Giving developers local admin access on their workstations

  • I am a developer (SSRS/SSIS) and I recently got tired of having to complete a work order every time I wanted to change something on my local workstation (2012 eval install, developer edition install, various changes to config files, etc). I asked our systems administrator and was told it was too big of a security risk. I used to do server administration at a previous job so its not like I am going to hose my machine. I also have access to a local admin account on our PRODUCTION SSRS/SSIS server :blink:. Just curious what other people's opinions are. :Whistling:

  • Just as long as the developer knows that if he hoses his system he is on is own, ensures that all required software is installed and running at all times (AV for one).

  • Lynn Pettis (3/23/2012)


    Just as long as the developer knows that if he hoses his system he is on is own, ensures that all required software is installed and running at all times (AV for one).

    Yeah, i would agree with that statement. Also just for some background (or laughs, or horrors depending) our systems administrator is also our DBA and thinks its perfectly ok for our OLTP databases to be in simple recovery mode because "transaction log backups are not worth the storage cost". :sick:

  • msmithson (3/23/2012)


    Lynn Pettis (3/23/2012)


    Just as long as the developer knows that if he hoses his system he is on is own, ensures that all required software is installed and running at all times (AV for one).

    Yeah, i would agree with that statement. Also just for some background (or laughs, or horrors depending) our systems administrator is also our DBA and thinks its perfectly ok for our OLTP databases to be in simple recovery mode because "transaction log backups are not worth the storage cost". :sick:

    How often are Full/Differential backups taken?

    Should also ask, how big are your databases?

  • Lynn Pettis (3/23/2012)


    msmithson (3/23/2012)


    Lynn Pettis (3/23/2012)


    Just as long as the developer knows that if he hoses his system he is on is own, ensures that all required software is installed and running at all times (AV for one).

    Yeah, i would agree with that statement. Also just for some background (or laughs, or horrors depending) our systems administrator is also our DBA and thinks its perfectly ok for our OLTP databases to be in simple recovery mode because "transaction log backups are not worth the storage cost". :sick:

    How often are Full/Differential backups taken?

    Should also ask, how big are your databases?

    The most critical db's are 34Gb and 54GB. I believe full backup once a week and differentials nightly. Correct me if I'm wrong but if we have an "issue" (h/w failure, corruption, etc) at the end of the day we will lose everything since the last differential backup. :crying:

  • msmithson (3/23/2012)


    Lynn Pettis (3/23/2012)


    msmithson (3/23/2012)


    Lynn Pettis (3/23/2012)


    Just as long as the developer knows that if he hoses his system he is on is own, ensures that all required software is installed and running at all times (AV for one).

    Yeah, i would agree with that statement. Also just for some background (or laughs, or horrors depending) our systems administrator is also our DBA and thinks its perfectly ok for our OLTP databases to be in simple recovery mode because "transaction log backups are not worth the storage cost". :sick:

    How often are Full/Differential backups taken?

    Should also ask, how big are your databases?

    The most critical db's are 34Gb and 54GB. I believe full backup once a week and differentials nightly. Correct me if I'm wrong but if we have an "issue" (h/w failure, corruption, etc) at the end of the day we will lose everything since the last differential backup. :crying:

    Yes. Using the simple recovery model prevents you from doing a point-in-time recovery of your database. Also, if you were to lose just your mdf/ndf (data) files but still had access to the ldf (t-log), you can't do a tail-log backup to recover the after log up to the point of failure.

  • Lynn Pettis (3/23/2012)


    msmithson (3/23/2012)


    Lynn Pettis (3/23/2012)


    msmithson (3/23/2012)


    Lynn Pettis (3/23/2012)


    Just as long as the developer knows that if he hoses his system he is on is own, ensures that all required software is installed and running at all times (AV for one).

    Yeah, i would agree with that statement. Also just for some background (or laughs, or horrors depending) our systems administrator is also our DBA and thinks its perfectly ok for our OLTP databases to be in simple recovery mode because "transaction log backups are not worth the storage cost". :sick:

    How often are Full/Differential backups taken?

    Should also ask, how big are your databases?

    The most critical db's are 34Gb and 54GB. I believe full backup once a week and differentials nightly. Correct me if I'm wrong but if we have an "issue" (h/w failure, corruption, etc) at the end of the day we will lose everything since the last differential backup. :crying:

    Yes. Using the simple recovery model prevents you from doing a point-in-time recovery of your database. Also, if you were to lose just your mdf/ndf (data) files but still had access to the ldf (t-log), you can't do a tail-log backup to recover the after log up to the point of failure.

    For someone to call themselves a DBA and put the data at risk like that is unacceptable in my opinion. We have well over a hundred users on the system all day long entering financial transactions and other critical data and to me the cost of the lost data and man hours outweighs the storage costs, not to mention we just bought a 10TB SAN recently. I guess it doesn't really affect me because when something happens it won't be my job on the line but can you tell I don't like or respect this person :laugh:?

  • msmithson (3/23/2012)


    Lynn Pettis (3/23/2012)


    msmithson (3/23/2012)


    Lynn Pettis (3/23/2012)


    Just as long as the developer knows that if he hoses his system he is on is own, ensures that all required software is installed and running at all times (AV for one).

    Yeah, i would agree with that statement. Also just for some background (or laughs, or horrors depending) our systems administrator is also our DBA and thinks its perfectly ok for our OLTP databases to be in simple recovery mode because "transaction log backups are not worth the storage cost". :sick:

    How often are Full/Differential backups taken?

    Should also ask, how big are your databases?

    The most critical db's are 34Gb and 54GB. I believe full backup once a week and differentials nightly. Correct me if I'm wrong but if we have an "issue" (h/w failure, corruption, etc) at the end of the day we will lose everything since the last differential backup. :crying:

    I have another question, has he tested the the backup files by restoring the databases to another server or location? Remember this: Backups are worthless, Restores are priceless.

  • Depends on the developer and the level of responsibility they are willing to take.

    Jason...AKA CirqueDeSQLeil
    _______________________________________________
    I have given a name to my pain...MCM SQL Server, MVP
    SQL RNNR
    Posting Performance Based Questions - Gail Shaw[/url]
    Learn Extended Events

  • Lynn Pettis (3/23/2012)


    msmithson (3/23/2012)


    Lynn Pettis (3/23/2012)


    msmithson (3/23/2012)


    Lynn Pettis (3/23/2012)


    Just as long as the developer knows that if he hoses his system he is on is own, ensures that all required software is installed and running at all times (AV for one).

    Yeah, i would agree with that statement. Also just for some background (or laughs, or horrors depending) our systems administrator is also our DBA and thinks its perfectly ok for our OLTP databases to be in simple recovery mode because "transaction log backups are not worth the storage cost". :sick:

    How often are Full/Differential backups taken?

    Should also ask, how big are your databases?

    The most critical db's are 34Gb and 54GB. I believe full backup once a week and differentials nightly. Correct me if I'm wrong but if we have an "issue" (h/w failure, corruption, etc) at the end of the day we will lose everything since the last differential backup. :crying:

    I have another question, has he tested the the backup files by restoring the databases to another server or location? Remember this: Backups are worthless, Restores are priceless.

    Funny you should ask that, i was discussing the situation with another developer who is also a junior admin of sorts and he attempted a restore of one of the dbs for development purposes and found that it was worthless. Oops! :laugh:

  • No problem, as long a normal without adminrights can run the developed software (in most cases).

  • In the organizations I have worked for - we utilize Ghost or something similar to build workstations. I tell developers that if they do anything that causes a lot of problems - and cannot figure it out themselves, be ready to have your workstation reimaged and ready to reinstall everything.

    Anytime one of my developers calls desktop support for an issue with their workstation - I let the desktop support person know that they are not to spend any more than 10-15 minutes evaluating the issue.

    If it cannot be resolved in that amount of time, reimage and move on. The developer can spend the next several days reinstalling/rebuilding their system. If this causes them to miss their deadlines - and it happens frequently - we have an issue and will address it accordingly.

    BTW - we do this same thing for end user workstations. If it is going to take a lot of effort to fix, reimage and reinstall. The only difference is that our end users are not responsible for installing everything since those systems should not have development utilities installed.

    Jeffrey Williams
    Problems are opportunities brilliantly disguised as insurmountable obstacles.

    How to post questions to get better answers faster
    Managing Transaction Logs

  • Jeffrey Williams 3188 (3/24/2012)


    In the organizations I have worked for - we utilize Ghost or something similar to build workstations. I tell developers that if they do anything that causes a lot of problems - and cannot figure it out themselves, be ready to have your workstation reimaged and ready to reinstall everything.

    Anytime one of my developers calls desktop support for an issue with their workstation - I let the desktop support person know that they are not to spend any more than 10-15 minutes evaluating the issue.

    If it cannot be resolved in that amount of time, reimage and move on. The developer can spend the next several days reinstalling/rebuilding their system. If this causes them to miss their deadlines - and it happens frequently - we have an issue and will address it accordingly.

    BTW - we do this same thing for end user workstations. If it is going to take a lot of effort to fix, reimage and reinstall. The only difference is that our end users are not responsible for installing everything since those systems should not have development utilities installed.

    I used to do desktop support as well and this is a fair approach. I know for a fact that I am not going to hose my own machine but I'm pretty sure the sysadmin thinks I will somehow compromise the network or one of the systems. I was told that because my machine has internet access and access to outlook/exchange that I cannot have access to a local admin account, it is too dangerous. :laugh:

  • SQLRNNR (3/23/2012)


    Depends on the developer and the level of responsibility they are willing to take.

    I agree, but you would hope someone computer literate enough to be a developer, would also be computer literate enough to avoid screwing up their system. The exception to this would be C and C++ developers because the languages are quite possibly the most dangerous programming languages known to man.

    -edit

    Oops, didn't realise there was a second page

    I used to call my self The Master on forums, then I entered the IT industry and realised how much I still have to learn.

  • In my workplace, we have Windows Server 2008r2 installed on developer workstations.

    This allows each developer to run Hyper-V so have their own virtualised workspaces. If you ruin your machine, just revert to a previous snapshot or delete the virtual hard-drives and add the back-ups that you are responsible for keeping.


    Forever trying to learn
    My blog - http://www.cadavre.co.uk/
    For better, quicker answers on T-SQL questions, click on the following...http://www.sqlservercentral.com/articles/Best+Practices/61537/
    For better, quicker answers on SQL Server performance related questions, click on the following...http://www.sqlservercentral.com/articles/SQLServerCentral/66909/

Viewing 15 posts - 1 through 14 (of 14 total)

You must be logged in to reply to this topic. Login to reply