Security Patch ,who can install it ?

[alex]

Hi,

We have several sql servers and company policy
1. all sql servers should be updated with latest MS Security Patches
2.Updates should be done by domain admistrators team.
3.Domain admins not sa of sql servers

Early we removed Bulitin\Admin group from all sql servers

When one of domain admin(domain\JoeBlow ) started updates for Windows and SQL securiy patch, update failed

I give domain\JoeBlow rights
to be server admin on sql ,update went half way and fail again.

When I gave domain\JoeBlow sa right ,update completed with success

If we don't want domain admins to be sa on sql server, what rights should they given to install Security patches?

Thank you

Alex

[rmiao]

Yes, you need sa rights to patch sql server. Sounds should change your policy one way or other.