Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the best method to grant read access to all current and future databases to a user (AD Group in this case)?

Currently I have a flaky scheduled job that does this using (going to start debugging the following, but maybe I am doing it wrong anyways):

sp_msforeachdb '
USE [?]
USE [?]
EXEC sp_addrolemember N''db_datareader'', N''MY_DOMAIN\SQL-READ-ALL''

Perhaps there is a better way?

share|improve this question
up vote 8 down vote accepted

For future databases, do this because all DBs are created from model

USE model
EXEC sp_addrolemember N'db_datareader', N'MY_DOMAIN\SQL-READ-ALL'

For existing databases, just run what you have above, once

share|improve this answer
My fault for leaving out a constraint, in general the "future" databases are actually restores. Restored DBs wouldn't inherit that form master correct? – Kyle Brandt Nov 9 '11 at 20:10
@Kyle Brandt: correct, they won't. Unless your restores comes from a box that has this already in the same domain – gbn Nov 9 '11 at 20:11
Maybe adding something to the restore script will be the most sensible thing for this scenario... – Kyle Brandt Nov 9 '11 at 20:12

About the restore: you can set up an Event Notification for the AUDIT_BACKUP_RESTORE event. Not for the faint of hearth, since programming asynchronous event notifications is not exactly easy, but it can do the job you're asking. See Implementing Event Notifications.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.