InstantForum.NET v2.9.0SQLServerCentralhttp://www.sqlservercentral.com/Forums/notifications@sqlservercentral.comTue, 21 May 2013 13:45:21 GMT20http://www.sqlservercentral.com/Forums/Topic1367525-1550-1.aspxCheck the permissions on the objects with DENY[code="sql"]select p.name, p.type_desc,OBJECT_NAME(dp.major_id),OBJECT_SCHEMA_NAME(dp.major_id), dp.permission_name, dp.state_descfrom sys.database_permissions dpinner join sys.database_principals p on dp.grantee_principal_id = p.principal_idwhere dp.state <> 'G'[/code]Edit, actually it'll be the DENY at the database level for principal_id = 54So check who that is - if it's S\I then fix the permissions by using a REVOKE[code="sql"]select p.name, p.type_descfrom sys.database_principals pwhere p.principal_id = 54[/code]Wed, 03 Oct 2012 08:56:02 GMTfoxxohttp://www.sqlservercentral.com/Forums/Topic1367525-1550-1.aspx[quote][b]foxxo (10/3/2012)[/b][hr]That would work, except if S\AI is a member of any other Windows group that exists on the SQL server which has a DENY on ALTER, then he will still get the error. You'd need to go through and find the permissions.eg.[code="sql"]select * from sys.database_permissionswhere state <> 'G'[/code][/quote]Thanks..Please see the result of the above query.. what shall i be looking..[img]https://docs.google.com/open?id=0B0uFffnwypYVWmUtTnRMaWQ4UUE[/img][url=https://docs.google.com/open?id=0B0uFffnwypYVWmUtTnRMaWQ4UUE][/url]Wed, 03 Oct 2012 08:39:51 GMTvinuvthttp://www.sqlservercentral.com/Forums/Topic1367525-1550-1.aspxThat would work, except if S\AI is a member of any other Windows group that exists on the SQL server which has a DENY on ALTER, then he will still get the error. You'd need to go through and find the permissions.eg.[code="sql"]select * from sys.database_permissionswhere state <> 'G'[/code]Wed, 03 Oct 2012 08:11:51 GMTfoxxohttp://www.sqlservercentral.com/Forums/Topic1367525-1550-1.aspx[quote][b]foxxo (10/3/2012)[/b][hr]One of the groups will have a DENY permission on ALTER or similar.DENY takes precedence over any GRANTed permissions[/quote]hmm..Might be.. any script to find that..also this what i didAdded I.t group as a login on sql server added i.t group as a user with the database.. made i.t group member of db_reader,db_writed. created a role db_executer, granted execute permission to db_executer and made i.t group member of db_executer role.added S\Al as a login on sql sevrer added S\Al as a db user with default schema set to DBO added S\Al to db_ddladmin granted alter permission on dbo to s\alby doing this wouldn't individual get the extra permission he is been granted.. ???to make this worse..i did exactly something on other database and same person can drop/alter objects..Wed, 03 Oct 2012 07:54:52 GMTvinuvthttp://www.sqlservercentral.com/Forums/Topic1367525-1550-1.aspxNo not replicated...Wed, 03 Oct 2012 07:52:38 GMTvinuvthttp://www.sqlservercentral.com/Forums/Topic1367525-1550-1.aspxOne of the groups will have a DENY permission on ALTER or similar.DENY takes precedence over any GRANTed permissionsWed, 03 Oct 2012 07:19:15 GMTfoxxohttp://www.sqlservercentral.com/Forums/Topic1367525-1550-1.aspxis the database replicated?I know a very similar error comes up on replicated databases and you have to be a dbo to be able to make ddl changes.Wed, 03 Oct 2012 06:31:18 GMTAnimal Magichttp://www.sqlservercentral.com/Forums/Topic1367525-1550-1.aspxExpertsI am trying to set up permission for our IT team. All our IT staffs are member of I.T group. With the database in question the IT staffs groups are member of db_reader, db_reader and can execute all SP/Fun. one particular user I want to give the permission to modify the objects. CREATE USER [S\Al] FOR LOGIN [S\Al] WITH DEFAULT_SCHEMA=[dbo]added him to db_ddlAmin roleEXEC sp_addrolemember N'db_ddladmin', N'S\Al'all the objects in our db belongs to DBO schema..so i have give alter permission on dbo schema to the userGRANT ALTER ON SCHEMA::[dbo] TO [S\Al]But when this user tries to modify an sp or drop a table he gets Cannot alter the procedure 'XX', because it does not exist or you do not have permission.Cannot drop table 'XX', because it does not exist or you do not have permission. This user can create a new table, but if he tries to drop the newly created table he get the permission error..This user is member of 4 other group where the group is a member of either db_owner or db_ddladmin role, What am I doing wrong, how can i resolve this..ThanksVTWed, 03 Oct 2012 04:09:06 GMTvinuvt