Restricted Backup role

Question

Hi all
I am new to MSSQL, so please be patient if my question sounds trivial :-)
We have an instance of MSSQL for development and the people normally do frequent backup/restore of databases (i.e. for upgrade of customer's production DBs, restore of production databases, etc..) via "sa" login. Note that we don't have a dedicated
DBA and we would like to avoid to dedicate a resource only for these trivial tasks.
Now we would like to restrict such security policy, like:
Remove DBA permissions to all users
Grant all users a specific role to backup/restore databases ONLY remotely (i.e. to/from \\192.168.xxx.xxx\mySharedFolder)
Restore only to the database where user is dbOwner
Would this be possible just by using security restrictions (not with stored procedures)? How?
I had a quick look to the Media sets config, but I couldn't figure out how to restric only to remote locations, and the dp_backupoperator doesn't seem to be configurable. Also the CREATE DATABASE permission is way to strong as we don't want a user to be
able to restore to any database, but only to his own.
Thank you!

Answer 1

Hello,
I just tried out Below on SQL Server 2012 where I created a procedure which did backup on local disks. Created a Login and user mapped it to a database gave user DB datareader and BACKUP DATABASE permission. 
Procedure to backup database
USE [Database_Name]
GO
/****** Object: StoredProcedure [dbo].[BackupDatabase_Proc] Script Date: 10-10-2014 21:29:00 ******/
DROP PROCEDURE [dbo].[BackupDatabase_Proc]
GO
/****** Object: StoredProcedure [dbo].[BackupDatabase_Proc] Script Date: 10-10-2014 21:29:00 ******/
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
create procedure [dbo].[BackupDatabase_Proc]
@Dbname char(20),
@Location varchar(20)
as
Begin
declare @SQL NVARCHAR(500)
SET @SQL = 'BACKUP DATABASE ' + @dbName + ' TO DISK = '''
+ @Location + ''' WITH INIT'
exec sp_executesql @SQL
end
GO
After This I created Login and then user with same name and gave it data reader for database for which I need to take backup.
USE DATABASE_NAME
GO
CREATE LOGIN backupLogin WITH PASSWORD=N'backup', DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english],
CHECK_EXPIRATION=OFF, CHECK_POLICY=ON
GO
CREATE USER BACKUPLOGINUSER FOR LOGIN [backupLogin] WITH DEFAULT_SCHEMA=[dbo]
GO
ALTER ROLE DB_DATAREADER ADD MEMBER BACKUPLOGINUSER
After that granted execute permission on Procedure to User
GRANT EXECUTE ON BACKUPDATABASE_PROC TO BACKUPLOGINUSER
GO
GRANT BACKUP DATABASE TO BACKUPLOGINUSER
Well with above user have data reader privilege and can run procedure to take backup. Is this what you are looking for.
Please mark this reply as answer if it solved your issue or vote as helpful if it helped so that other forum members can benefit from it
My Technet Wiki Article
MVP