Читаем матчасть:
ArcSDE_Config_GD_SQLServer.pdf, Chapter 2, Managing security:
ArcSDE 9 for Microsoft SQL Server supports Windows authentication with some restrictions:
1. Windows groups are supported for data manipulation language (DML) (select, insert, update, delete) operations only. Members of Windows groups cannot create data through ArcSDE.
2. If you must have Windows users create data, then those users must be granted access individually (not through a Windows group) and cannot have a domain name in their database username. If your login name is TERRA\bob, then your database username must be “bob”.
3. You cannot connect through ArcSDE as a different Windows user than your present login. If you logged in as TERRA\Ian, you cannot make a Windows authenticated connection as GLOBE\Ian.
4. You cannot restrict access to the %SDEHOME%\bin directory on the server if you connect through the application server. The application server spawns processes in the security context of the connecting Windows user. To correctly spawn the process, this directory must not be restricted to the connecting user. This is not a concern for direct connect Windows authenticated connections.
5. Not all ArcSDE clients support single sign-on, meaning you’ll have to enter your username to connect to ArcSDE services. At ArcSDE 9, only the ArcSDE administration commands support single sign-on. ArcGIS requires you to submit a username and password.
Т.е. права юзерам на чтение-редактирование Вы можете раздавать спокойно, используя роли и прочие прелести Windows Integrated security. А вот владельцами-администраторами данных придётся заниматься отдельно.
