Windows Authentication - Multiple Groups

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Michael MacGregor - 28 May 2007 21:07 GMT

If a user is a member of more than one Windows groups, what permissions will
the user be granted upon logging into SQL Server if the different groups
have different access rights?

Michael MacGregor
Database Architect

Reply to this Message

Jens - 28 May 2007 21:54 GMT

Granted right are commulative, restrictive rights will always
overrider granted rights, not matter how often a right was granted to
the user/group. E.g. the User is granted to Select and Insert from/to
a table through one memebership and granted DML through another
membership. If he would be denied the permission to insert in a third
group, the resulting rights would be Select / Delete / Insert

Jens K. Suessmeyer.

---
http://www.sqlserver2005.de
---

Reply to this Message

Erland Sommarskog - 28 May 2007 23:17 GMT

> Granted right are commulative, restrictive rights will always
> overrider granted rights, not matter how often a right was granted to
> the user/group. E.g. the User is granted to Select and Insert from/to
> a table through one memebership and granted DML through another
> membership. If he would be denied the permission to insert in a third
> group, the resulting rights would be Select / Delete / Insert

I guess you mean that the resulting rights would be SELECT-DELETE-UPDATE
as he was denied INSERT.

Signature

Erland Sommarskog, SQL Server MVP, esquel@sommarskog.se

Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/prodtechnol/sql/2005/downloads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodinfo/previousversions/books.mspx

Reply to this Message

Jens - 29 May 2007 04:27 GMT

Hehe, you are sure right :-) Test passed :-)

Jens K. Suessmeyer.

---
http://www.sqlserver2005.de
---

Reply to this Message