Deb Melkin (b | t) is hosting T-SQL Tuesday this month and is letting us rant. Who doesn’t like to rant about databases and the famous “it depends”. She mentioned even doing a Ted Talk, we should find out more about this, she just linked to all the talks, I couldn’t find hers.
So, what to rant about? Should your managers have access to your SQL Server instances? It depends. You say on what. Well, just one thing. What type of manager do you have?
Working Managers
Working managers actively work on projects, participate in after-hours maintenance (not necessarily on call, but most of the time), have been a DBA, but basically are a DBA with management responsibility. This type of manager still needs full access to perform his job. But then we have the…
Manager Managers
These managers don’t know SQL Server and could be quite dangerous to the server. They may do something ask them to do while you aren’t around in an effort to help. They be a former DB2 DBA that is now a manager so by default is just in the “SQL DBA” AD Group. There is a reason we use AD Groups, you all do right, and distribution lists for alerts, please don’t just use your email to send important messages and make sure all the DBAs are in the DL and just you, side rant sorry. Your AD Group should just have the working DBAs in, and that should be the syadmin on the server. No should remove or add anyone to the group unless an HR event happens.
So, for example when coming into a new company it’s good to find out about this. Because I went into one company where everyone had the sa password in the whole company. I couldn’t keep anything under control or tracked as to who was doing what without a lot of work. And they weren’t willing to let me get things under control, so I make things better.
So, I recently interviewed for my current job and the manager readily admitted he would be willing to jump in and help and do anything. I ask him how much experience he had with SQL Server, and he readily said none. I told him then his sysadmin rights were going to be taken away from him. He didn’t miss a beat and said, “I’m good with that.” In my head, that was a big checkmark that said this a boss that can work for. One that doesn’t have a big ego or lock on control and is willing to let me come in do what I knew who to do best and trust me. He even told me to make sure I mention that when I interviewed the C-level security officer. But if your manager is actively helping work tickets and doing work that is different. My manager will be left with VIEW SERVER STATE privileges and our monitoring tool so he can see what is happening.
Summary
Manager managers stay away from the servers, let your DBAs do their jobs.
The post T-SQL Tuesday #152 – It Depends – Manager’s Access first appeared on Tracy Boggiano's Blog.