Re: sql admin rights question

From: Sue Hoegemeier (Sue_H_at_nomail.please)
Date: 04/12/05 

Date: Mon, 11 Apr 2005 18:51:09 -0600

If they need admin rights to the entire server then they
need to be a member of the sysadmin role. Any Deny does not
apply to a sysadmin. Permissions are cumulative with deny
taking precedence but a sysadmin bypasses all of this.

-Sue

On Mon, 11 Apr 2005 18:09:35 -0400, "Keith G Hicks"
<krh@comcast.net> wrote:

>Yes. This is very helpful. I just found "Denying Permissions" in B.O.L.
>Thank you.
>
>Keith
>
>"Joseph MCAD" <anonymous@microsoft.discussions.com> wrote in message
>news:e4KjIztPFHA.3704@TK2MSFTNGP12.phx.gbl...
>April 11, 2005
>
> Yes. You can grant the user the DB_Admin (hopefully that is the correct
>admin role) role and then goto the specific database and then put a Deny ACE
>in for the user. This will grant the user overall admin rights, but since
>Deny ACEs have precedence over allows, the user will not be able to access
>your database. I hope this helps! :-)
>
> Joseph MCAD
>
>
>
>

Relevant Pages

  • Re: sql admin rights question
    ... all management and administration activities. ... > You need to be able to Deny the admin, however, and therefore should Not ... >> If they need admin rights to the entire server then they ... >> need to be a member of the sysadmin role. ...
    (microsoft.public.sqlserver.security)
  • Re: Help!! They want to take away our Local Admin rights!!
    ... Let's see it from the SysAdmin POV for a minute, ... This means that, in general, if you have admin rights on the machine, ... automatically moves junk mail to a dedicated folder. ... TB will mark and move messages in the Junk folder. ...
    (borland.public.delphi.non-technical)
  • Re: sql admin rights question
    ... You need to be able to Deny the admin, however, and therefore should Not ... > need to be a member of the sysadmin role. ... > taking precedence but a sysadmin bypasses all of this. ...
    (microsoft.public.sqlserver.security)
  • Re: How to DENY SELECT permissions?
    ... You cannot DENY from sysadmin. ... "Lawrence" wrote in message ... > I'm dbo & sysadmin on this table that I'm trying to take away SELECT permission. ...
    (microsoft.public.sqlserver.programming)
  • RE: sysadmin
    ... you can't deny the sysadmin anything. ... Database change management for SQL Server ...
    (microsoft.public.sqlserver.tools)