Under OS group authentication for sysdba users: Start/Stop/Recover the db Run Oracle provided scripts that specify that the script is to be ran as SYS such as optional $ORACLE_HOME/rdbms/admin/cat*, dbms*, and utl* scripts. Application of Oracle patch sets and upgrade scripts as specified in the installation documentation It looks like this pretty much matches what you took from the manual. HTH -- Mark D Powell -- -----Original Message----- From: oracle-l-bounce@xxxxxxxxxxxxx [mailto:oracle-l-bounce@xxxxxxxxxxxxx]On Behalf Of Barbara Baker Sent: Wednesday, December 08, 2004 2:05 PM To: oracle-l@xxxxxxxxxxxxx Subject: What operations should be performed as SYS Have any of you had to define (for SOX or otherwise) what specific operations should be performed by SYS versus other administrative operations that can be performed by a user granted DBA privilege? If so, are you willing to share? (Help me! The auditor is on my tail. mayday mayday) Here's a list I came up with from the Database Administrator's Guide. However, I'm not too happy with it. Any additions/changes would sure be helpful. Thanks! Barb Perform startup and shutdown operations Alter database: open, mount, back up, or change character set Create database Create or modify init or spfile Alter database commands Archivelog and recovery commands -- //www.freelists.org/webpage/oracle-l -- //www.freelists.org/webpage/oracle-l