• is my solution correct ("db_denydatareader" to MASTER)

    No, it is not correct.

    Jared
    CE - Microsoft