Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

RDBMS: SQL Server 2005

I am connecting to SQL Server through Windows Authentication. My account(domain\me) belong to a group, "domain\alert"

The problem is that, even after denying a select permission on a table(actually all permissions), I could still access that table on a new connection.

deny select on dbo.perm to [domain\me]

And one thing to note is that, the group i belong to, "domain\alert" is a dbo of database the table is located.

As far as I know, deny permission takes precedence over grant.

What permission can still be granting me a permission to select the perm table?

share|improve this question
up vote 2 down vote accepted

From Books Online's Permissions Hierarchy: SQL Server 2005 Permissions Hierarchy
It looks like the Fixed database role takes precedence over the permissions given to a Windows Domain Login. I also was under the impression that a DENY would always take precedence over a GRANT, but I guess Fixed database role dbo trumps all.

share|improve this answer
Thanks, Nathan. I don't think I can argue with what the official doc reads ;) It looks like it's just how it works. – Sung Aug 28 '09 at 17:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.