Deployment of MSDE

Is there a way to turn off System Administrators in Server Roles for the
Builtin\Administrators using the deployment toolkit?
No
"Jon" <Jon@.discussions.microsoft.com> wrote in message
news:1364DDFA-764B-4C65-AC14-BBBFEB979DD2@.microsoft.com...
> Is there a way to turn off System Administrators in Server Roles for the
> Builtin\Administrators using the deployment toolkit?
|||Hi Jon,
I install MSDE with my C# app via the deployment toolkit.
As soon as my C# app starts, I run the command against the DB
EXEC sp_denylogin [BUILTIN\\Administrators]
This removes the admins from the built in group
HTH
Paul
"Jon" <Jon@.discussions.microsoft.com> wrote in message
news:1364DDFA-764B-4C65-AC14-BBBFEB979DD2@.microsoft.com...
> Is there a way to turn off System Administrators in Server Roles for the
> Builtin\Administrators using the deployment toolkit?
|||hi Paul,
Paul Aspinall wrote:
> Hi Jon,
> I install MSDE with my C# app via the deployment toolkit.
> As soon as my C# app starts, I run the command against the DB
> EXEC sp_denylogin [BUILTIN\\Administrators]
> This removes the admins from the built in group
>
and the SQL Server Agent can run without problems?
(http://support.microsoft.com/default.aspx?kbid=237604)
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.10.0 - DbaMgr ver 0.56.0
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply
sql

Deployment

Hello,
What is the best way to deploy a Reporting Services solution. The solution
consists of database scripts, reports, CRI dll's and roles.
Thanks
HenrikHello Henrik,
I am not sure what does your solution include.
Based on my research and experience, you need to deploy those data
seperately.
For example, you need to run all the database scripts on the production
environment and then, you could use the VS 2005 IDE to deploy the report.
I am not sure what did you mean CRI dll and roles. Would you please specify
it more clearly?
Sincerely,
Wei Lu
Microsoft Online Community Support
==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.
Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================(This posting is provided "AS IS", with no warranties, and confers no
rights.)|||Hello Wei Lu,
We have a solution that contains the following elements:
1) SQL Scripts, which create views, tables, ect.
2) Custom Report Items (CRI) which is contained in a DLL
3) Reports (RDL files)
4) Reporting Services User Roles
5) Datasources
6) Setup of policies (permissions) on each report
We have to package the solution and deploy it to multiple customers.
Best regards
Henrik.
"Wei Lu [MSFT]" <weilu@.online.microsoft.com> wrote in message
news:OnGVeBD7GHA.2336@.TK2MSFTNGXA01.phx.gbl...
> Hello Henrik,
> I am not sure what does your solution include.
> Based on my research and experience, you need to deploy those data
> seperately.
> For example, you need to run all the database scripts on the production
> environment and then, you could use the VS 2005 IDE to deploy the report.
> I am not sure what did you mean CRI dll and roles. Would you please
> specify
> it more clearly?
> Sincerely,
> Wei Lu
> Microsoft Online Community Support
> ==================================================> Get notification to my posts through email? Please refer to
> http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
> ications.
> Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
> where an initial response from the community or a Microsoft Support
> Engineer within 1 business day is acceptable. Please note that each follow
> up response may take approximately 2 business days as the support
> professional working with you may need further investigation to reach the
> most efficient resolution. The offering is not appropriate for situations
> that require urgent, real-time or phone-based interactions or complex
> project analysis and dump analysis issues. Issues of this nature are best
> handled working with a dedicated Microsoft Support Engineer by contacting
> Microsoft Customer Support Services (CSS) at
> http://msdn.microsoft.com/subscriptions/support/default.aspx.
> ==================================================> (This posting is provided "AS IS", with no warranties, and confers no
> rights.)
>|||Have you looked at MSI packages?
You could probably package most of the elements. MSI packages can be used
for SQL scripts, which covers element 1, and might cover element 4, 5 and 6
if you can do this through SQL. It can also install dlls, covering element
2. I've never tried using msi against a web service, but it should be
possible, and with the right setup of your package, you should be able to
either deploy your reports or at least trigger a rss-script (reporting
services script, not the blog rss :) ) that will deploy your reports.
A bit of information here
http://www.sqlmag.com/Article/ArticleID/22428/sql_server_22428.html
A more hands-on example and article here
http://www.csharp-home.com/index/tiki-read_article.php?articleId=152
If you decide on msi, please tell the NG what you do and how successful it
turns out.
Kaisa M. Lindahl Lervik
"Henrik Skak Pedersen" <skak@.community.nospam> wrote in message
news:eY0e8DE7GHA.4116@.TK2MSFTNGP03.phx.gbl...
> Hello Wei Lu,
> We have a solution that contains the following elements:
> 1) SQL Scripts, which create views, tables, ect.
> 2) Custom Report Items (CRI) which is contained in a DLL
> 3) Reports (RDL files)
> 4) Reporting Services User Roles
> 5) Datasources
> 6) Setup of policies (permissions) on each report
> We have to package the solution and deploy it to multiple customers.
> Best regards
> Henrik.
>
> "Wei Lu [MSFT]" <weilu@.online.microsoft.com> wrote in message
> news:OnGVeBD7GHA.2336@.TK2MSFTNGXA01.phx.gbl...
>> Hello Henrik,
>> I am not sure what does your solution include.
>> Based on my research and experience, you need to deploy those data
>> seperately.
>> For example, you need to run all the database scripts on the production
>> environment and then, you could use the VS 2005 IDE to deploy the report.
>> I am not sure what did you mean CRI dll and roles. Would you please
>> specify
>> it more clearly?
>> Sincerely,
>> Wei Lu
>> Microsoft Online Community Support
>> ==================================================>> Get notification to my posts through email? Please refer to
>> http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
>> ications.
>> Note: The MSDN Managed Newsgroup support offering is for non-urgent
>> issues
>> where an initial response from the community or a Microsoft Support
>> Engineer within 1 business day is acceptable. Please note that each
>> follow
>> up response may take approximately 2 business days as the support
>> professional working with you may need further investigation to reach the
>> most efficient resolution. The offering is not appropriate for situations
>> that require urgent, real-time or phone-based interactions or complex
>> project analysis and dump analysis issues. Issues of this nature are best
>> handled working with a dedicated Microsoft Support Engineer by contacting
>> Microsoft Customer Support Services (CSS) at
>> http://msdn.microsoft.com/subscriptions/support/default.aspx.
>> ==================================================>> (This posting is provided "AS IS", with no warranties, and confers no
>> rights.)
>|||Hello Henrik,
I agreee with Kaisa.
You could setup a MSI package to deploy the SQL Script and use the RSS
script to deploy the Report.
Here are also some article for your reference:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vsintro7/ht
ml/vbtskcreatinginstallerforyourapplication.asp
http://www.codeproject.com/dotnet/Win_App_Setup_Project.asp?df=100&forumid=2
50630&exp=0&select=1419048
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/rsprog/htm/
rsp_prog_soapapi_script_3ik1.asp
Sincerely,
Wei Lu
Microsoft Online Community Support
==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================This posting is provided "AS IS" with no warranties, and confers no rights.|||Hi ,
How is everything going? Please feel free to let me know if you need any
assistance.
Sincerely,
Wei Lu
Microsoft Online Community Support
==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================This posting is provided "AS IS" with no warranties, and confers no rights.

Deny user roles from a Stored Procedure.

Hello,

I am trying to deny a user from processing a query, however the user still seems to be able to see the procedure.

I have executed the following command on both the 'Public' and specific user name.

DENY EXECUTE ON [OBJECT_NAME] TO [PUBLIC]

However when i run the command 'sp_helprotect OBJECT_NAME' afterwards it shows that deny is set on 'Public', yet the user can still run the procedure from a web report... I have tried restarting IIS and this also does nothing, any ideas?

Thanks,

RichAre you using windows authentication? If so, make sure that a Windows group does not have execute authority on the procedure. I would also check to make sure the user acount that is the problem does not have an elevated role like db_owner or a system role like sysadmin. I'm assuming that you verified that the application is actually using the login you have been denying permissions on.|||

Quote:

Originally Posted by rob313

Are you using windows authentication? If so, make sure that a Windows group does not have execute authority on the procedure. I would also check to make sure the user acount that is the problem does not have an elevated role like db_owner or a system role like sysadmin. I'm assuming that you verified that the application is actually using the login you have been denying permissions on.

the user might be a "dbo".|||If the user is dbo then SQL Server does not check any other permissions (grant or deny), so that would be why you are seeing this behavior. You will need to remove the user from dbo and grant that account the needed permissions or role.

DENY permission

Hi ,
i have set up to db roles "Admin" which have been
granted select , delete , insert , update
and "test" which has been granted select and DENY update
i have set up a user "user1" account which is part of
the "Admin" and "test" db role.
In this case will "user1" be denied the ability to
UPDATE ?
AND if i also set up user1 as a system administrator
fixed server role besides the 2 db role above , will the
DENY update has any effect on user1 ?
thks & rdgs
Hi,
Answer to your queries:-
In this case will "user1" be denied the ability to UPDATE ?
Ans: - Yes, User will not be able to select and update.
if i also set up user1 as a system administrator fixed server role besides
the 2 db role above , will the
DENY update has any effect on user1 ?
Ans: - Sysadmin role will override all the roles or Deny permissions. The
user with SYADMIN role can do any functionality in the SQL server
as well as all databases.
Thanks
Hari
MCDBA
"maxzsim" <anonymous@.discussions.microsoft.com> wrote in message
news:0d4a01c484cd$c77bfbd0$a301280a@.phx.gbl...
> Hi ,
> i have set up to db roles "Admin" which have been
> granted select , delete , insert , update
> and "test" which has been granted select and DENY update
> i have set up a user "user1" account which is part of
> the "Admin" and "test" db role.
> In this case will "user1" be denied the ability to
> UPDATE ?
> AND if i also set up user1 as a system administrator
> fixed server role besides the 2 db role above , will the
> DENY update has any effect on user1 ?
> thks & rdgs
|||IN addition permissions are cumulative across all of the roles, etc which
apply to a user, THEN subtract out all of the DENY permissions... ( Deny
overrides a grant.)
Wayne Snyder, MCDBA, SQL Server MVP
Mariner, Charlotte, NC
www.mariner-usa.com
(Please respond only to the newsgroups.)
I support the Professional Association of SQL Server (PASS) and it's
community of SQL Server professionals.
www.sqlpass.org
"maxzsim" <anonymous@.discussions.microsoft.com> wrote in message
news:0d4a01c484cd$c77bfbd0$a301280a@.phx.gbl...
> Hi ,
> i have set up to db roles "Admin" which have been
> granted select , delete , insert , update
> and "test" which has been granted select and DENY update
> i have set up a user "user1" account which is part of
> the "Admin" and "test" db role.
> In this case will "user1" be denied the ability to
> UPDATE ?
> AND if i also set up user1 as a system administrator
> fixed server role besides the 2 db role above , will the
> DENY update has any effect on user1 ?
> thks & rdgs

DENY permission

Hi ,
i have set up to db roles "Admin" which have been
granted select , delete , insert , update
and "test" which has been granted select and DENY update
i have set up a user "user1" account which is part of
the "Admin" and "test" db role.
In this case will "user1" be denied the ability to
UPDATE ?
AND if i also set up user1 as a system administrator
fixed server role besides the 2 db role above , will the
DENY update has any effect on user1 ?
thks & rdgsHi,
Answer to your queries:-
In this case will "user1" be denied the ability to UPDATE ?
Ans: - Yes, User will not be able to select and update.
if i also set up user1 as a system administrator fixed server role besides
the 2 db role above , will the
DENY update has any effect on user1 ?
Ans: - Sysadmin role will override all the roles or Deny permissions. The
user with SYADMIN role can do any functionality in the SQL server
as well as all databases.
Thanks
Hari
MCDBA
"maxzsim" <anonymous@.discussions.microsoft.com> wrote in message
news:0d4a01c484cd$c77bfbd0$a301280a@.phx.gbl...
> Hi ,
> i have set up to db roles "Admin" which have been
> granted select , delete , insert , update
> and "test" which has been granted select and DENY update
> i have set up a user "user1" account which is part of
> the "Admin" and "test" db role.
> In this case will "user1" be denied the ability to
> UPDATE ?
> AND if i also set up user1 as a system administrator
> fixed server role besides the 2 db role above , will the
> DENY update has any effect on user1 ?
> thks & rdgs|||IN addition permissions are cumulative across all of the roles, etc which
apply to a user, THEN subtract out all of the DENY permissions... ( Deny
overrides a grant.)
Wayne Snyder, MCDBA, SQL Server MVP
Mariner, Charlotte, NC
www.mariner-usa.com
(Please respond only to the newsgroups.)
I support the Professional Association of SQL Server (PASS) and it's
community of SQL Server professionals.
www.sqlpass.org
"maxzsim" <anonymous@.discussions.microsoft.com> wrote in message
news:0d4a01c484cd$c77bfbd0$a301280a@.phx.gbl...
> Hi ,
> i have set up to db roles "Admin" which have been
> granted select , delete , insert , update
> and "test" which has been granted select and DENY update
> i have set up a user "user1" account which is part of
> the "Admin" and "test" db role.
> In this case will "user1" be denied the ability to
> UPDATE ?
> AND if i also set up user1 as a system administrator
> fixed server role besides the 2 db role above , will the
> DENY update has any effect on user1 ?
> thks & rdgs

DENY permission

Hi ,
i have set up to db roles "Admin" which have been
granted select , delete , insert , update
and "test" which has been granted select and DENY update
i have set up a user "user1" account which is part of
the "Admin" and "test" db role.
In this case will "user1" be denied the ability to
UPDATE ?
AND if i also set up user1 as a system administrator
fixed server role besides the 2 db role above , will the
DENY update has any effect on user1 ?
thks & rdgsHi,
Answer to your queries:-
In this case will "user1" be denied the ability to UPDATE ?
Ans: - Yes, User will not be able to select and update.
if i also set up user1 as a system administrator fixed server role besides
the 2 db role above , will the
DENY update has any effect on user1 ?
Ans: - Sysadmin role will override all the roles or Deny permissions. The
user with SYADMIN role can do any functionality in the SQL server
as well as all databases.
Thanks
Hari
MCDBA
"maxzsim" <anonymous@.discussions.microsoft.com> wrote in message
news:0d4a01c484cd$c77bfbd0$a301280a@.phx.gbl...
> Hi ,
> i have set up to db roles "Admin" which have been
> granted select , delete , insert , update
> and "test" which has been granted select and DENY update
> i have set up a user "user1" account which is part of
> the "Admin" and "test" db role.
> In this case will "user1" be denied the ability to
> UPDATE ?
> AND if i also set up user1 as a system administrator
> fixed server role besides the 2 db role above , will the
> DENY update has any effect on user1 ?
> thks & rdgs|||IN addition permissions are cumulative across all of the roles, etc which
apply to a user, THEN subtract out all of the DENY permissions... ( Deny
overrides a grant.)
--
Wayne Snyder, MCDBA, SQL Server MVP
Mariner, Charlotte, NC
www.mariner-usa.com
(Please respond only to the newsgroups.)
I support the Professional Association of SQL Server (PASS) and it's
community of SQL Server professionals.
www.sqlpass.org
"maxzsim" <anonymous@.discussions.microsoft.com> wrote in message
news:0d4a01c484cd$c77bfbd0$a301280a@.phx.gbl...
> Hi ,
> i have set up to db roles "Admin" which have been
> granted select , delete , insert , update
> and "test" which has been granted select and DENY update
> i have set up a user "user1" account which is part of
> the "Admin" and "test" db role.
> In this case will "user1" be denied the ability to
> UPDATE ?
> AND if i also set up user1 as a system administrator
> fixed server role besides the 2 db role above , will the
> DENY update has any effect on user1 ?
> thks & rdgs