I would like to provide developers limited access to a production Windows Server 2008 Standard box. This is so they can diagnose problems that occur there with the ASP.NET application we are hosting. We want to make sure they can "do no harm" and not impact anything that's running there, but can get a good picture of problems that might be happening.
So, this is a two part question. First, what activities would you limit these users to (and what would you deny them access to), and secondly, how would you achieve that set of limitations?