I'm working with a newly hired dev on a server08 box - he'll be working both SQL and IIS7. In the past I've just bestowed Admin on devs (and if he's reading this - nothing personal - i'm sure you are a fine upstanding whatever yadayada).
The box has VS10 and sql08 but none of the existing groups are pointing at those specific packages. How do i go about assigning appropriate permissions?
thx
For SQL, you can create a new windows global group if it works for your purposes and grant specific permissions to sql databases.
It depends on how much control you want to give the developer. Personally, I'd set up the database for them and then give 'db_owner' so they could modify the contents. Don't give them db instance wide permissions - they probably don't need it.
Not sure about IIS rights.
For IIS7 you can use its delegation feature to delegate administrative and configuration functions.
But to debug web apps running under IIS you need an account with Debug privilege. While you can assign any account this privilege, Debug is one of the "God Privileges" and assigning it to an account will allow that account to gain all other privileges (since you can inject code into any other process using the debug APIs and thus grant all other privileges).
Looking at it another way (and, as a developer, I admit to bias): if you don't trust the individual to be an administrator on their development machines, how can you trust the code they write?