Permissions to modify SQL Agent Jobs

Question

Permissions
on SQL Server Agent
I would
like to assign the permission to user ,who can edit all SQL agent job(even own by others) without assigning the sysadmin role.
is it possible?
regards
EA

Answer 1

Hallo Ekbal,
only granting access to the procs will not fit because internally these procs check whether the executing account is member of the sysadmin-role of of any other roles which need the required permissions.
What you have to do is the development of a wrapper-proc which covers the execution with a different user. Get details concerning here:
http://msdn.microsoft.com/en-us/library/ms178106(v=sql.90).aspx
Long story short - you have to do the following steps if you execute the procedures in the context of a certificate:
1. Create a certificate you want to use for the execution of the wrapper procs in msdb
CREATE CERTIFICATE cert_Jobs
ENCRYPTION BY PASSWORD = 'myUltracomplexPassword'
WITH SUBJECT = 'Certificate for JobManagement',
START_DATE = '20120101',
EXPIRY_DATE = '29991231'
2. Backup the certificate for later implementation in the master and implementation in master database
BACKUP CERTIFICATE cert_JobHistory TO FILE = 'C:\temp\cert_JobHistory.cer';
USE master;
GO
CREATE CERTIFICATE cert_JobHistory FROM FILE = 'C:\temp\cert_JobHistory.cer';
3. Create a login based on the certifcate and make it a sysadmin
CREATE LOGIN login_JobHistory FROM CERTIFICATE [cert_JobHistory];
GRANT AUTHENTICATE SERVER TO [login_JobHistory];
GO
EXEC sp_addsrvrolemember @loginame = 'login_JobHistory', @rolename = 'sysadmin';
4. create a user in msdb for the login, create a wrapper proc for sp_update_job
USE msdb
GO
CREATE USER login_JobHistory FROM LOGIN [login_JobHistory];
GO
CREATE PROC dbo.proc_wrapper_update_job
@paramter_list of sp_upate_job
WITH EXECUTE AS OWNER
AS
BEGIN
EXEC dbo.sp_update_job @parameter_list
END
5. add signature of certificate to the proc
ADD SIGNATURE TO OBJECT::dbo.proc_wrapper_update_job
BY CERTIFICATE [cert_JobHistory]
WITH Password = ''myUltracomplexPassword';
6. Grant EXECUTE-permission on the proc to dedicated users you want to manage the jobs
IMHO this process is a bad workaround and - just my point of view - not practicable but I don't see any other solution than granting sysadmin privileges for the dedicated users. What you can do also is doing the modification to the mentioned procs but this
is definitely not recommended because these procs are system procs and you will loose support from Microsoft!
Get more details concerning execution of procedures by certificates by visiting the following links:
AUTHENTICATE SERVER:
http://support.microsoft.com/kb/906549
Using certificates for execution of procs:
http://msdn.microsoft.com/en-us/library/bb283630(v=sql.105).aspx
Uwe Ricken
MCSE - SQL Server 2012
MCSA - SQL Server 2012
MCITP Database Administrator 2005
MCITP Database Administrator 2008
MCITP Microsoft SQL Server 2008, Database Development
db Berater GmbH
http://www-db-berater.de
SQL Server Blog (german only)