SQL 2005 ALTER ANY LOGIN trouble

Hi all!

I want a user to be able to create windows logins, and only this, observing
least privileges.
As the SQL Server 2005 Books online teach, what is needed is grant the user
a server-wide permission ALTER ANY LOGIN.
That's what I'm doing:
1.
grant alter ANY login to [Domain\User]
which executes successfully. Then strange things begin to happen, .

2. First, I try to check whether the permission is really given:

.. execute as user = N'Domain\User'
SELECT Has_perms_by_name(null, null, N'ALTER ANY LOGIN');

returns 0.

3. I open the Management Studio\Server properties\Permissions for the login
in interest, the corresponding permissions are cheked! (BTW for myself it
returns 1, as I'm a sysadmin.)

4. Next I'm running

execute as user = N'Domain\User'

CREATE LOGIN [Domain\AnotherUser] FROM WINDOWS WITH
DEFAULT_DATABASE=[DB], DEFAULT_LANGUAGE=[us_english],

and getting

Msg 15247, Level 16, State 1, Line 12

User does not have permission to perform this action.

5. Then the User self runs this and it fails again.

6. Granting the User a CONTROL SERVER permission or including him in the
local Administrators group on the server (as myself) solves the problem. But
isn't it elevation of privileges? What for did we fight?

I feel I'm missing something. Who can shed the light?

Thanks

Oleg


.

Relevant Pages

  • Re: Allowing Anonymous write access only.
    ... need at least READ permission for login. ... > been set up so that anonymous FTP users have write access only, this> may seem insecure and we do get a certain ammount of hackers or> taggers testing the system by dropping test files and folders onto the> server, but because anonymous users do not have read access they soon> find that they cannot download anything they upload and go elsewhere. ... This is where my problems have started,> I initialy replicated all the IIS setting and NTFS permission from my> NT box on my 2003 box but so far have been unable to achive the same> result, it appaers that I can only grant anonymous write access if I ...
    (microsoft.public.inetserver.iis.ftp)
  • gdm hangs
    ... gdm will hang 9 of 10 times when logging out. ... with or without the client having been connected to the Server. ... # Timed login, useful for kiosks. ... Must output the chosen host on stdout, ...
    (Debian-User)
  • RE: Login Error: 18456, Severity: 14, State:11
    ... The problem is the Login is denied. ... The SQL server error log shows the lines: ... The ONLY permission that permits login is the 'Control Server' permission. ... Microsoft Online Community Support ...
    (microsoft.public.sqlserver.security)
  • Re: GRANT VIEW SERVER STATE to Database Role
    ... Since it is a Server permission, it has to be a login. ... If you have several domain logins to which you want to grant this permission, but you would like to limit how many times you grant this on the server, do the following. ...
    (microsoft.public.sqlserver.programming)
  • RE: OWA 2003 with ISA 2004
    ... OWA externally. ... i can login by any user. ... 825763 How to configure Internet access in Windows Small Business Server ... g. Reproduce this issue and send the logs to me. ...
    (microsoft.public.windows.server.sbs)