SQL Clone
SQLServerCentral is supported by Redgate
 
Log in  ::  Register  ::  Not logged in
 
 
 


Disable database user


Disable database user

Author
Message
Fraggle-805517
Fraggle-805517
SSCertifiable
SSCertifiable (5.2K reputation)SSCertifiable (5.2K reputation)SSCertifiable (5.2K reputation)SSCertifiable (5.2K reputation)SSCertifiable (5.2K reputation)SSCertifiable (5.2K reputation)SSCertifiable (5.2K reputation)SSCertifiable (5.2K reputation)

Group: General Forum Members
Points: 5233 Visits: 1512
Hello everyone,

We are working on a migration, a few db's a night for the next week. Part of the migration requires that we shutoff access to the database. This is a 3rd party application and, in their infinite wisdom, they created a single login that maps to a user in each database.

As such, I cannot disable the login. Is there a way to disable the user or unmap it from the login?

Note, I am not able to take the DB offline, rename it, etc, which complicates things more.

Thanks,

Fraggle
Alvin Ramard
Alvin Ramard
SSC-Insane
SSC-Insane (21K reputation)SSC-Insane (21K reputation)SSC-Insane (21K reputation)SSC-Insane (21K reputation)SSC-Insane (21K reputation)SSC-Insane (21K reputation)SSC-Insane (21K reputation)SSC-Insane (21K reputation)

Group: General Forum Members
Points: 21137 Visits: 11752
Have you tried setting the database to Single_User mode?



Alvin Ramard
Memphis PASS Chapter

All my SSC forum answers come with a money back guarantee. If you didn't like the answer then I'll gladly refund what you paid for it.

For best practices on asking questions, please read the following article: Forum Etiquette: How to post data/code on a forum to get the best help
Fraggle-805517
Fraggle-805517
SSCertifiable
SSCertifiable (5.2K reputation)SSCertifiable (5.2K reputation)SSCertifiable (5.2K reputation)SSCertifiable (5.2K reputation)SSCertifiable (5.2K reputation)SSCertifiable (5.2K reputation)SSCertifiable (5.2K reputation)SSCertifiable (5.2K reputation)

Group: General Forum Members
Points: 5233 Visits: 1512
Can't do it. We are using Replication to migrate the databases.

Thanks,

Fraggle
Lowell
Lowell
SSC Guru
SSC Guru (185K reputation)SSC Guru (185K reputation)SSC Guru (185K reputation)SSC Guru (185K reputation)SSC Guru (185K reputation)SSC Guru (185K reputation)SSC Guru (185K reputation)SSC Guru (185K reputation)

Group: General Forum Members
Points: 185019 Visits: 41569
fraggle i just tested this myself;
i was hoping i could alter a user and remove their mapping to the existing login, but i found i had to crop and recreate the user without login instead.

if the user doesn't have a matching user, it wouldn't have access to that specific database anymore.

this was my test:

Create LOGIN [ClarkKent] WITH PASSWORD='NotTheRealPassword'

USE [WHATEVER]
Create USER [ClarkKent] FOR LOGIN [ClarkKent] ;
--didn't work:
--ALTER USER [ClarkKent] WITHOUT LOGIN;
--remove and put the user back without login, so we can
DROP USER [ClarkKent];
CREATE USER [ClarkKent] WITHOUT LOGIN;
--add back any roles, ie

CREATE ROLE [AlmostOwners]
EXEC sp_addrolemember N'db_ddladmin', N'AlmostOwners'
EXEC sp_addrolemember N'db_datareader', N'AlmostOwners'
EXEC sp_addrolemember N'db_datawriter', N'AlmostOwners'
--can the users EXECUTE procedures? comment out if false
GRANT EXECUTE TO [AlmostOwners]
--allow the users to see view proc and function definitions
Grant View Definition ON SCHEMA::[dbo] To [AlmostOwners]

--finally add our user to the role:
EXEC sp_addrolemember N'AlmostOwners', N'ClarkKent'




if needed then later we can ALTER USER [ClarkKent] FOR LOGIN [ClarkKent] to put him back.

Lowell
--help us help you! If you post a question, make sure you include a CREATE TABLE... statement and INSERT INTO... statement into that table to give the volunteers here representative data. with your description of the problem, we can provide a tested, verifiable solution to your question! asking the question the right way gets you a tested answer the fastest way possible!
dan-572483
dan-572483
SSCrazy Eights
SSCrazy Eights (9.1K reputation)SSCrazy Eights (9.1K reputation)SSCrazy Eights (9.1K reputation)SSCrazy Eights (9.1K reputation)SSCrazy Eights (9.1K reputation)SSCrazy Eights (9.1K reputation)SSCrazy Eights (9.1K reputation)SSCrazy Eights (9.1K reputation)

Group: General Forum Members
Points: 9103 Visits: 2026
How about putting the user in the db_denydatareader Database security Role?
Erland Sommarskog
Erland Sommarskog
SSChampion
SSChampion (13K reputation)SSChampion (13K reputation)SSChampion (13K reputation)SSChampion (13K reputation)SSChampion (13K reputation)SSChampion (13K reputation)SSChampion (13K reputation)SSChampion (13K reputation)

Group: General Forum Members
Points: 13438 Visits: 879
Fraggle-805517 (2013-07-18)
Is there a way to disable the user or unmap it from the login?


REVOKE CONNECT TO thisuser



Erland Sommarskog, SQL Server MVP, www.sommarskog.se
Orlando Colamatteo
Orlando Colamatteo
SSC Guru
SSC Guru (105K reputation)SSC Guru (105K reputation)SSC Guru (105K reputation)SSC Guru (105K reputation)SSC Guru (105K reputation)SSC Guru (105K reputation)SSC Guru (105K reputation)SSC Guru (105K reputation)

Group: General Forum Members
Points: 105352 Visits: 14506
There is no way to "disable a database user" per se. The way i do this is to remap the User i want to "disable" to a different Login, a temporary one that no one could ever usemto connect to the instance. Then when i want to "enable" the User again, i remap it to the original Login thereby reinstating access.

ALTER USER...WITH LOGIN =

__________________________________________________________________________________________________
There are no special teachers of virtue, because virtue is taught by the whole community. --Plato
Go


Permissions

You can't post new topics.
You can't post topic replies.
You can't post new polls.
You can't post replies to polls.
You can't edit your own topics.
You can't delete your own topics.
You can't edit other topics.
You can't delete other topics.
You can't edit your own posts.
You can't edit other posts.
You can't delete your own posts.
You can't delete other posts.
You can't post events.
You can't edit your own events.
You can't edit other events.
You can't delete your own events.
You can't delete other events.
You can't send private messages.
You can't send emails.
You can read topics.
You can't vote in polls.
You can't upload attachments.
You can download attachments.
You can't post HTML code.
You can't edit HTML code.
You can't post IFCode.
You can't post JavaScript.
You can post emoticons.
You can't post or upload images.

Select a forum








































































































































































SQLServerCentral


Search