2

I am having some trouble creating a new SQL user in SQL Server 2008 R2. When I use SQL Server Management Studio it checks db_owner role membership by default. I just want to create a new sql user with read only access. Even with the following raw SQL it still creates the user with db_owner level permission.

<!-- language: lang-sql -->
CREATE LOGIN readonlyuser
WITH PASSWORD = '12345',CHECK_POLICY = OFF, DEFAULT_DATABASE=mydatabase
GO
USE mydatabase
GO
CREATE USER readonlyuser FOR LOGIN readonlyuser
GO
EXEC sp_addrolemember 'db_datareader', 'readonlyuser'

Now if I log on to SQL Server Management Studio with newly created user I can basically access any table and modify any data any way that I want. This is exactly what I not want to do. I want only to be read data and not to modify any data

Strange thing is if I look at the roles for database the readonlyuser is inside db_datareader and not in db_owner.

So why is SQL creating this user with db_owner level permissions, thus allowing the user to modify data?

Update 2013/08/07

This seems to be happening with just one specific database. I created brand new database and created bunch of tables and then ran the same script above and it is working perfectly fine. But if i try with the actual database where i need this change, it doesn't work like that. It created the user and gave way too much permission.

Is there anything that i can check on that database? Please note that specific database was not designed by me. It is from a 3rd party vendor. So not sure exactly what modifications they might have done.

Any help is greatly appreciated.

4

4 回答 4

2

我遇到了同样的问题。

解决方案：sp_changedbowner。那解决了它。（不知何故，所有者被破坏了）

于 2013-11-05T12:47:04.360 回答
0

我在查询中没有看到任何问题。当我测试它时，它按预期工作。只是为了确认，验证用户是否正确映射到所需的数据库（mydatabase）并且从用户属性窗口中选择了 db_datareader。

于 2013-08-06T22:58:24.850 回答
0

我发现在将登录名添加到我恢复到新服务器的数据库时会发生这种情况。在数据库属性的“文件”选项卡中，所有者字段为空白，即使它在“常规”选项卡中列出了用户。如果我用有效的登录名填充所有者字段，那么问题就解决了：默认情况下，新登录名没有检查“db_owner”。

于 2014-08-13T23:43:35.340 回答
0

为了扩展 Greg 的评论，当恢复的数据库在源服务器上由当前（目标）服务器上不存在的登录名拥有时，可能会发生这种情况。常规选项卡上的信息是原始所有者（在源服务器上），无法反映在文件选项卡上，因为当前服务器上缺少该登录。从某种意义上说，这是一个“孤立的数据库”。

于 2018-11-20T12:50:42.530 回答