Hi,
I'm the DBA of a 500 person state agency. I have 16 accounts with SysAdmin rights. That seems way too many. But the other server rights seem to be too restrictive. Even dbOwner seems restrictive. What sort of consensus is there for the rights other application developers and SAs ought to have?
MichaelG
The current way I have my asp.net 2.0 web app running reports is, based on an
interface the user selects the criteria for a report. The .RDL file is created
dynamically based on the user's selections.
I then need to SOAP the dynamically created report to the report server and
then the report runs fine.
BUT it requires Adminstrative rights to do this. Can this be accomplished
without giving the local machine admin rights. I am sorry if this question
has been answered before but i have not been up here in a while.
The DBA at our location is demanding local admin (windows) right's to the box so he can function. Right now when he logs in i have given him right's to the inetpub directory, sql directory, i have set him as a sysadmin on sql2005 and gone into the http:\localhost
eports and set him up as a system manager and under site priveledges set him as a sys admin. When he tries to login and configure the report server he gets the following error:
Title-Reporting services configuration manager
Error-There was an error refreshing the UI. bla bla bla
A WMI error has occurred and no additional error information is availiable
Title-Reporting services configuration manager
Error-There was an error while switching panels. The most likely cause is an error retrieving WMI properties. bla bla bla
A WMI error has occurred and no additional error information is availiable
then when he's in sql server 2005 surface area configuation
Title-Surface Area Configuration
Error-Access denied (system.management)
Is there any documentation or anythign anyone can tell me that i can do to give this DBA full access to configure and admin the SQL portion of his system without giving him admin rights to the OS???
Please help!!
Thanks for any time anyone has taken to review this thread!!
Can a Administrative Installation be performed with SQL 2005, and if so how is it done.
View 5 Replies View RelatedHello gentlemen,
I would like to ask a question, more like to verify something that I know myself.
I have an installation in SQL Server 7.0 (SP4), that hosts a database of 70gb with an average growth of 5 gb a month, that is being 'hitted' with an average of 600 clients, (about 50 to 90 concurrent hits). My question is :
Given the fact that I wish to upgrade my server to an SQL Server 2000 Enterprise Edition, how much RAM should I fit to the new machine?
I do have my suspicion, and I would like to keep it to myself for now, I would like also to ask if there's a formula for ram calculation. Mind you I don't ask for MINIMUM RAM, but more like OPTIMUM RAM, being that this Server hosts a critical system.
Thank you in advance.
I have a DTS package in a QA server (MS SQL SERVER 2000). Now I want to implement that DTS package to the Production Server (MS SQL SERVER 2000) without any administrative effort.
I just wanted to create a script which can then execute to the production server to create that DTS package.
Till now what I have done to overcome this issues are..
I have save the DTS package in QA Server as Structured Storage File.
And then copied the Structured Storage file from the QA Server to the production Server
And then execute the package using dtsrun utilities.
But in that case it is not creating the package in the production server.So that one can update or view the package from SQL Server Enterprise Manager ->Data transformation Service->Locale Package.
SQL Server 2005: Microsoft SQL Server Enterprise Edition (64-bit)
Microsoft Windows NT 5.2 (3790)
SQL Version 9.00.3175.00
I have 2 identical servers... one for DEV and one for TEST. On the DEV server, I can use xp_cmsdhell to execute "administrative commands" such as NET SHARE and AT. On the identically configured TEST server, I can not. Those command return the "System error 5 has occurred. Access is denied" error. I CAN run other commands via xp_cmdshell (DIR, NET USE, etc.). This is true regardless of the account I connect as.
The SQL Server service accounts in both instances are domain accounts belonging to the local admin group.
I "know" that I ran across this when setting up the DEV server and am "fairly sure" I found a reference to a known problem with 2005's xp_cmdshell and administrative commands. But for the life of me I can not now find any such reference, nor can I find any differences between the DEV and TEST servers in the area of users, groups, policies, or anything else security-related. (99.9% of the internet searches I do end up being about either enabling xp_cmdshell -- done -- or setting up an xp_cmdshell proxy account -- not needed).
Any input is greatly appreciated.
Thanks!
-dave
I should audit all access by dba (italian privacy law) in my sql server , what is the best way?
Using the build in audit i can't achieve this goal, do i miss something?
My sqlserver use windows auth.
I am not able to connect to Remote Distributor from Publisher using Administrative Link Password. I have configured the Distributor on 1 m/c and Publisher on another m/c. When i use the wizard to configure the publisher using remote distributor. I have also specified the same Admin Password link (distributor_admin) in the distributor m/c.
I am getting the following message:
TITLE: New Publication Wizard------------------------------
SQL Server could not connect to the Distributor using the specified password.
[URL]
------------------------------ADDITIONAL INFORMATION:
Connection to server [SANMENON] failed.OLE DB provider "SQLNCLI" for linked server "D956CF83-AE2E-4FC5-83DD-BE90D84A3950" returned message "Login timeout expired".OLE DB provider "SQLNCLI" for linked server "D956CF83-AE2E-4FC5-83DD-BE90D84A3950" returned message "An error has occurred while establishing a connection to the server. When connecting to SQL Server 2005, this failure may be caused by the fact that under the default settings SQL Server does not allow remote connections.". (Microsoft SQL Server, Error: 21670)
[URL]
------------------------------BUTTONS:
OK------------------------------
I want to give user right to create temp tables but I don't want to allow him modify any other tables, or any other rights. Any ideas?
View 1 Replies View RelatedHello, I need to create a sp that allows a user(not sa) to reset passwords using sp_password. The part that I'm stuck on is how to login within the proc so that the user(not sa) can exec the sp_password as sa without having to give the user sa rights. I don't mind hard coding the sa password with the proc but I can not give sa password to the users. Do I need to somehow alter sp_password for this to work?
Any help is much appreciated.
Thanks.
Hi
Need to give a user permission to add logins and users to a database. Have tries to alias the user to DBO but it doesnt work. Is there a way to do it other than reassigning DBO permissions to the user.
Thanks
Is there a way in SQL server to grant "SA" rights to non-SA users for certain commands.
I know there's a way to do this in Sybase by creating a password protected role and then activating it within a stored procedure.
Thus, the specific right is only active for the brief duration of the stored procedure - which runs the particular command to be granted. The role is de-activated at the end of the stored procedure.
Any suggestions are greatly appreciated.
Thanks,
Isaac
I have a basic question regarding rights. What level of rights do Ihave to have to grant another user update rights? I don't want togive everyone owner rights. Can a person with update rights grantanother person update rights?Thanks.
View 1 Replies View RelatedHi everybody,
The below I posted on SQL 2000 Forum about a week ago.
Any new thoughts................
I would like to get an input from as many people as possible on the following:
In our organization DBA is responsible for 5 servers ( currently NT 4/SQL 7)and is a part of group of a 5 people including manager and 3 developers.
DBA currently has a FULL access to every server.
In a few months we will be replacing the existing system with Windows 2000/SQL 2000.
LAN group will give to DBA only a read rights for the Windows 2000 environment, saying that the AUDITORS, both internal and external, require that. In other words, if DBA needs to run a command prompt, move files from one directory to another in Production environment, he has to fill the request to LAN, so LAN group would do that.
So I guess the main question(s) is:
What is the degree of involmment of DBA with Operating system?
Is DBA suppose to be an NT administrator ( I dont think so, since DBA has a lot of other thing to do?
If DBA accidently makes an unwanted changes to the Operating System, who should be blamed for ( not personally, but in more general terms) and would it be an extra argument to take write rights away from a DBA?
What auditors saying about that?
Thanks a lot in advance,
Andrei
I have a user that is requesting sa rights on a test server. I prefer to give him aliased
dbo rights. What is the difference between the two?? What can he not do with dbo
that he could with sa??
hi, I am having a database in sql server 7.0. it has a web front end database. how can I grant access to the tables. do I create a guest logins in the security folder, then in the database user tab, I give access as read,write. Or there is another way to do it.
Thanks
Ali
Hi,
I have public and dbo rights on a sp.
I am trying to call this sp thru a EntityBean(Java).
But I am getting an error.
Can anyone tell me what all rights do I need to execute this stored proc.?
TIA.
Jay
Hi All,
I have a user that should only have the rights to view the jobs and database properties within Enterprise Manager. I am not sure how to do that. Can you please help? Thanks.
Hi All,
I've restored the dev db from the prod backup which overwrote the users and their rights in dev db. Is there any way that I can find out what those rights were? I have the list of users in dev db but not their rights . Thanks.
Here is a debated question:
Does the DBA need admin rights?
They are not responsible for the server, user accounts, software updates of any kind or odbc configurations. This is controlled by the LANWAN server support group.
With the assigned SYSADMIN role, service account as local administrator, they have NTFS permissions the the DATAApplication partition and rights to stop and start all related services to SQL.
They can also access event viewer, performance monitor and other MMC snap-ins as read only.
Can they do required functions?
Thanks,
RJ
I remember seeing a document on this site a couple of years ago that explained reasons why a DBA needs sa access rights. I can go into BOL and generate a list of things you can only do with sa rights. However the article I am looking for was well written, much better than I could do.
My infrastructure team has decided that the DBA's and Sr. Developers will not have sa access rights. All schema changes, stored proc creation, view creation, database backups, maintenance plans, etc will go through their server engineers. They do not understand what they are getting into.
Does anyone have a nice document that would aid me in my efforts to convince the Infrastructure group to change their "new" policy?
Thanks for any info!!
Jeff
Hi everybody,
I would like to get an input from as many people as possible on the following:
In our organization DBA is responsible for 5 servers ( currently NT 4/SQL 7)and is a part of group of a 5 people including manager and 3 developers.
DBA currently has a FULL access to every server.
In a few months we will be replacing the existing system with Windows 2000/SQL 2000.
LAN group will give to DBA only a read rights for the Windows 2000 environment, saying that the AUDITORS, both internal and external, require that. In other words, if DBA needs to run a command prompt, move files from one directory to another in Production environment, he has to fill the request to LAN, so LAN group would do that.
So I guess the main question(s) is:
What is the degree of involmment of DBA with Operating system?
Is DBA suppose to be an NT administrator ( I dont think so, since DBA has a lot of other thing to do?
If DBA accidently makes an unwanted changes to the Operating System, who should be blamed for ( not personally, but in more general terms) and would it be an extra argument to take write rights away from a DBA?
What auditors saying about that?
Thanks a lot in advance,
Andrei
How do I text base add my domain users group with full rights to my database. I am using teratrax to manage my database. This is what comes up when I click on new database user
-- Replace all lower case words with your own code.
EXECUTE SP_GRANTDBACCESS 'login', 'user_name'
If I connect with SQL Management Studio to a server I cannot open or change SQL Agent jobs. (I can see them, but if I ask properties it opens a new job window).
At home I have no problem managing jobs.
I also cannot stop or start the SQL Agent.
What rights do I need? I am not in a domain, but with using the same username and password on my laptop as on the server and I have no problem connecting, add/changes databases and such.
Henri
~~~~
There's no place like 127.0.0.1
what users have the rights to execute sp_helpuser?
View 1 Replies View RelatedIf I on a remote hosting server have db_owner rights, do I then also havedb_securityadmin and db_dlladmin rights?BRGS, TCHillII
View 1 Replies View RelatedHi all,
I'm just a hobby programmer that writes programs for my personal use and maybe for friends.
I'm planning on using VB.Net 2008 Express edition for my development. I was using SQLite before with VB.Net 2005, but it seems the ADO.NET provider will not work with the VB.Net 2008 Express edition, so I'm thinking of moving to SSCE.
Do I still have to sign up for redistribution rights? I looked at the choices (What Best Describes You) when you start to sign up for those rights and I don't think I fall under any.
I was hoping to either just copy the 7 DLLs to the client computer or use the redistributable MSI installer to install SSCE.
Any help will be appreciated.
JB
Hi,
I am using SSRS 2005.
Created several reports on the server where SSRS is installed.
In addition I managed to develop a few more reports on my work station and then deployed the reports to the server.
From my local machine I can brose to http://servername/reports and view/run the reports.
Now I would like to find out if/how others can view some of the reports. How/where do I set rights...?
Thanks
I have recently published a report to SRS. I created a new service account and assigned that account the "Browser" role for the report that I wanted the service account to access. However, upon connecting to the SRS URL with the new service account, I am unable to view any reports. I then added the "view" and even the "Content Manager" role, and I still could not see the reports. I made the service account an admin on the box and I could see the necessary reports. Is there a local group that I need to place user accounts that I want to be able to access the reports I publish to the srs url?
Thanks,
Joe
I'm running into an issue with a user with restricted rights being able to access a local SDF file. The user has Modify right to the folder (and the file), but cannot access the SDF if it was created by someone else.
The only two workarounds I've found are: 1) If the I delete the SDF and then the restricted user creates the SDF they can then access it. 2) If I grant Full Control to the folder then the restricted user can access the database.
Is this by design? Are there programatic changes that can be made to enable access?
All users who login to the box (Windows XP) need to be able to access the same SDF. The SDF is stored on the local machine.
Thanks,rlw...
Hi All,
I've got an SQL 2005 server setup with some databases. I'm trying to set it up so that a user can upload his database backup and then restore the DB using Studio Express but am having some issues with it. The user can upload his database fine, but when we try and go in to restore it, he can't view the directory or file of the backup. I've added the service account that SQL runs as, as well as the SQL2005%Machine%etc... user without much luck. The only thing I can think of from here is SQL permissions and I'm a little vague on how to accomplish what I want. One other thing is that if I add sysadmin rights to the user, they can see the directories fine. I tried adding dbcreator as recommended by other posts and that didn't work either. Any help would be greatly appreciated. Thanks!
Brad