BACKGROUND: Infrastructure team has revoked local admin where SQL Servers resides to everyone including DBAs. Finally, they agreed to let us RDP to the SQL Servers (which they had taken out), but any of the tasks we need elevated permissions are being done via a webex where the individual with rights logs into the server and gives me control to do what I have to do. (I still have to wait for that person to be available to do this for me).
I am Database Administrator III, MCSE, MCSA, and I can't even support my servers. My coworker and I provide support to over 140+ SQL servers from 2008-2014. 95% are virtual servers (Hypervisor). I am trying to get opinions from the SQL Server experts in the industry so I can document the answers for management, and would really appreciate your comments.
QUESTION: * What is an appropriate workaround? *
These new security policies implemented (and without letting us know when they were going into effect) against all the staff in IT, and have prevented my fellow DBA and I from doing the very basic DBA tasks (which I have already documented for my manager and explained locations affected, registry keys, etc..):
- Install SQL server
- Install Upgrades, Hotfixes, or apply patches to SQL server
- Upgrade or install features/components to SQL server
- Create databases
- Create data or log files and or move them to different devices
- Manage files or file groups for space utilization, cleanup, and TROUBLESHOOT
- Backup and Restores
- Install Microsoft Assessment and planning tool. Had to install under someone else’s login now I can’t run it or access the database in (localdb)\maptoolkit
- Reboot the server after installs or to clear up an issue.- I’m ok with infrastructure doing this
- Start and stop services for SQL components.- I’m ok with infrastructure doing this
- high availability
- SQL Server cluster
- another business continuity strategy
- Implement auditing
- Import/export data
- Start the instance of SQL Server in single-user mode
- Connect to SQL Server When System Administrators Are Locked Out
- Server Configuration Manager
- Create jobs in the OS scheduler if needed - I’m ok with infrastructure doing this if needed, and we can provide scripts
What is an appropriate workaround?