From an admin point of view (whether it be as a SQL admin OR a sysadmin) I do not believe that this is either an industry standard practice or a best practice. Certainly all of the Microsoft docs are going to espouse least privilege

share|improve this answer
As noted above, DBAs should have to prove why they NEED (not want) admin rights on the server. IMHO there is no reason a DBA (with no other admin qualifications) should have administrator/root access to the database server: If they need configuration changes they should be asking the sysadmin. – voretaq7♦ Feb 8 '10 at 18:52
1  
@voretaq7 That sounds nice in an ideal world, but frankly I'd prefer to hire DBAs I can trust, run only DB services on my DB servers, and let them cut admins out of the loop for simple admin tasks. – phoebus Feb 8 '10 at 20:42
3  
@phoebus - And when the trustworthy DBA does something that breaks the environment will you be expecting the sysadmin group to repair the damage? I've cleaned up messes made by very competent, very well-meaning DBAs enough times to believe in this particular separation of church (DBA) and state (SA). – voretaq7♦ Feb 8 '10 at 21:10
1  
@voretaq7 Perhaps you don't run in a properly isolated environment. If you're running other services on the DB server then you have an issue already. The kinds of DBAs we hire were generally sysadmins long before they were DBAs. I suppose if you're dealing with some "teach yourself MSSQL in 21 days" folks then you have a point. Bottom line is that the principal of least privilege is always a good starting point, but in many environments the pros of DBAs as admins on select servers outweigh the cons. Blind dogmatism isn't any more useful in IT than cavalier permissions assignment. – phoebus Feb 8 '10 at 21:56
1  
@phoebus, I don't care if the DBA that I have helped write windows, in my environemnt (and as a general security priciple) no one gets privleges they cannot prove they actually need. I for instance, do not have admin rights to the sql servers. Not because I can't manage sql, but because it's simply not my area of responsibility and I don't need the privilege. It's not about competency per se. Certainly there are shops where the DBA is also an admin, however if you have an actual server admin there usually is no need for them to be an admin if you follow least privilege. – Jim B Feb 9 '10 at 2:52
show 2 more comments
up vote 1 down vote

Here is an MSDN article with lots of links to other articles relating to SQL Server Security.

http://msdn.microsoft.com/en-us/library/bb283235(SQL.90).aspx

Here is an article that talks about restricting interactive login for SQL Analysis services http://msdn.microsoft.com/en-us/library/ms175588(SQL.90).aspx

Depending on what the DBA's job responsibilities include and what you mean by "SQL Server", the DBA might need administrator rights. SQL Server could mean SQL Database Engine or Analysis Services or Integration Services or Reporting Services.

And then there is backups and restores and where those files sit. Does the DBA need to create new databases and can he/she create the data files and log files for those without admin rights. What about restarting services?

No the DBA does not have to be an administrator of the machine, but often the DBA is expected to do a lot of tasks that require those permissions.

share|improve this answer
up vote 1 down vote

I don't think MS would give a definitive position on this. The way I would see it is that if someone has local admin on a box then they are assuming a level of responsibility for that box: it's uptime, reliability, performance, security, etc at OS level. If the person is in a position to take on that responsibility, and if taking on that responsibility is within the remit of their job, then it's OK; otherwise the answer is "no".

share|improve this answer
up vote 0 down vote

There is a general AGREEMENT that SQL DBAs need Local Admin privileges.
If you tie the hands of the person responsible for the well-being of your database, expect it to die and have no one to blame but yourself.
To do everything that you need to do when you're an SQL DBA, you need admin rights. Don't be stingy -- or fire the one you've got and hire one you can trust. THEN don't be stingy.

share|improve this answer
up vote 0 down vote

@Jim B In most environments I've worked in the network engineers go out of their way to NOT allow my workstation to connect to SQL Server with SSMS. That being said in organizations I've worked for my rights as a DBA are almost always Local Admin on the database server, so that i have the ability to RDP into the server without having to run the server in Terminal Services Application mode.

Being able to restart services is also helpful i.e. SQL Server related services.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.