Restricting Computer Administrator Access To Named SQL Instance

This is a slight re-stating from an older thread, which I think warrants some new discussion. The answer has always been that system administrators should have full access to everything on a system, including databases.

Although that is a logical position for internal IT departments it doesn't quite fit the model of systems with outsourced or external system support.


"If you don't trust your DBA, then you need a new DBA. They are in a position of authority for a reason and restricting that authority makes it impossible for them to do the job they are hired to do."

What about scenarios where you have local machine administrators that should NOT be given access to private data in a secured database, even though they need to be able to access and maintain everything else? And unfortunately some regulations are written about access to stored data whether encrypted or not...

In the modern world of Sarbanes-Oxley and PCI-DSS/CISP it is no longer so cut and dried. Especially where companies have software/hardware support contracts with third parties that require administrative access to other aspects of the systems.

So accepting that you might need someone to have administrative level access to the box but they should not be able to view the contents of a database installed on that box, what would you do?


Is there a way to create an adminstrative group that does not allow access to a specific named instance of SQL?

Is there a way to revoke access for one member of the administrators group only?


Thanks,
Ted