And I think I'm almost there conceptually. I think I just need a few example/confirmations to bring it home.

1) My understanding is that server permissions (http://msdn.microsoft.com/en-us/library/ms186260.aspx) allow a login to gain access to the database server, but they can't perform any actions on the database (such as updating or deleting a table) unless they have database permissions (http://msdn.microsoft.com/en-us/library/ms188367.aspx). Correct?

2) So for example, if a windows group has CONNECT SQL server permissions, the users that are part of that group can only connect to the database and can not perform any database actions (such as updating or deleting a table) unless further specified in the database permissions. Correct?

3) If someone had database permissions and not server permissions, then that would be useless, right? Since they couldn't connect (or login).

  1. Unless you make them a sysadmin (or grant them other system-wide privileges), pretty much. It depends on what permissions you've granted to public on the database itself.
  2. Assuming that the group and/or group members do not have other permissions on the database, pretty much.
  3. Pretty much, yeah.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.