Re: db_denydatawriter

Hi Ekrem,

Thanks for your ideas.

I ran sp_hepuser on the data base & it returned two rows: The Group name
for each row was :

db_datareader
db_denydatawriter.

I tried sp_helpsrvrolemember as you alos suggested but her user name was not
included in the result set.

I'm wondering. We have an application which uses its own login to interact
with this database. If a user has read write access for this application,
perhaps this also gives read write access on the database to this user?
Sounds dangerous but this might be what is happening perhaps?

Thanks again for your ideas on this

Ant








"Ekrem Önsoy" wrote:

There is no difference modifying data using GUI or TSQL in terms of your
question. So, denying is denying.

Resrictive permissions overrides in its own level. So, when you assign
db_denydatawriter to her she would not be able to modify data even if she
would have db_owner right.

However, if she has sysadmin right, then she'll be able to modify that data.

You may want to run the following lines in your Query Analyzer to see your
logins and users mor detailed.

USE <database_name>
EXEC sp_helpuser <user's_name> -- this helps you what permissions she has on
that database

EXEC sp_helpsrvrolemember 'sysadmin' -- you don't need to change anything
with this command. It'll list logins who has sysadmin role.

--
Ekrem Önsoy



"Ant" <Ant@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:70FDAC21-1CDB-40CC-AEB5-E187178FE35E@xxxxxxxxxxxxxxxx
Hi Uri,

Thanks for your reply. I don't believe this is the case. There is no way
we
would have done the registration of EM with her, as she wasn't even
employed
at the time of the registration ( if I understand your meaning).

I'm wondering two things:

Does DenyWriter only deny using the actual UPDATE, DELETE, INSERT
statements
in queries, but not deny the user to graphically change data in EM?
or

Is it possible she has some admin rights which override DenyWriter (though
I
doubt this).

I checked her User & she has been assigned no server roles. Her DB Role
permissions include Public, DataReader & DenyDataWriter.

Does this help at all?

Many thanks though for your interest in this

Regards

Ant


"Uri Dimant" wrote:

Ant
Probably it is because you did the registration of EM with the user who
has
more powerfull permissions



"Ant" <Ant@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:C049AA62-F777-4111-A93F-E60F54BB8332@xxxxxxxxxxxxxxxx
Hi,

I have given a colleage db_datareader rights & db_denydatawriter rights
but
when she uses enterprise manager she can still edit fields graphically
simply
by clicking onthe field, changing it & moving the focus away.

Is this normal & if so, how can this be safegaurded against?

Many thanks for any ideas on this

Ant




.

Relevant Pages

  • Re: SQL Server 2005 Stored Procedure security annoyances
    ... stored proecedure on a database wide level? ... GRANT EXECUTE ON SCHEMA::MySchema TO MyRole ... I am sure I will forget some SP's and probably forget to set the rights ... permissions because not all stored procedures are equal. ...
    (microsoft.public.sqlserver.security)
  • Re: Disable Sysadmin to view metadata in SQL2005
    ... given the fact that they have sysadmin rights to that box? ... If the permissions are not granular enough, ... I think it's View Any Database / View Server State/ View ... the metadata? ...
    (microsoft.public.sqlserver.security)
  • Re: Grant admin rights to user temporarily
    ... The issue is that I have a database with empty tables, as it should, when I ... > rights to give themself rights... ... > Consequently the code, acting with the permissions of your user, can't give ... > the case of an action query, to run the query, even if they are otherwise ...
    (microsoft.public.access.security)
  • Re: Complete Neophyte Question(s)
    ... I guess it just seems backward that you'd grant permissions to these by ... For rights to _use_ objects then the appropriate rights need to be granted ... for a database that is supposed to be secured it is a bad idea ...
    (microsoft.public.sqlserver.security)
  • RE: Access 97 Security issue Cant make a MDE
    ... >>I am trying to make a MDE of a database. ... >>the dayabase as a user AND can sign in simply as admin, ... > permissions for the ... >>Admin rights. ...
    (microsoft.public.access.security)