2

I'm DBA in my organization and use SQL Server 2012 and 2014. I requestd to define multiple group in active directory such as Developer, DBA, supporter and ets... and add my users to this groups. after this a create login from this groups and grant access to DBA, Developer and supporter groups. Change in my organization chart is above, and each time one personnel changed his position, I request to change his group in Active Directory.

My problem: The Admin of Active Directory can add his user or any user to each of this groups and get access to my database without that I get it.

I want to use this groups for grant permission and looked up for a way for solve my problem.

Thanks in advance.

Improve this question

1 Answer 1

Reset to default
2

This is a common issue, you want to use groups to keep things simple but you don't want to lose visibility of who has access to your databases. The way I see it you have two options:

  1. If you trust your AD admins (If you don't you have bigger problems) then use AD groups.
  2. If you don't trust your AD admins then you will have to manage access on a per user level by giving everyone an individual SQL Server login.
Improve this answer
2
  • Thanks for your comment. But I have about 20 Server with SQL Server and if I manage access on my servers per user, each time that my organization chart changed, must verify all of these servers.
    – mehdi lotfi
    May 6, 2015 at 7:27
  • @mehdilotfi Then the AD groups are the way to go. You should ask, if the data is sensitive, that some sort of auditing is set on the Active Directory groups that give access to the databases and that each change in the groups is accounted for. You can always query AD to get the group membership but if the AD administrators are not trusted an audit on those changes are needed, but that is out of scope for DBA.
    – Spörri
    May 6, 2015 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.