Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

What is best practice for sql server security? Using AD groups that are given rights on schema objects or should I add the AD groups to a database role which is given rights on schema objects ? If the later one is best practice, what is really the benefit of using database roles ?

share|improve this question

1 Answer 1

up vote 7 down vote accepted

Generally speaking, adding AD groups to database roles and granting the permissions to the roles gives you some separation of purpose. In that case you would use them as:

  1. AD Group = a set of logins that share the same database access needs.
  2. Role = a set of permissions that define a set of rights to be shared by logins.

The advantage is that the role can have more that one AD group added to it. Likewise, if the AD Group is removed, the permission sets remain in place. That way the original AD Group, a new AD Group or groups, could be added without needing to redefine the rights.

And, of course, more than one AD Group can use a role and an AD Group could use several roles. It all depends on how you want to use and reuse permissions.

If the rights are granted directly to an AD Group, then dropping the group also drops the rights that the group had. Which would mean recreating those rights if you need them elsewhere.

share|improve this answer
    
Thanks for the explaination, we normally create access specific AD groups e.g. read group, change group etc. but I can see now the nuances the role approach would give me. –  nojetlag Oct 22 '13 at 11:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.