DB_Owner Database Role Membership Permission in SQL 2005

  • We are using a VB6 application thru Citrix Metaframe 4 on Windows 2003

    Servers that accesses a database on an SQL 2005 server (Windows Server

    2003 OS) that requires that the users (or user group) have the

    DB_Owner Database Role Membership Permission in SQL 2005. A client is

    concerned that this level of access for their users will leave open

    potential security risks. When we remove the DB_Owner Database Role

    Membership Permission in SQL 2005 our VB6 application cannot properly

    run stored procedures among other tasks. We use windows integrated

    security (active directory) only setup and NOT SQL Server

    authentication.

    Is the DB_Owner Database Role Membership Permission in SQL 2005 a real

    risk for security? The client is concerned the users can hack in and

    drop or alter the databases.

    Thank you!

  • It is a risk to give db_owner permissions to a user. check this link: http://technet.microsoft.com/en-us/library/cc966507.aspx.

  • It is a risk if you have someone that wants to be milicious, he can steel information or remove important data that will cost you time and man hours to fix. There is another way to protect the system and you can do it with server triggers. This will allow you to grant db_owner rights to users that log in from the app and deny access if they log in with anything else.

    >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    Do not reinvent the wheel.
    >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Viewing 3 posts - 1 through 2 (of 2 total)

You must be logged in to reply to this topic. Login to reply