I created a new database on a SQL Server 2008 R2 instance and a login/user for it. I have set the user to db_owner so he can't view any other databases on that server but he can see and query the master

database. Is there a way to hide/deny permissions for the master database? Are there any possible vulnerabilities if I leave him to query the master database or is there a way to deny him access to the master database?

  • 4
    What are you trying to hide from them specifically? Sometimes some access to master is important, e.g. if the user will need to execute certain stored procedures, or query from utility tables that are proliferated in code all over the web (e.g. master.dbo.spt_values). – Aaron Bertrand Feb 14 '14 at 14:30
  • There will be no need for that. All stored procedures (if any) will be custom regarding that database only. I tried to query the master in some ways and for now I didn't find any information about the other databases that are hidden from that user – AArmin Feb 14 '14 at 15:09
  • 1
    @AArmin The views and tables in master have select permission granted to public. When a user is not explicitly granted or denied permissions, then the effective permission is inherited from public. I agree with Aaron's point - what exactly you want to hide from the users ? You can explicitly deny permissions to users using dynamic SQL. – Kin Shah Aug 5 '14 at 15:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.