Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

 All Forums
 General SQL Server Forums
 New to SQL Server Administration
 dbo, datareader and datawriter

Author  Topic 

craigwg
Posting Yak Master

154 Posts

Posted - 2011-11-18 : 14:30:54
I have a host of users that are assigned as db_owner, db_datareader and db_datawriter at the same time on a multitude of databases. I want to remove the db_owner and keep the reader and writer in tact where needed. But I'm not sure EXACTLY what this means and booksonline is giving way too much information to be readily understood. Can someone give me a simple breakdown on the types of things that I lose by removing db_owner on a user?

Thanks!

Craig Greenwood

tkizer
Almighty SQL Goddess

38200 Posts

Posted - 2011-11-18 : 14:32:53
db_owner gives the user "god" privileges inside the database. The user will ONLY be able to do SELECT/INSERT/UPDATE/DELETE if the user only has db_datareader/db_datawriter. The user won't be able to do backups, run DDL (like CREATE/ALTER TABLE, CREATE/ALTER PROC), or anything outside of read/write on data.

Tara Kizer
Microsoft MVP for Windows Server System - SQL Server
http://weblogs.sqlteam.com/tarad/

Subscribe to my blog
Go to Top of Page

tkizer
Almighty SQL Goddess

38200 Posts

Posted - 2011-11-18 : 14:33:29
You should take a step back and see exactly what permissions these users need. Then determine what can be removed and possibly added.

So what do these users need to do?

Tara Kizer
Microsoft MVP for Windows Server System - SQL Server
http://weblogs.sqlteam.com/tarad/

Subscribe to my blog
Go to Top of Page

craigwg
Posting Yak Master

154 Posts

Posted - 2011-11-18 : 14:51:54
Helpful questions. I made a excel spreadsheet of the users and the dbs they have access to as well as their permission level. I'm done, it was a beast because I did it manually. Surely there are some dynamic views or SPs that exist to look at users and their permissions. Which ones do you suggest using?

Craig Greenwood
Go to Top of Page

tkizer
Almighty SQL Goddess

38200 Posts

Posted - 2011-11-18 : 15:26:02
I don't have a suggestion for how to easily check the permissions for each user.


Tara Kizer
Microsoft MVP for Windows Server System - SQL Server
http://weblogs.sqlteam.com/tarad/

Subscribe to my blog
Go to Top of Page

vikki.seth
Yak Posting Veteran

66 Posts

Posted - 2011-11-19 : 01:25:03
if you want to know what permissions any user has in your database? Since you are sysadmin you can impersonate anyone. The following query will impersonate another user to run the fn_my_permissions function


Use Dbname
Set quoted_identifier off
execute ('select * From fn_my_permissions(NULL, "database")') AS USER = 'Username'
Go to Top of Page
   

- Advertisement -