Click here to monitor SSC
SQLServerCentral is supported by Red Gate Software Ltd.
 
Log in  ::  Register  ::  Not logged in
 
 
 
        
Home       Members    Calendar    Who's On


Add to briefcase

DB_Owner Database Role Membership Permission in SQL 2005 Expand / Collapse
Author
Message
Posted Friday, January 15, 2010 8:13 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: General Forum Members
Last Login: Thursday, February 11, 2010 9:08 AM
Points: 1, Visits: 11
We are using a VB6 application thru Citrix Metaframe 4 on Windows 2003
Servers that accesses a database on an SQL 2005 server (Windows Server
2003 OS) that requires that the users (or user group) have the
DB_Owner Database Role Membership Permission in SQL 2005. A client is
concerned that this level of access for their users will leave open
potential security risks. When we remove the DB_Owner Database Role
Membership Permission in SQL 2005 our VB6 application cannot properly
run stored procedures among other tasks. We use windows integrated
security (active directory) only setup and NOT SQL Server
authentication.

Is the DB_Owner Database Role Membership Permission in SQL 2005 a real
risk for security? The client is concerned the users can hack in and
drop or alter the databases.

Thank you!
Post #848304
Posted Sunday, January 17, 2010 4:00 AM


Hall of Fame

Hall of FameHall of FameHall of FameHall of FameHall of FameHall of FameHall of FameHall of FameHall of Fame

Group: General Forum Members
Last Login: Friday, September 19, 2014 10:19 AM
Points: 3,087, Visits: 1,435
It is a risk to give db_owner permissions to a user. check this link: http://technet.microsoft.com/en-us/library/cc966507.aspx.




My blog
Post #848838
Posted Monday, January 18, 2010 5:10 AM
SSC Veteran

SSC VeteranSSC VeteranSSC VeteranSSC VeteranSSC VeteranSSC VeteranSSC VeteranSSC Veteran

Group: General Forum Members
Last Login: Tuesday, August 5, 2014 6:31 AM
Points: 215, Visits: 444
It is a risk if you have someone that wants to be milicious, he can steel information or remove important data that will cost you time and man hours to fix. There is another way to protect the system and you can do it with server triggers. This will allow you to grant db_owner rights to users that log in from the app and deny access if they log in with anything else.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
I see stupid people
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Post #849091
« Prev Topic | Next Topic »

Add to briefcase

Permissions Expand / Collapse