Granting REMOTE DBA authority

A user name with REMOTE DBA authority has full DBA authority on the database only when connecting from SQL Remote. With REMOTE DBA authority, SQL Remote has full access to the database and can make changes specified in the messages. Only users with REMOTE DBA or DBA authority can run SQL Remote.

As a special authority, REMOTE DBA, has the following properties:

No distinct permissions when not connected from SQL Remote A user that is granted REMOTE DBA authority has no extra privileges on any connection apart from SQL Remote. Therefore, even if the user name and password for a REMOTE DBA user are widely distributed, there are no security issues. As long as the user name has no permissions beyond CONNECT granted on the database, no one can use this user name to access data in the database.
Full DBA permission from SQL Remote When connecting from SQL Remote, a user with REMOTE DBA authority has full DBA permission on the database.

When to grant REMOTE DBA authority

It is recommended that when you are creating users on the consolidated database that you grant REMOTE DBA authority to the publisher of the consolidated database and to each remote user. When a remote database is extracted by the Extraction utility (dbxtract) or the Extract Database Wizard, the remote user becomes the publisher of the remote database, and is granted PUBLISH permission and REMOTE DBA authority.

This recommendation simplifies the administration of users. Each remote user only needs one user name to connect to the database, whether from the SQL Remote (which provides the user with full DBA authority) or from any other client application (in which case the REMOTE DBA authority grants the user no extra permissions).

Granting REMOTE DBA authority

When to grant REMOTE DBA authority

See also