The guest user is disabled on our user databases but data security guys want us to disable it on system databases as well. Should I do it?


No you shouldn't disable the guest account on the system databases. You also shouldn't disable it on the user databases. This will stop anyone from using SQL Server Management Studio to connect to the instance. As long as you haven't granted any permissions in the user databases to public, and you haven't changed any of the default permissions in the databases, then the guest role poses no security risk.

Also your security team should stop making recommendations about how to secure SQL Server until they've learned how SQL Server and it's tools work.

  • Regarding user databases, the guest user is disabled (no CONNECT permission) by default in user databases. It should be enabled in user databases only when needed. – Dan Guzman Oct 21 '16 at 10:39

No, don't disable the guest account within the system databases.

See https://blogs.msdn.microsoft.com/batuhanyildiz/2013/03/02/guest-user-account-in-sql-server/

and the quote:

The recommendation is not valid for master, msdb and tempdb system databases. If Guest user is disabled in msdb system database, it may cause some issues.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.