You can prevent SQL Server DBA's from having local administrator privileges on Windows. You can create applications that enforce separation of duties in the external management of data. Multiple instances can be on the same server or multiple servers, and multiple servers provides an option for also splitting Windows privileges between two sets of operating system administrators. You can split data among different instances of SQL Server and not allow DBA's from one instance to have permissions on the other.
Apply channels separation studio full#
For example, SQL Server 2008 no longer includes a "BUILTIN\Administrators" group that used to give every local Windows administrator full sysadmin privileges in SQL Server by default.
You can prevent operating system administrators from gaining easy access to SQL Server. However, there are still several ways we can apply separation of duties to the management of SQL Server. Separation of duties is not designed into the SQL Server DBA role itself, as a senior SQL Server DBA will have the SQL Server sysadmin built-in server role, which gives a single DBA complete control over SQL Server. The idea of separating duties in general is to prevent a single person from being able to complete a task, such as a bank vault combination having 6 numbers, and giving 3 to one employee and 3 to another.
Someone recently asked me about the principle of separation of duties (aka segregation of duties) as it applies to SQL Server DBA's, and I thought that would make a good topic for this blog, so here goes. First published on TECHNET on Sep 12, 2011
0 kommentar(er)
