Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

What is the best method to grant read access to all current and future databases to a user (AD Group in this case)?

Currently I have a flaky scheduled job that does this using (going to start debugging the following, but maybe I am doing it wrong anyways):

sp_msforeachdb '
USE [?]
CREATE USER [MY_DOMAIN\SQL-READ-ALL] FOR LOGIN [MY_DOMAIN\SQL-READ-ALL]
USE [?]
EXEC sp_addrolemember N''db_datareader'', N''MY_DOMAIN\SQL-READ-ALL''
'

Perhaps there is a better way?

share|improve this question
add comment

2 Answers

up vote 8 down vote accepted

For future databases, do this because all DBs are created from model

USE model
EXEC sp_addrolemember N'db_datareader', N'MY_DOMAIN\SQL-READ-ALL'

For existing databases, just run what you have above, once

share|improve this answer
    
My fault for leaving out a constraint, in general the "future" databases are actually restores. Restored DBs wouldn't inherit that form master correct? –  Kyle Brandt Nov 9 '11 at 20:10
3  
@Kyle Brandt: correct, they won't. Unless your restores comes from a box that has this already in the same domain –  gbn Nov 9 '11 at 20:11
5  
Maybe adding something to the restore script will be the most sensible thing for this scenario... –  Kyle Brandt Nov 9 '11 at 20:12
add comment

About the restore: you can set up an Event Notification for the AUDIT_BACKUP_RESTORE event. Not for the faint of hearth, since programming asynchronous event notifications is not exactly easy, but it can do the job you're asking. See Implementing Event Notifications.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.