Skip to main content
Improved as per own test case
Source Link
Shekar Kola
  • 2.4k
  • 2
  • 10
  • 24

As long as the Login member of sysadmin, NO DENY can stop sysadmin members, similarly database level DENY cannot stop user while user part of db_owner. So, DENY BACKUP wouldn't hep unless login removed from sysadmin server role.following applied:

  1. login removed from sysadmin server role
  2. Maintain one db_owner per database.

As long as the Login member of sysadmin, NO DENY can stop sysadmin members, similarly database level DENY cannot stop user while user part of db_owner. So, DENY BACKUP wouldn't hep unless login removed from sysadmin server role.

As long as the Login member of sysadmin, NO DENY can stop sysadmin members. So, DENY BACKUP wouldn't hep unless following applied:

  1. login removed from sysadmin server role
  2. Maintain one db_owner per database.
Improved as per own test case
Source Link
Shekar Kola
  • 2.4k
  • 2
  • 10
  • 24

Test Case (based on comments)

CREATE LOGIN TEST_USER WITH PASSWORD = 'test', CHECK_POLICY=OFF;

USE TestDB;
CREATE USER TEST_USER FOR LOGIN TEST_USER;
ALTER ROLE DB_OWNER ADD MEMBER TEST_USER;

CREATE ROLE DENY_BACKUP;
DENY BACKUP DATABASE TO DENY_BACKUP;
ALTER ROLE DENY_BACKUP ADD MEMBER TEST_USER;  -- Implicit DENY

DENY BACKUP DATABASE TO TEST_USER; -- Explicit DENY
GO

-- Implicit/Explicit BACKUP permissions Verification 
select dp.name, p.* 
from sys.database_permissions as p
        join sys.database_principals as dp on p.grantee_principal_id = dp.principal_id
where p.type = 'BADB'
go
----------------------------------------------------------------------------------------
-- Above commands must be run by SYSADMIN, below must be from TEST_USER
----------------------------------------------------------------------------------------
Use TestDB;
Backup Database TestDB to disk = 'null';  -- as expected it fails due to DENY permissions
go

sp_helpuser 'test_user'; -- Yes, "TEST_USER" is DB_OWNER

REVOKE BACKUP DATABASE TO DENY_BACKUP; -- Implicit DENY can be revoked by same user while the user is DB_OWNER
ALTER ROLE DENY_BACKUP DROP MEMBER TEST_USER; -- Implicit DENY can be revoked by same user while the user is DB_OWNER
REVOKE BACKUP DATABASE TO Test_User -- Explicit DENY cannot be revoked by same user though user is DB_OWNER. It says, "you cannot revoke permissions yourself"
go


Test Case (based on comments)

CREATE LOGIN TEST_USER WITH PASSWORD = 'test', CHECK_POLICY=OFF;

USE TestDB;
CREATE USER TEST_USER FOR LOGIN TEST_USER;
ALTER ROLE DB_OWNER ADD MEMBER TEST_USER;

CREATE ROLE DENY_BACKUP;
DENY BACKUP DATABASE TO DENY_BACKUP;
ALTER ROLE DENY_BACKUP ADD MEMBER TEST_USER;  -- Implicit DENY

DENY BACKUP DATABASE TO TEST_USER; -- Explicit DENY
GO

-- Implicit/Explicit BACKUP permissions Verification 
select dp.name, p.* 
from sys.database_permissions as p
        join sys.database_principals as dp on p.grantee_principal_id = dp.principal_id
where p.type = 'BADB'
go
----------------------------------------------------------------------------------------
-- Above commands must be run by SYSADMIN, below must be from TEST_USER
----------------------------------------------------------------------------------------
Use TestDB;
Backup Database TestDB to disk = 'null';  -- as expected it fails due to DENY permissions
go

sp_helpuser 'test_user'; -- Yes, "TEST_USER" is DB_OWNER

REVOKE BACKUP DATABASE TO DENY_BACKUP; -- Implicit DENY can be revoked by same user while the user is DB_OWNER
ALTER ROLE DENY_BACKUP DROP MEMBER TEST_USER; -- Implicit DENY can be revoked by same user while the user is DB_OWNER
REVOKE BACKUP DATABASE TO Test_User -- Explicit DENY cannot be revoked by same user though user is DB_OWNER. It says, "you cannot revoke permissions yourself"
go

Improved as per own test case
Source Link
Shekar Kola
  • 2.4k
  • 2
  • 10
  • 24

Aside from that, consider db_owner (if other exists in same DB) can REVOKE their DENY DENY, Creating an alert (using message:18264) would be workaround solution.

Aside from that, consider db_owner can REVOKE their DENY, Creating an alert (using message:18264) would be workaround solution.

Aside from that, consider db_owner (if other exists in same DB) can REVOKE DENY, Creating an alert (using message:18264) would be workaround solution.

Improved answer based on comments
Source Link
Shekar Kola
  • 2.4k
  • 2
  • 10
  • 24
Loading
op question point correction and improved answer
Source Link
Shekar Kola
  • 2.4k
  • 2
  • 10
  • 24
Loading
Source Link
Shekar Kola
  • 2.4k
  • 2
  • 10
  • 24
Loading