And I think I'm almost there conceptually. I think I just need a few example/confirmations to bring it home.
1) My understanding is that server permissions (http://msdn.microsoft.com/en-us/library/ms186260.aspx) allow a login to gain access to the database server, but they can't perform any actions on the database (such as updating or deleting a table) unless they have database permissions (http://msdn.microsoft.com/en-us/library/ms188367.aspx). Correct?
2) So for example, if a windows group has CONNECT SQL server permissions, the users that are part of that group can only connect to the database and can not perform any database actions (such as updating or deleting a table) unless further specified in the database permissions. Correct?
3) If someone had database permissions and not server permissions, then that would be useless, right? Since they couldn't connect (or login).