Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question points out that "View Server State" permission is required for various DMV's (dynamic management views), but I can't find anything about who you do and do not want to grant the permission to.

Now of course I understand "least permissions", and why you wouldn't want to just grant it to anybody, but I can't find any guideance on how to evaluate whether it SHOULD be granted or not.

So, my question: What are the security and performance implications of granting a user "View Server State" permission. What can they do that they maybe shouldn't be allowed to do...

Update: one implication is that the user will be able to use DMV's to look at queries. If the queries or query parameters can contain confidential information that the user wouldn't otherwise be able to see, allowing VIEW SERVER STATE would allow them to do so (i.e. dob = or ssn =).

share|improve this question

migrated from Oct 23 '12 at 20:03

This question came from our site for professional and enthusiast programmers.

up vote 5 down vote accepted

There are no significant performance issues that I can think of from granting this permission. From a security perspective, you run the risk of letting a user see what you most details about your weakspots, so for example, a malicious user could view your most common wait stats are, which could help them target a DoS attack against your server.

Is this possible? Defiantly. Is this likely? I'm compelled to say No, but remember that it is estimated that 90 percent of attacks against companies are from internal attackers.

share|improve this answer
@PeterCarter: +1 for the DoS and common wait states. I was hoping for something a bit more encompassing, but at least it's a solid potential risk. – jmoreno Oct 26 '12 at 6:34
@PeterCarter: thanks for answering. – jmoreno Nov 23 '12 at 16:12

It's a security problem. You can never go wrong if you follow the Principle of Least Privileged. In other words, if an authenticating principal doesn't need a particular permission, then don't give it to them. Do you give out information regarding the type of locks on your door to other people that don't need to know that about your house? I would hope not. They probably wouldn't do anything, but it's still not prudent.

If we based data principles off of luck and generosity, we'd be in bigger trouble quite a bit more often. Security is an aspect where you should only grant when you can defend why you granted. You're simply giving somebody more information than they need to know. Don't do it. Server state is still sensitive.

share|improve this answer
I understand Least Privileges, I in fact referenced it in my question -- I am looking for how to evaluate need vs risk. If 50% of the views cause the server to grind to a halt or it allows the user to view confidential information, then the need would have to be significant. – jmoreno Oct 23 '12 at 21:28
Why would you want to give it away needlessly to begin with? What are you gaining out of that?? – Thomas Stringer Oct 23 '12 at 21:29
Who says they are giving it away needlessly? The OP might need to grant it to someone to investigate a specific issue (e.g. to look at sys.dm_db_missing_index_details) and they want to know what exactly the risks are of doing so. – Martin Smith Oct 23 '12 at 21:34
I guess I'm missing the mark with this question, I don't see anything in the question that indicates the necessity for the permission. – Thomas Stringer Oct 23 '12 at 21:48
@ThomasStringer: the question isn't about necessity, it's about risk. To put it in monetary terms, you may know what additional risks this would expose your servers to, and so be able to say no to a penny, and yes to a million dollars. I don't, but I want to. – jmoreno Oct 24 '12 at 1:55

As an administrator you would view this information as being in your domain (performance / index usage / etc) but there are potentially compelling reasons that a development organization would want this information for a large legacy system they support- identifying zombie tables that are only touched by maintenance processes for example.

In the end it always ends up being an issue of "luck and generosity" since the call on whether any particular request is justified ends up being a soft choice and not a crisp formula. The use of best practice patterns without looking at context is itself a pretty nasty anti-pattern and reality is that many approach their positions with "talk to the hand" as a starting point.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.