{"id":3846,"date":"2014-07-03T02:09:00","date_gmt":"2014-07-03T00:09:00","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/"},"modified":"2014-07-03T02:09:00","modified_gmt":"2014-07-03T00:09:00","slug":"sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/","title":{"rendered":"SQL Server 2014: Are DENY &#8216;SELECT ALL USERS SECURABLES&#8217; permissions sufficient for DBAs?"},"content":{"rendered":"<p><img decoding=\"async\" class=\"blog-image aligncenter\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014.jpg\" alt=\"\" \/><\/p>\n<p>SQL Server 2014 improves the segregation of duties by implementing new server permissions. The most important is the SELECT ALL USERS SECURABLES permission that will help to restrict database administrators from viewing data in all databases.<\/p>\n<p>My article is a complement to David Barbarin&#8217;s article <a href=\"\/sql-server-2014-select-all-users-securables-a-db-admins\">&#8216;SQL Server 2014: SELECT ALL USERS SECURABLES &amp; DB admins&#8217;<\/a>.<\/p>\n<p>I have tested some cases to be sure that I can do my DBA&#8217;s job as well.<br \/>\nAs a reminder, msdb database is used by the SQL agent for alerts and jobs. It also contains the backup history, SSIS packages like Maintenance Plans, and more useful information.<br \/>\nIn conclusion, we can see that this database is very important for daily jobs of DBAs.<br \/>\nTo begin, let\u2019s configure a restricted dba user.<\/p>\n<h3>Step 1: Create a role with CONTROL SERVER permission<\/h3>\n<p>&nbsp;<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">USE [master]\nGO\nCREATE SERVER ROLE [restrictedadmin] AUTHORIZATION [DBIDBA_GROUP]\nGO\nGRANT CONTROL SERVER TO [restrictedadmin]DENY SELECT ALL USER SECURABLES TO [restrictedadmin]\nGO<\/pre>\n<h3>Step 2: Add the DBA group with the restricted administration to the server<\/h3>\n<p>&nbsp;<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">CREATE LOGIN [DBIRestricted_DBA_GROUP] FROM WINDOWS WITH DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english]\nGO<\/pre>\n<h3>Step 3: Add the restricted DBA group to the server role [restrictedadmin]<\/h3>\n<p>&nbsp;<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">ALTER SERVER ROLE [restrictedadmin] ADD MEMBER [DBIRestricted_DBA_GROUP]\nGO<\/pre>\n<p>Now, I have a Restricted_DBA_GROUP group featuring the CONTROL SERVER permission only and without the right to view data in all databases by using the new server permission DENY SELECT ALL USER SECURABLES.<\/p>\n<h3>Check msdb views<\/h3>\n<p>The first step consists of accessing some basic msdb tables like backupset or sysalerts.<\/p>\n<p>I just begin with a simple query: select * from msdb.dbo.backupset &#8230;.<\/p>\n<p><a class=\"easyblog-thumb-preview\" title=\"msdb1.png\" href=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/msdb1.png\"><img decoding=\"async\" title=\"msdb1.png\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/msdb1.png\" alt=\"msdb1.png\" \/><\/a><\/p>\n<p>The Select is denied&#8230; OK, maybe it just concerns this table!<br \/>\nThen I test it with other useful msdb tables like sysalerts, sysjobhistory, sysoperators, sysschedules, and sysssispackages.<\/p>\n<p><a class=\"easyblog-thumb-preview\" title=\"msdb2.png\" href=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/msdb2.png\"><img decoding=\"async\" title=\"msdb2.png\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/msdb2.png\" alt=\"msdb2.png\" \/><\/a><\/p>\n<p>The Select is denied for all views. Oops!<br \/>\nDo I experience the same with others system views in msdb?<\/p>\n<p><a class=\"easyblog-thumb-preview\" title=\"msdb3.png\" href=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/msdb3.png\"><img decoding=\"async\" title=\"msdb3.png\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/msdb3.png\" alt=\"msdb3.png\" \/><\/a><\/p>\n<p>No, I don&#8217;t and if I run the same on the user database, the queries run successfully.<\/p>\n<h3>The main question is why?<\/h3>\n<p>In my test, I was able to show that I can access the sys and INFORMATION_SCHEMA schemas which are reserved for system objects and metadata.<\/p>\n<p><a class=\"easyblog-thumb-preview\" title=\"msdb4.png\" href=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/msdb4.png\"><img decoding=\"async\" title=\"msdb4.png\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/msdb4.png\" alt=\"msdb4.png\" \/><\/a><\/p>\n<p>But I haven&#8217;t permissions to access the dbo schema in msdb. At this point, I can understand that dbo permissions are denied to classic database users, but as a DBA, I need to access the msdb database.<br \/>\nNow, I will grantmy user [Restricted_DBA_GROUP] the SELECT permission on msdb tables. It&#8217;s a good idea, isn&#8217;t it?<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">USE [msdb]\nGRANT SELECT ON SCHEMA::dbo TO [Restricted_DBA_GROUP]<\/pre>\n<p>&nbsp;<\/p>\n<p><a class=\"easyblog-thumb-preview\" title=\"msdb5.png\" href=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/msdb5.png\"><img decoding=\"async\" title=\"msdb5.png\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/msdb5.png\" alt=\"msdb5.png\" \/><\/a><\/p>\n<p>I repeated my test with all views and the result was the same. The select permission is still denied&#8230;<br \/>\nWe notice that the deny permission overrules the grant permission.<br \/>\nIt is rather reassuring \ud83d\ude44<\/p>\n<h3>Conclusion<\/h3>\n<p>Be careful when you restrict permissions for a database administrator.<br \/>\nI have seen a lot of articles or demos saying that Deny the &#8216;SELECT ALL USER SECURABLES&#8217; is the solution to deny viewing data in all databases.<br \/>\nIt&#8217;s not false, but for a real database administrator who needs to use msdb objects, it does not realy apply.<br \/>\nFor either an auditor (security auditor) or a dba junior or a trainee, it&#8217;s a good way to limit the data access.<br \/>\nUse this blog to convince your customer if you are a &#8220;good&#8221; DBA consultant like me&#8230;:-D<\/p>\n","protected":false},"excerpt":{"rendered":"<p>SQL Server 2014 improves the segregation of duties by implementing new server permissions. The most important is the SELECT ALL USERS SECURABLES permission that will help to restrict database administrators from viewing data in all databases. My article is a complement to David Barbarin&#8217;s article &#8216;SQL Server 2014: SELECT ALL USERS SECURABLES &amp; DB admins&#8217;. [&hellip;]<\/p>\n","protected":false},"author":15,"featured_media":3590,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[198],"tags":[49,25,51,52],"type_dbi":[],"class_list":["post-3846","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-database-management","tag-microsoft","tag-security","tag-sql-server","tag-sql-server-2014"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.2 (Yoast SEO v27.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>SQL Server 2014: Are DENY &#039;SELECT ALL USERS SECURABLES&#039; permissions sufficient for DBAs? - dbi Blog<\/title>\n<meta name=\"description\" content=\"SQL Server 2014 facilitates the segregation of duties by implementing new server permissions. The most important is the permission called SELECT ALL USERS SECURABLES to restrict database administrators to view data in all databases.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"SQL Server 2014: Are DENY &#039;SELECT ALL USERS SECURABLES&#039; permissions sufficient for DBAs?\" \/>\n<meta property=\"og:description\" content=\"SQL Server 2014 facilitates the segregation of duties by implementing new server permissions. The most important is the permission called SELECT ALL USERS SECURABLES to restrict database administrators to view data in all databases.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2014-07-03T00:09:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"245\" \/>\n\t<meta property=\"og:image:height\" content=\"149\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"St\u00e9phane Haby\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"St\u00e9phane Haby\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\\\/\"},\"author\":{\"name\":\"St\u00e9phane Haby\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/d0bfb7484ae81c8980fc2b11334f803b\"},\"headline\":\"SQL Server 2014: Are DENY &#8216;SELECT ALL USERS SECURABLES&#8217; permissions sufficient for DBAs?\",\"datePublished\":\"2014-07-03T00:09:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\\\/\"},\"wordCount\":526,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2022\\\/04\\\/2e1ax_default_entry_sqlserver2014.jpg\",\"keywords\":[\"Microsoft\",\"Security\",\"SQL Server\",\"SQL Server 2014\"],\"articleSection\":[\"Database management\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\\\/\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\\\/\",\"name\":\"SQL Server 2014: Are DENY 'SELECT ALL USERS SECURABLES' permissions sufficient for DBAs? - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2022\\\/04\\\/2e1ax_default_entry_sqlserver2014.jpg\",\"datePublished\":\"2014-07-03T00:09:00+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/d0bfb7484ae81c8980fc2b11334f803b\"},\"description\":\"SQL Server 2014 facilitates the segregation of duties by implementing new server permissions. The most important is the permission called SELECT ALL USERS SECURABLES to restrict database administrators to view data in all databases.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2022\\\/04\\\/2e1ax_default_entry_sqlserver2014.jpg\",\"contentUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2022\\\/04\\\/2e1ax_default_entry_sqlserver2014.jpg\",\"width\":245,\"height\":149},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"SQL Server 2014: Are DENY &#8216;SELECT ALL USERS SECURABLES&#8217; permissions sufficient for DBAs?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/d0bfb7484ae81c8980fc2b11334f803b\",\"name\":\"St\u00e9phane Haby\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1123227ca39a5dca608c0f72d23cd1904fee29979749bbb3a485b9438436c553?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1123227ca39a5dca608c0f72d23cd1904fee29979749bbb3a485b9438436c553?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1123227ca39a5dca608c0f72d23cd1904fee29979749bbb3a485b9438436c553?s=96&d=mm&r=g\",\"caption\":\"St\u00e9phane Haby\"},\"description\":\"St\u00e9phane Haby has more than ten years of experience in Microsoft solutions. He is specialized in SQL Server technologies such as installation, migration, best practices, and performance analysis etc. He is also an expert in Microsoft Business Intelligence solutions such as SharePoint, SQL Server and Office. Futhermore, he has many years of .NET development experience in the banking sector and other industries. In France, he was one of the first people to have worked with Microsoft Team System. He has written several technical articles on this subject. St\u00e9phane Haby is Microsoft Most Valuable Professional (MVP) as well as Microsoft Certified Solutions Associate (MCSA) and\u00a0Microsoft Certified Solutions Expert (MCSE) for SQL Server 2012. He is also Microsoft Certified Technology Specialist (MCTS) and Microsoft Certified IT Professional (MCITP) for SQL Server 2008 as well as ITIL Foundation V3 certified. He holds a Engineer diploma in industrial computing and automation from France. His branch-related experience covers Chemicals &amp; Pharmaceuticals, Banking \\\/ Financial Services, and many other industries.\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/author\\\/stephane-haby\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"SQL Server 2014: Are DENY 'SELECT ALL USERS SECURABLES' permissions sufficient for DBAs? - dbi Blog","description":"SQL Server 2014 facilitates the segregation of duties by implementing new server permissions. The most important is the permission called SELECT ALL USERS SECURABLES to restrict database administrators to view data in all databases.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/","og_locale":"en_US","og_type":"article","og_title":"SQL Server 2014: Are DENY 'SELECT ALL USERS SECURABLES' permissions sufficient for DBAs?","og_description":"SQL Server 2014 facilitates the segregation of duties by implementing new server permissions. The most important is the permission called SELECT ALL USERS SECURABLES to restrict database administrators to view data in all databases.","og_url":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/","og_site_name":"dbi Blog","article_published_time":"2014-07-03T00:09:00+00:00","og_image":[{"width":245,"height":149,"url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014.jpg","type":"image\/jpeg"}],"author":"St\u00e9phane Haby","twitter_card":"summary_large_image","twitter_misc":{"Written by":"St\u00e9phane Haby","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/"},"author":{"name":"St\u00e9phane Haby","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/d0bfb7484ae81c8980fc2b11334f803b"},"headline":"SQL Server 2014: Are DENY &#8216;SELECT ALL USERS SECURABLES&#8217; permissions sufficient for DBAs?","datePublished":"2014-07-03T00:09:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/"},"wordCount":526,"commentCount":0,"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014.jpg","keywords":["Microsoft","Security","SQL Server","SQL Server 2014"],"articleSection":["Database management"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/","url":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/","name":"SQL Server 2014: Are DENY 'SELECT ALL USERS SECURABLES' permissions sufficient for DBAs? - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/#primaryimage"},"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014.jpg","datePublished":"2014-07-03T00:09:00+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/d0bfb7484ae81c8980fc2b11334f803b"},"description":"SQL Server 2014 facilitates the segregation of duties by implementing new server permissions. The most important is the permission called SELECT ALL USERS SECURABLES to restrict database administrators to view data in all databases.","breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/#primaryimage","url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014.jpg","contentUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_sqlserver2014.jpg","width":245,"height":149},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/sql-server-2014-are-deny-select-all-users-securables-permissions-sufficient-for-dbas\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"SQL Server 2014: Are DENY &#8216;SELECT ALL USERS SECURABLES&#8217; permissions sufficient for DBAs?"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/d0bfb7484ae81c8980fc2b11334f803b","name":"St\u00e9phane Haby","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/1123227ca39a5dca608c0f72d23cd1904fee29979749bbb3a485b9438436c553?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/1123227ca39a5dca608c0f72d23cd1904fee29979749bbb3a485b9438436c553?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1123227ca39a5dca608c0f72d23cd1904fee29979749bbb3a485b9438436c553?s=96&d=mm&r=g","caption":"St\u00e9phane Haby"},"description":"St\u00e9phane Haby has more than ten years of experience in Microsoft solutions. He is specialized in SQL Server technologies such as installation, migration, best practices, and performance analysis etc. He is also an expert in Microsoft Business Intelligence solutions such as SharePoint, SQL Server and Office. Futhermore, he has many years of .NET development experience in the banking sector and other industries. In France, he was one of the first people to have worked with Microsoft Team System. He has written several technical articles on this subject. St\u00e9phane Haby is Microsoft Most Valuable Professional (MVP) as well as Microsoft Certified Solutions Associate (MCSA) and\u00a0Microsoft Certified Solutions Expert (MCSE) for SQL Server 2012. He is also Microsoft Certified Technology Specialist (MCTS) and Microsoft Certified IT Professional (MCITP) for SQL Server 2008 as well as ITIL Foundation V3 certified. He holds a Engineer diploma in industrial computing and automation from France. His branch-related experience covers Chemicals &amp; Pharmaceuticals, Banking \/ Financial Services, and many other industries.","url":"https:\/\/www.dbi-services.com\/blog\/author\/stephane-haby\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/3846","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=3846"}],"version-history":[{"count":0,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/3846\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media\/3590"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=3846"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=3846"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=3846"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=3846"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}