Re: Conflicting AD groups

Permissions are aggregates. So if a Windows User1 is a member of GroupA and GroupB and SQL Server creates a login for both GroupA and GroupB, the User1 will be able to connect and will have the permissions of both. There will be some unpredictability. If GroupA has a default database of Northwind and GroupB has a default database of AdventureWorks, then who knows what the default database of User1 will be. (I just tested with local groups and it was Northwind. Probably because it's listed first in the permissions list, but I wouldn't bet on it.)
And as always, DENY's override the aggregated GRANT's. So if GroupA has permission on object XYZ and GroupB is denied permission on object XYZ then User1 will be denied.
--
Rick Byham (MSFT), SQL Server Books Online
This posting is provided "AS IS" with no warranties, and confers no rights.

"JRStern" <JRStern@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:414E90D7-22E1-41E0-BCB2-8886DF7D953F@xxxxxxxxxxxxxxxx
I'm not a security guy, don't know if this is a simple or complex question,
but it seems it would be common.

We're setting up a new environment where most SQL Server security will be by
the Active Directory group membership a Windows login has. If a login is in
several groups with different levels of privileges, how is this resolved?
Point to a KB article would be fine.

Thanks.


Josh


.

Relevant Pages

  • Re: Everyone take ownership
    ... I change its permissions so only GROUPA and ... > in GROUPA or GROUPB can claim Ownership of the folder. ... Looks like the permission is inherited from the parent folder. ...
    (microsoft.public.win2000.security)
  • Re: Replacing groupname on share permissions
    ... the replacement of group with another in an ACL is not an elemental ... What you need to do is to create a new ACL to give groupA the ... and then revoke the access of GroupB. ... Changing permissions is generally something that should be done when the ...
    (microsoft.public.scripting.wsh)
  • Re: Replacing groupname on share permissions
    ... What you need to do is to create a new ACL to give groupA the ... and then revoke the access of GroupB. ... > Changing permissions is generally something that should be done when the ... from a large number of shares and replace ...
    (microsoft.public.scripting.wsh)
  • Re: networking with different groups
    ... >> desired access permissions for each shared disk and folder. ... >the permissions there is no way I can see USER1. ... It's your choice whether to create 6 individual user accounts or 2 ...
    (microsoft.public.windowsxp.network_web)
  • All or nothing NTFS permissions???
    ... I've added user1 and user2 as users and added them to an FTPAccounts ... the user has free reign to read/write to any sites on ... even though no other permissions have been given. ... applies even when the virtual directory points to a directory that is ...
    (microsoft.public.inetserver.iis.ftp)