Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to provide developers limited access to a production Windows Server 2008 Standard box. This is so they can diagnose problems that occur there with the ASP.NET application we are hosting. We want to make sure they can "do no harm" and not impact anything that's running there, but can get a good picture of problems that might be happening.

So, this is a two part question. First, what activities would you limit these users to (and what would you deny them access to), and secondly, how would you achieve that set of limitations?

share

migration rejected from superuser.com Jul 21 '13 at 21:51

This question came from our site for computer enthusiasts and power users. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as too broad by Wesley, kce, Ward, Falcon Momot, mdpc Jul 21 '13 at 21:51

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

    
I'm getting the "potentially subjective" warning on this question, so I want to defend this question a bit. Understand that the focus of this question is on ASP.NET. For example, an ASP.NET application can write to the file system, so that's one thing we'll want the users to be able to view without impacting. Also, it can write to the event log, so that's another place these users will need to see. If it still seems subjective, I'll be happy to refine it down. –  Brian Colavito Jul 19 '13 at 14:19
1  
unfourtunately, most of the tools such users would need, require them to have local admin on the server. the most common tools will be inetmgmt.msc, eventvwr.msc, Perfmon, and a number of random utils for monitoring resource allocation. They will also likely need the ability to actually run the web app from the servers desktop, so that actual asp error messages are displayed. theres just no way they can function under a limited-privledge account. –  Frank Thomas Jul 19 '13 at 16:03

3 Answers 3

If this is in production, you should be doing event log collection and performance monitoring anyway. Don't give them access to the server, give them access to the logs and performance charts on your monitoring server(s).

share
    
Agreed, if this is a production server then giving access to anyone but server admins is just not a good idea. However, the logs are a good start. –  Jacques Jul 22 '13 at 9:11

Giving access to the error logs would be a start. If you don't want to give permissions to the original files, or the folder, then an automated duplicating process could be used. If the .net app is compiled prior to publishing, or works in other environments, but your instance is generating errors, troubleshooting on the web server will be required. If you could duplicate the environment entirely, the http logs could be used to recreate the issues. There are some tools for this, loosely associated with session replay tools.

share

They should not need to diagnose the issue on the server. If the application generates meaningful logs, that log folder could be shared. If an exception or cpu/memory issue needs to be diagnosed, you can use DebugDiag to create process memory dumps to a folder, and share that with the developers. If they need access to the windows event logs, add them to the Event Log Readers group.

share

Not the answer you're looking for? Browse other questions tagged or ask your own question.