Sql server agent roles and job's owner issue

Question

Hi,
We have a tricky question about agent role and job owner. If I granted sqlagentoperatorrole to a windows account in a sql instance, the account will have permission to create a sql job, the job's owner is the account and he can edit the job. But we want
to keep all agent jobs' owner as SA. But after I (have sysadmin role) changed the job's owner to SA, the windows account won't be able to edit the job any more. but I don't want to give sysadmin role to the account, Does anybody have solution for my issue?
so recap my question,
1. all jobs owners should be SA
2. Allow some accounts without sysadmin permission can edit these jobs
3. Which kid of permission shall I grant to these accounts?
Thanks
David

Answer 1

Its not secessary to have SA for all the jobs, normally we avoid using SA...
Depends if you want to have some sort of security measures in place. If not, doesn't matter much. As for the 'sa' topic, I change the name of that account or disable immediately after install. It practically eliminates that vector of attack.
If you SQLAgentOperatorRole permissions then you can do the below... this is just a agent role so this comes under MSDB....
http://msdn.microsoft.com/en-us/library/ms188283.aspx
Also if you have sql SA access with doamin account or sql account then you can play with sql server completely without any issues, no harm in this...
Agenet principals are scoped to msdb; make sure you are running the statement from msdb DB. For example:
use [msdb]
go
-- The code where @userName is declared & set
EXEC sp_addrolemember 'SQLAgentOperatorRole', @userName
go
If you still have problems let us know, and please include the error number and message in order to help us understand the nature of the fauilure.
Best practice...
http://technet.microsoft.com/en-us/library/cc966485.aspx
Raju Rasagounder Sr MSSQL DBA