Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working with a newly hired dev on a server08 box - he'll be working both SQL and IIS7. In the past I've just bestowed Admin on devs (and if he's reading this - nothing personal - i'm sure you are a fine upstanding whatever yadayada).

The box has VS10 and sql08 but none of the existing groups are pointing at those specific packages. How do i go about assigning appropriate permissions?


share|improve this question

For SQL, you can create a new windows global group if it works for your purposes and grant specific permissions to sql databases.

It depends on how much control you want to give the developer. Personally, I'd set up the database for them and then give 'db_owner' so they could modify the contents. Don't give them db instance wide permissions - they probably don't need it.

Not sure about IIS rights.

share|improve this answer

For IIS7 you can use its delegation feature to delegate administrative and configuration functions.

But to debug web apps running under IIS you need an account with Debug privilege. While you can assign any account this privilege, Debug is one of the "God Privileges" and assigning it to an account will allow that account to gain all other privileges (since you can inject code into any other process using the debug APIs and thus grant all other privileges).

Looking at it another way (and, as a developer, I admit to bias): if you don't trust the individual to be an administrator on their development machines, how can you trust the code they write?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.