Admin Rights for Everyone

I was chatting with someone that works at a smaller organization Still a few hundred employees, but the technical teams (dev and ops) were less than 20 in total. They mentioned that everyone had admin rights to the systems as they worked as a team and sometimes developers provided production support.

I haven’t encountered that in quite some time. Is it still a thing to give a lot of people administrator writes across many systems? I know for many organizations there is concern about developers being able to change things in production, but if you aren’t a public company or a regulated one, then Sarbanes-Oxley, HIPAA, PCI-DSS, or other restrictions don’t apply. In those cases, if you have a tight team that functions together, would you be worried about this practice?

My perspective is that I am worried, and I’d still want to restrict production access to a few. I might allow developers to merge code and approve pipelines to run, but I’d want to ensure there are audit trails. Ideally, I’d even restrict DBAs and others from using their credentials and force them to use pipelines, but I know reality. In the moment, during a crisis, they might need access in a quicker way that allows interactive work.

Sometimes production issues are hard to diagnose without being on the actual system.

What I might want to enable instead is a specific account (or a few) for sysadmins that can be used for production access, but with an extended event trace limited to capturing just their actions and all their actions. This wouldn’t trigger for most activity, but it would if an admin accessed the system. In my mind, this is less about a worry of malicious activity by an admin and more a way to ensure log all actions so we can troubleshoot mistakes.

I’m sure none of you make mistakes in a crisis, but I do. For my own safety, I’d want a record of my actions.

I might even set a policy of screenshot recording as well. Many of us work in SSMS, and it’s easy to forget if we ran a query, or what the results were. SQL History in SQL Prompt saves me often if I forget what query I ran, but it doesn’t capture results. If I’m running scripts, whether DDL/DML or clicking in SSMS, I would like a record of what happened. An audit trail we can review.

I do try not to click things in SSMS in production, and instead copy/save the scripts and then run them. It’s a better habit, but in a crisis, I know I might forget, as would others, so putting a system in place to capture actions is helpful. Recording your screen is an easy way to do this.

Admin rights widely distributed have been shown to be a bad idea, especially in the era of ransomware, social engineering, etc. However, some entity needs them, so try to ensure you have good governance around actions taken. Just in case someone makes a mistake.

Steve Jones

Listen to the podcast at Libsyn, Spotify, or iTunes.

Note, podcasts are only available for a limited time online.