I recently discovered an oversight in my knowledge of SQL Server security (I am still a neophyte):
Column GRANT overrides Table DENY by default.
Apparently you can change this setting, using the "common criteria compliance enabled" advanced option:
sp_configure 'show advanced options', 1;
sp_configure 'common criteria compliance enabled', 1;
sp_configure 'show advanced options', 0;
However, for some reason, I can't access the current state of this setting using the normal method:
select * from sys.configurations order by name;
I only see the related "c2 audit mode" show up, and "c2 audit mode" has been superseded by "common criteria compliance enabled". Does anyone know why I can't see the current state of this option? Is there another system view that I need to use instead? Is this a bug? I haven't found any information via Google or on MSDN about this...