In spite of our vehement protests, our management has decided that the development team must be granted 'sa' rights on the development server. The catch is that we, the DB support group are still responsible for maintaining this box.
We have now been entrusted the task of coming up with a list of Dos and Don'ts for the development teams with these enhanced privileges.
Please add to this list:
DO -- confine activities to the DB under development
DO NOT --
- change any SQL instance settings
- sp_configure (including cmdshell)
- add/change/delete any security settings
- add/change/delete database objects
- add/change/delete server objects like backup devices and linked servers
- add/change/delete replication
- add/change/delete maintenance plans
- touch any database that doesn't belong to your team
Any pointers to tools available for tracking these users activities will be greatly appreciated.