{"id":3617,"date":"2014-02-26T10:35:00","date_gmt":"2014-02-26T09:35:00","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/"},"modified":"2014-02-26T10:35:00","modified_gmt":"2014-02-26T09:35:00","slug":"sql-server-2014-select-all-users-securables-a-db-admins","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/","title":{"rendered":"SQL Server 2014 : SELECT ALL USERS SECURABLES & DB admins"},"content":{"rendered":"

\"\"<\/p>\n

Microsoft will introduce four new security permissions in SQL Server 2014. One of them called SELECT ALL USERS SECURABLES is the subject of this post. \u00a0As explained by Microsoft SQL Server 2014 will allow a database administrator to manage data without seeing sensitive data or personally identifiable information. We can achieve a greater compliance but we must take care what is said because we could be wrong about the terms \u201cmanage without seeing sensitive data\u201d. Let me explain.<\/p>\n

If we have a na\u00efve approach we could misunderstand this terms and think \u201coh great \u2026 with SQL Server 2014 we will prevent a database administrator to see all data (sensitive or not) but in\u00a0fact I think (personal point of view) on reflection it is not exactly the goal of this server permission.<\/p>\n

Basically \u201cSELECT ALL USERS SECURABLES\u201d permission is designed, when granted, to allow a user to view data in all databases he can connect. For auditing purposes, the new permission is very interesting and it can be also used to prevent someone to read. Furthermore, SQL Server 2005 introduced the concept of \u201csecurable\u201d that can be the server.\u00a0 One of the new server permission provided is CONTROL SERVER often associated with sysadmin fixed role because it will grant full server level permissions and automatically grant full access to all databases but unlike sysadmin fixed role it allow a more granular approach to granting and denying access to individual securable (login in our case) without bypassing the permission check algorithm. Thus, applying security principles to DBA team staff begins by avoiding to use sysadmin role and to prefer CONTROL SERVER permission. At this point I know, we\u00a0could claim this is not\u00a0that easy as\u00a0CONTROL SERVER has multiple caveats but let me demonstrate by a practical example where we can use the new server permission \u201cSELECT ALL USERS SECURABLES\u201d to restrict database administrators to view data in all databases.<\/p>\n

First we can create a server role introduced with SQL Server 2012 for the database administrator team:<\/p>\n

 <\/p>\n

CREATE SERVER ROLE dba;<\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
GO<\/span><\/div>\n

 <\/p>\n

Then we create a database administrator login dba1:<\/p>\n

 <\/p>\n

CREATE LOGIN dba1<\/span><\/span><\/span><\/span><\/div>\n
WITH PASSWORD = ‘dba1’,<\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
CHECK_POLICY = OFF;<\/span><\/span><\/span><\/span><\/span><\/div>\n
GO<\/span><\/div>\n

 <\/p>\n

We add the login as member of the dba1 fixed role :<\/p>\n

 <\/p>\n

ALTER SERVER ROLE dba ADD MEMBER dba1;<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
GO<\/span><\/div>\n

 <\/p>\n

Now it\u2019s time to play with both the server permission CONTROL SERVER and SELECT ALL USER SECURABLES to prevent a database administrator to read data in all databases.<\/p>\n

 <\/p>\n

GRANT CONTROL SERVER TO dba;<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
GO<\/span><\/div>\n
\u00a0<\/span><\/div>\n
DENY SELECT ALL USER SECURABLES TO dba;<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
GO<\/span><\/div>\n

 <\/p>\n

We can now\u00a0ensure it works by connecting with the login dba1.<\/p>\n

 <\/p>\n

SELECT SUSER_NAME() AS login_name, USER_NAME() as [user_name];<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
GO<\/span><\/div>\n

 <\/p>\n

In my configuration I have a database named SensitiveDB with a table named SensitiveTable.<\/p>\n

 <\/p>\n

\"billet2_newsecuritysql14_1\"<\/p>\n

 <\/p>\n

USE SensitiveDB;<\/span><\/span><\/span><\/span><\/div>\n
GO<\/span><\/div>\n
\u00a0<\/span><\/div>\n
SELECT *<\/span><\/span><\/span><\/div>\n
FROM INFORMATION_SCHEMA.TABLES;<\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
GO<\/span><\/div>\n

 <\/p>\n

\"billet2_newsecuritysql14_2\"<\/p>\n

 <\/p>\n

SELECT *<\/span><\/span><\/span><\/div>\n
FROM INFORMATION_SCHEMA.COLUMNS;<\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
GO<\/span><\/div>\n

 <\/p>\n

\"billet2_newsecuritysql14_3\"<\/p>\n

 <\/p>\n

SELECT<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SPECIFIC_CATALOG,<\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SPECIFIC_SCHEMA,<\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SPECIFIC_NAME,<\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ROUTINE_TYPE<\/span><\/span><\/div>\n
FROM INFORMATION_SCHEMA.ROUTINES;<\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n

 <\/p>\n

\"billet2_newsecuritysql14_4\"<\/p>\n

 <\/p>\n

And so on \u2026 At this point we can view all objects in the database and their definitions. Now if we try to read data in the table SensitiveTable or from the view V_SensitiveTable :<\/p>\n

 <\/p>\n

SELECT *<\/span><\/span><\/span><\/div>\n
FROM dbo.SensitiveTable;<\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
\u00a0<\/span><\/div>\n
SELECT *<\/span><\/span><\/span><\/div>\n
FROM dbo.V_SensitiveTable;<\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n

 <\/p>\n

\"billet2_newsecuritysql14_5\"<\/p>\n

 <\/p>\n

As expected we don\u2019t have the permissions to read data in the database or from anywhere. Ok great, we\u2019ve done a good job. Database administrators can manage the SQL Server instance but they cannot read data! But is it really over? The answer is\u00a0of course\u00a0no. Why? At this point we have to remember about the server permission CONTROL SERVER. It will grant full permissions on the server and automatically on all the databases. It means a person which have this server permission can grant himself permissions to a securable even if it exists an explicit DENY for this securable. It is easy to retrieve which permissions are denied :<\/p>\n

 <\/p>\n

— Check if dba1 is member of a server role<\/span><\/div>\n
SELECT<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 sp.name,<\/span><\/span><\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 sp.principal_id as login_principal_id,<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 sp.type_desc,<\/span><\/span><\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 sp2.name AS role_name,<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 sp2.principal_id as role_principal_id<\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
FROM sys.server_principals AS sp<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LEFT JOIN sys.server_role_members AS sr<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ON sp.principal_id = sr.member_principal_id<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 LEFT JOIN sys.server_principals AS sp2<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ON sp2.principal_id = sr.role_principal_id<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
WHERE sp.name = ‘dba1’;<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n

 <\/p>\n

\"billet2_newsecuritysql14_6\"<\/p>\n

 <\/p>\n

\u00a0— Check permissions for all concerned principal_id<\/span><\/div>\n
SELECT<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 grantee_principal_id,<\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 class_desc,<\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 [permission_name],<\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 state_desc<\/span><\/span><\/div>\n
FROM sys.server_permissions<\/span><\/span><\/span><\/span><\/span><\/div>\n
WHERE grantee_principal_id IN(267, 268);<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n

 <\/p>\n

\"billet2_newsecuritysql14_7\"<\/p>\n

 <\/p>\n

The login dba1 can now grant itself the \u201cSELECT ALL USER SECURABLES\u201d permission for the securable dba \u2026<\/p>\n

 <\/p>\n

USE [master];<\/span><\/span><\/span><\/span><\/div>\n
GO<\/span><\/div>\n
\u00a0<\/span><\/div>\n
GRANT SELECT ALL USER SECURABLES TO dba;<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
GO<\/span><\/div>\n

 <\/p>\n

\u2026 and read data in the SensitiveTable<\/p>\n

\"billet2_newsecuritysql14_8\"<\/p>\n

 <\/p>\n

What a surprise !!! Is it a bug, a mistake or a Microsoft marketing lie ? <\/span>I admit I had this reaction when I saw it and I’m pretty sure others also\u00a0! After a long discussion with some others SQL Server MVPS and friends, I don\u2019t think because event if a database administrator does not need the read data to perform its tasks there can be some cases where it may be necessary, for\u00a0example troubleshooting a long request with a\u00a0specific set of data. If you need a more restrictive role, you have to look at granting only those subsets of CONTROL SERVER. \u00a0I remember a discussion with one of my customer about the implementation of the separation of duties for database administrators particularly one question: Is the goal to prevent DBA staff to perform theirs tasks? Of course not but we want to audit action when a database administrator needs to elevate its privileges. Fortunately SQL Server provides an audit feature which can help to detect a malicious use of sysadmin permissions.<\/p>\n

We could\u00a0setup an audit trail that can track the event GRANT SELECT ALL USER SECURABLES permission and records events into the Windows security log or into the audit files which the database administrator has no access. Furthermore since SQL Server 2012 we can fail an action if it cannot be recorded to the audit target (ON FAILURE = FAIL_OPERATION)<\/p>\n

 <\/p>\n

USE [master]<\/span><\/span><\/span><\/div>\n
GO<\/span><\/div>\n
\u00a0<\/span><\/div>\n
— Creation of audit target<\/span><\/div>\n
CREATE SERVER AUDIT [HIGH_PERMISSIONS_GRANTED]<\/span><\/span><\/span><\/span><\/span><\/div>\n
TO FILE <\/span><\/span><\/span><\/div>\n
(\u00a0\u00a0\u00a0\u00a0\u00a0 FILEPATH = N’E:AUDIT’<\/span><\/span><\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ,MAXSIZE = 1024 MB<\/span><\/span><\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ,MAX_FILES = 10<\/span><\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ,RESERVE_DISK_SPACE = ON<\/span><\/span><\/span><\/span><\/span><\/div>\n
)<\/span><\/div>\n
WITH<\/span><\/div>\n
(\u00a0\u00a0\u00a0\u00a0\u00a0 QUEUE_DELAY = 1000<\/span><\/span><\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ,ON_FAILURE = FAIL_OPERATION<\/span><\/span><\/span><\/span><\/span><\/div>\n
)<\/span><\/div>\n
WHERE ([statement] LIKE ‘GRANT SELECT ALL USER SECURABLES%’);<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
GO<\/span><\/div>\n
\u00a0<\/span><\/div>\n
ALTER SERVER AUDIT [HIGH_PERMISSIONS_GRANTED] WITH (STATE = ON)<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
GO<\/span><\/div>\n
\u00a0<\/span><\/div>\n
— Creation of audit specification target<\/span><\/div>\n
CREATE SERVER AUDIT SPECIFICATION [HIGH_PERMISSIONS_GRANTED_specification]<\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
FOR SERVER AUDIT [HIGH_PERMISSIONS_GRANTED]<\/span><\/span><\/span><\/span><\/span><\/div>\n
ADD<\/span><\/div>\n
(<\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SERVER_PERMISSION_CHANGE_GROUP<\/span><\/span><\/div>\n
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 — To be completed by others usefull actions to track<\/span><\/span><\/div>\n
)<\/span><\/div>\n
WITH (STATE = ON);<\/span><\/span><\/span><\/span><\/span><\/span><\/span><\/div>\n
GO<\/span><\/div>\n

 <\/p>\n

Now if dba1 need to grant the server permission \u201cSELECT ALL USER SECURABLES\u201d automatically the event is recorded to the corresponded trace file:<\/p>\n

 <\/p>\n

\"billet2_newsecuritysql14_9\"<\/p>\n

 <\/p>\n

The audit trace in this case ca be used to detect quickly the malicious use of the some grant actions and limit the damages. Of course behind the scene a robust process must be in place before implementing the tool.<\/p>\n

To summarize, SQL Server 2014 facilitates the segregation of duties by implementing new server permissions but segregation of duties does not mean prevent in all cases some actions. To be efficient the segregation of duties consists of the implementation of automatic and preventives control. Feel free to share your opinion\u00a0on this subject !<\/p>\n

By David Barbarin<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Microsoft will introduce four new security permissions in SQL Server 2014. One of them called SELECT ALL USERS SECURABLES is the subject of this post. \u00a0As explained by Microsoft SQL Server 2014 will allow a database administrator to manage data without seeing sensitive data or personally identifiable information. We can achieve a greater compliance but […]<\/p>\n","protected":false},"author":26,"featured_media":3189,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[198],"tags":[49,25,52,434],"type_dbi":[],"class_list":["post-3617","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-database-management","tag-microsoft","tag-security","tag-sql-server-2014","tag-sql-server-audit"],"acf":[],"yoast_head":"\nSQL Server 2014 : SELECT ALL USERS SECURABLES & DB admins - dbi Blog<\/title>\n<meta name=\"description\" content=\"Microsoft will introduce four new security permissions in SQL Server 2014. One of them called SELECT ALL USERS SECURABLES is the subject of this post.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SQL Server 2014 : SELECT ALL USERS SECURABLES & DB admins\" \/>\n<meta property=\"og:description\" content=\"Microsoft will introduce four new security permissions in SQL Server 2014. One of them called SELECT ALL USERS SECURABLES is the subject of this post.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2014-02-26T09:35:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014_20130625-144612_1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"245\" \/>\n\t<meta property=\"og:image:height\" content=\"149\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Microsoft Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Microsoft Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/\"},\"author\":{\"name\":\"Microsoft Team\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/bfab48333280d616e1170e7369df90a4\"},\"headline\":\"SQL Server 2014 : SELECT ALL USERS SECURABLES & DB admins\",\"datePublished\":\"2014-02-26T09:35:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/\"},\"wordCount\":1261,\"commentCount\":0,\"image\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014_20130625-144612_1.jpg\",\"keywords\":[\"Microsoft\",\"Security\",\"SQL Server 2014\",\"SQL Server Audit\"],\"articleSection\":[\"Database management\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/\",\"name\":\"SQL Server 2014 : SELECT ALL USERS SECURABLES & DB admins - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014_20130625-144612_1.jpg\",\"datePublished\":\"2014-02-26T09:35:00+00:00\",\"author\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/bfab48333280d616e1170e7369df90a4\"},\"description\":\"Microsoft will introduce four new security permissions in SQL Server 2014. One of them called SELECT ALL USERS SECURABLES is the subject of this post.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/#primaryimage\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014_20130625-144612_1.jpg\",\"contentUrl\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014_20130625-144612_1.jpg\",\"width\":245,\"height\":149},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/www.dbi-services.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SQL Server 2014 : SELECT ALL USERS SECURABLES & DB admins\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/bfab48333280d616e1170e7369df90a4\",\"name\":\"Microsoft Team\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/c44a1a792c059f24055763aa77d80a244467f6eef724a8bd13db8d4a350b7a4c?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/c44a1a792c059f24055763aa77d80a244467f6eef724a8bd13db8d4a350b7a4c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/c44a1a792c059f24055763aa77d80a244467f6eef724a8bd13db8d4a350b7a4c?s=96&d=mm&r=g\",\"caption\":\"Microsoft Team\"},\"url\":\"https:\/\/www.dbi-services.com\/blog\/author\/microsoft-team\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"SQL Server 2014 : SELECT ALL USERS SECURABLES & DB admins - dbi Blog","description":"Microsoft will introduce four new security permissions in SQL Server 2014. One of them called SELECT ALL USERS SECURABLES is the subject of this post.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/","og_locale":"en_US","og_type":"article","og_title":"SQL Server 2014 : SELECT ALL USERS SECURABLES & DB admins","og_description":"Microsoft will introduce four new security permissions in SQL Server 2014. One of them called SELECT ALL USERS SECURABLES is the subject of this post.","og_url":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/","og_site_name":"dbi Blog","article_published_time":"2014-02-26T09:35:00+00:00","og_image":[{"width":245,"height":149,"url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014_20130625-144612_1.jpg","type":"image\/jpeg"}],"author":"Microsoft Team","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Microsoft Team","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/"},"author":{"name":"Microsoft Team","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/bfab48333280d616e1170e7369df90a4"},"headline":"SQL Server 2014 : SELECT ALL USERS SECURABLES & DB admins","datePublished":"2014-02-26T09:35:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/"},"wordCount":1261,"commentCount":0,"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014_20130625-144612_1.jpg","keywords":["Microsoft","Security","SQL Server 2014","SQL Server Audit"],"articleSection":["Database management"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/","url":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/","name":"SQL Server 2014 : SELECT ALL USERS SECURABLES & DB admins - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/#primaryimage"},"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014_20130625-144612_1.jpg","datePublished":"2014-02-26T09:35:00+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/bfab48333280d616e1170e7369df90a4"},"description":"Microsoft will introduce four new security permissions in SQL Server 2014. One of them called SELECT ALL USERS SECURABLES is the subject of this post.","breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/#primaryimage","url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014_20130625-144612_1.jpg","contentUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014_20130625-144612_1.jpg","width":245,"height":149},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-select-all-users-securables-a-db-admins\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"SQL Server 2014 : SELECT ALL USERS SECURABLES & DB admins"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/bfab48333280d616e1170e7369df90a4","name":"Microsoft Team","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/c44a1a792c059f24055763aa77d80a244467f6eef724a8bd13db8d4a350b7a4c?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/c44a1a792c059f24055763aa77d80a244467f6eef724a8bd13db8d4a350b7a4c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c44a1a792c059f24055763aa77d80a244467f6eef724a8bd13db8d4a350b7a4c?s=96&d=mm&r=g","caption":"Microsoft Team"},"url":"https:\/\/www.dbi-services.com\/blog\/author\/microsoft-team\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/3617","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/26"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=3617"}],"version-history":[{"count":0,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/3617\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media\/3189"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=3617"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=3617"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=3617"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=3617"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}