I could fix this issue with the following steps:
- Create login
- Create DBO user and assign it to a specific database
- ADD this user to the MASTER database ( create user x for login x)
DENY SELECT On SCHEMA::sys To x DENY SELECT On SCHEMA::INFORMATION_SCHEMA To x
But since there's a lot of logins in the server, I don't want to add ALL of them in the master database to deny this permission. For now, ALL users have DBO role, because both dev and the user uses the same login (yeah..I know...I really know ). It would be hard to track future issues.
Is there a better way to do this? (To deny select on sys tables and information_schema).
And one more question. WHY ReadOnly has access to sys tables (sys.databases for example )?