2

Following a request from the Security Team, do you think is there any issue if I revoke access to these tables?

Use Master
GO
REVOKE SELECT ON sys.database_principals TO PUBLIC;
REVOKE SELECT ON sys.database_principals TO GUEST;

The point of the question is not whether the request is reasonable, but whether it can be harmful in any way.

2 Answers 2

1

I have to comply unless there is some kind of negative impact on applications.

It would break any application relying on the documented behavior that "Any user can see their own user name, the system users, and the fixed database roles.".

3
  • Unless I grant them those rights directly with relay on defaults...
    – MBuschi
    Jan 22, 2023 at 17:51
  • 1
    Sure, but you would have to discover which applications and identities require the privileges. That's just what I would say in response to a useless security request. Jan 22, 2023 at 19:57
  • Does it even work? I thought you couldn't do this kind of thing on system tables? Asking for a friend... Jan 23, 2023 at 0:36
3

I'd say there's no point in that request. The Permissions section of the sys.database_principals states that each user can only see it's own info and those that are default on any SQL Server instance:

Permissions

Any user can see their own user name, the system users, and the fixed database roles. To see other users, requires ALTER ANY USER, or a permission on the user. To see user-defined roles, requires ALTER ANY ROLE, or membership in the role.

Therefore, if they're seeing info related to other users, it's likely they've been granted the ALTER ANY USER or ALTER ANY ROLE and that should be your target.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.