Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

This question already has an answer here:

I have an odd situation. An Active Directory group was recently created for the sole purpose of being a securable in SQL Server. I created a login based on the AD group, a user based on the login, and granted permissions to the user. All pretty standard stuff. When I impersonate one of the group members (using execute as login='domain\username'), I'm able to perform the granted action. However, when the user himself tries it, he gets "permission denied". I'm at a loss to explain the behavior and subsequently fix it.

share|improve this question

marked as duplicate by Jon Seigel, Mark Storey-Smith, Paul White, ypercube, dezso Jul 4 '13 at 7:59

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
Do other group members have the same problem or just that one? –  Kenneth Fisher Jul 4 '13 at 0:08

2 Answers 2

Is your service account an AD user? It would need to be to evaluate group memberships, for example. (If you're logged in as an AD user, SQL can evaluate those permissions.)

Microsoft recommends using a domain user for service accounts.
http://msdn.microsoft.com/en-us/library/ms143504.aspx

share|improve this answer

Depending on the Windows version and how the user is attempting to run their query, it may be UAC. I've successfully used this link to solve similar issues for multiple clients: http://www.sqldbops.com/2010/05/token-based-server-access-validation.html

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.