DB_Owner Database Role Membership Permission in SQL 2005

SQLServerCentral is supported by Red Gate Software Ltd.

Popular Topics

Home

Members

Calendar

Who's On

Home » SQL Server 2005 » SQL Server 2005 Security » DB_Owner Database Role Membership Permission...

DB_Owner Database Role Membership Permission in SQL 2005

Rate Topic

Display Mode

Topic Options

Author

Message

birdman357

Posted Friday, January 15, 2010 8:13 AM

Forum Newbie

Group: General Forum Members
Last Login: Thursday, February 11, 2010 9:08 AM
Points: 1, Visits: 11

We are using a VB6 application thru Citrix Metaframe 4 on Windows 2003
Servers that accesses a database on an SQL 2005 server (Windows Server
2003 OS) that requires that the users (or user group) have the
DB_Owner Database Role Membership Permission in SQL 2005. A client is
concerned that this level of access for their users will leave open
potential security risks. When we remove the DB_Owner Database Role
Membership Permission in SQL 2005 our VB6 application cannot properly
run stored procedures among other tasks. We use windows integrated
security (active directory) only setup and NOT SQL Server
authentication.

Is the DB_Owner Database Role Membership Permission in SQL 2005 a real
risk for security? The client is concerned the users can hack in and
drop or alter the databases.

Thank you!

Post #848304

Ignacio A. Salom Rangel

Posted Sunday, January 17, 2010 4:00 AM

Hall of Fame

Group: General Forum Members
Last Login: Wednesday, June 12, 2013 5:45 PM
Points: 3,051, Visits: 1,363

It is a risk to give db_owner permissions to a user. check this link: http://technet.microsoft.com/en-us/library/cc966507.aspx.

My blog

Post #848838

OomBoom

Posted Monday, January 18, 2010 5:10 AM

SSC Veteran

Group: General Forum Members
Last Login: Wednesday, March 27, 2013 5:19 AM
Points: 211, Visits: 424

It is a risk if you have someone that wants to be milicious, he can steel information or remove important data that will cost you time and man hours to fix. There is another way to protect the system and you can do it with server triggers. This will allow you to grant db_owner rights to users that log in from the app and deny access if they log in with anything else.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
I see stupid people
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Post #849091

« Prev Topic | Next Topic »

Permissions