1

I have a user that has his Active Directory logon set to allow logging into a specific SQL Server, and that works fine. This user is also part of an AD Group that has access to a specific database on this server. However, this membership doesn't grant him access to that specific database. I have to give his AD logon access to the database separately.

Question: Is there a conflict when granting SQL Server access via a user's AD login, and also adding permissions to a specific database on the SQL Server by the user's membership in a specific AD group?

If there is anyway to set this up to work let me know.

Improve this question
2
  • This should just work. You will need to narrow the problem significantly before we can help. You can use the search function of the site to look for similar questions or ways to troubleshoot it on your end until you can give enough details. Oh and welcome!
    – Tom V
    Dec 13, 2018 at 15:55
  • Was the user recently added to the AD group? Explicitly adding AD users in SQL gives them access straight away, but I have seen a number of occasions where users are added to AD groups and their access doesn't work until they log out and back in and refresh their security information.
    – HandyD
    Dec 13, 2018 at 22:37

1 Answer 1

Reset to default
0

You will have no problem doing what you have described. SQL Server security is designed intentionally to allow you to grant different permissions to a group and to a person in that group, and keep the two separated. They did this to address exactly the scenario that you are describing.

The only way that you would have a conflict is if you explicitly deny a permission. Then the deny would override any grant.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.