• Nicholas, thanks for your reply. The user is not listed under any of the groups under Server Roles, but is still able to access the DB.

    Jerry, the user is able to access and make DDL modifications to the DB even if I give only db_datareader access. Seems very strange...

    For now, I've disabled the login...

    Regards,

    Guru