RE: What commands can a user execute

learned from a security monitoring script which logs security events that a
member from this NT Group created and dropped a database. How ???

Maybe, he is a member of some other domain group that has the permission to
create database. Note that the owner of a database can always drop that
database.

Linchi

"Cqlboy" wrote:

I have user access SQL Server 2005 via a Windows NT Group which is not mapped
to any server roles but is a db_owner in almost all databases. I just
learned from a security monitoring script which logs security events that a
member from this NT Group created and dropped a database. How ???
Inspecting sp_srvrolepermission
and sp_dbfixedrolepermission I find that only the dbcreation server role has
the permission to create/drop a database which, again, my NT Group is not
mapped to.
How do I determine an NT Groups permissions and more importantly, which
commands they can execute ? Thanks. -CqlBoy

fn_my_permissions(NULL, 'Database')
sp_srvrolepermission
sp_dbfixedrolepermission

select sl.*
from master.sys.syslogins sl
left join sys.database_role_members rm on
user_name(rm.member_principal_id) = sl.loginname
.

Relevant Pages

  • Re: code access security
    ... Error 1 CREATE ASSEMBLY for assembly 'GmsSqlClr' failed because assembly ... owner has EXTERNAL ACCESS ASSEMBLY permission and the database has the ... make sure the database owner is mapped to the correct login on ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: low permission cannot convert from A97 to A2000/2003
    ... Delete is a separate permission. ... You need open exclusive permission on the database to ... > The admin user has full privileges. ... > as we wont be importing those files from them, and the contractor will be ...
    (microsoft.public.access.conversion)
  • Re: low permission cannot convert from A97 to A2000/2003
    ... Delete is a separate permission. ... You need open exclusive permission on the database to ... > The admin user has full privileges. ... > as we wont be importing those files from them, and the contractor will be ...
    (microsoft.public.access.security)
  • Re: Windows Power User SQL
    ... The guest user must have connect permission in master and tempdb. ... When I run from the master database for example testing against user bill ...
    (microsoft.public.sqlserver.security)
  • RE: What commands can a user execute
    ... member from this NT Group created and dropped a database. ... he is a member of some other domain group that has the permission to ...
    (microsoft.public.sqlserver.security)