User has been denied select to table T1 in DB1, but user can create synonym in DB2 and can select from DB1.TB1. I can not deny create synonyms to user. Is it possible to prevent user to select after create synonyms for DB1.TB1?
use d2 create synonym dbo.cl for d1.dbo.cl select top 100 * from dbo.cl (100 rows affected) select top 100 * from d1.dbo.cl The SELECT permission was denied on the object 'cl', database 'd1', schema 'dbo'.
User has db_owner through AD group in d2