Persistent mirroring witness disconnected probem on mirror

Hi,
I'm running a syncornized mirroring setup using a witness on our LAN.
Since we don't use a domain controller, we use certificates for outbound and
inbound mirroring connections.
We're using sql server 2005 SP1 standard edititon on all machines.
The principal and mirror have only the partner role
The witness has only the witness role
After exeucting 'alter database set witness' on server1, the mirror monitor
shows that server1, the pricnipal, is connected to the witness, but server2,
the mirror, is disconnected from the witness.
When performing a manual failover (alter databsase set partner failover),
server2, now the principal, is still disconnected from the witness.
I've eliminated the possibility that server2 and the witness have a
connection problem, by dropping the witness from server1 when server1 was the
principal, and adding it to server2, when server2 was the principal. Then,
server1 is the one with the disconnected problem.
When executing the set witness command on a mirror, I get an error that it
can only be done on the principal machine.
Any ideas?
Thanks,
Ronen
The error message is exactly correct. You run an alter database set partner
on both the principal and the mirror. You only run the alter database set
witness on the principal. That command option is never run against the
mirror. It looks like you have either a certificate issue or you have a
connectivity problem. If the principal and mirror are server1 and server2,
what is the name of the witness?
Mike Hotek
MHS Enterprises, Inc
http://www.mssqlserver.com
"Ronen" <Ronen@.discussions.microsoft.com> wrote in message
news:C3C6E7E5-AA18-4A24-BC34-3C378D05A41D@.microsoft.com...
> Hi,
> I'm running a syncornized mirroring setup using a witness on our LAN.
> Since we don't use a domain controller, we use certificates for outbound
> and
> inbound mirroring connections.
> We're using sql server 2005 SP1 standard edititon on all machines.
> The principal and mirror have only the partner role
> The witness has only the witness role
> After exeucting 'alter database set witness' on server1, the mirror
> monitor
> shows that server1, the pricnipal, is connected to the witness, but
> server2,
> the mirror, is disconnected from the witness.
> When performing a manual failover (alter databsase set partner failover),
> server2, now the principal, is still disconnected from the witness.
> I've eliminated the possibility that server2 and the witness have a
> connection problem, by dropping the witness from server1 when server1 was
> the
> principal, and adding it to server2, when server2 was the principal. Then,
> server1 is the one with the disconnected problem.
> When executing the set witness command on a mirror, I get an error that it
> can only be done on the principal machine.
> Any ideas?
> Thanks,
> Ronen
>
sql

Permissions question

Hi,
I need to give access to a domain user group DOMAIN\Developers so that they
can ONLY start/stop SQL Jobs. Which is the best role to grant.
Thanks
Reddipermissions to run sp_stop_job and sp_start_job(msdb) plus permissions to
execute xp_sqlagent_enum_jobs(master) if accounts are not in sysadmins
and/or do not own the sqlagent jobs
"Reddi" <Reddi@.discussions.microsoft.com> wrote in message
news:2F34F361-C7B3-426B-AAC2-976E93039EC6@.microsoft.com...
> Hi,
> I need to give access to a domain user group DOMAIN\Developers so that
they
> can ONLY start/stop SQL Jobs. Which is the best role to grant.
> Thanks
> Reddi

Permissions granted from Domain credentials

I am working with Visual Studio.net and creating a front end for a SQL datab
ase. Now with the access front end, it uses the domain credentials of the l
ogged in user to determine what permissions they have for editing records in
the SQL (2000) database.
I need the same to be done with the web front end I am creating now. I have
gone into the WEB.CONFIG file and put in my credentials there, identity i
mpersonate="true" userName="domain\johndoe" password="password"
Now this is ok if...I didn't change my password regularly and I wanted every
one to have full access...but obviously I don't. Is there some syntax that
I need there so that it will use the credentials of the logged in user? Or a
m I in the wrong file and s
hould be making changes elsewhere? I am new to this but I am learning. In
the OleDB connection for the datagrid on the page, I have added the line...
Trusted Connection=SSPI. What am I missing? I am using OleDb connection a
nd OleDb Command. Like I s
aid...with my credential in the web.config, it works fine. But that is only
good for now. I need the security set so when I get to creating a page tha
t only administrators have access to I can get those to work correctly.
Thanks All!!I am assuming that with the Trusted Connection = SSPI the connection is
failing. If so, what error message do you get when it fails?
Rand
This posting is provided "as is" with no warranties and confers no rights.|||You need to allow Kerberos Authentication to occur. The middle machine
must be trusted for Security Delegation. Also , the SQL Server service
account needs to have the Service Principal Name set.
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.

Permissions granted for user x are insufficient for performing this operation

Here's the setup:
I've got a RS server set up in a QA domain. When I publish reports to it,
it prompts me for a username and password. I enter the ADMINISTRATOR
account and password and all is well.
I've now set up a RS server in the production domain and I need to publish
my reports to it. I've added my domain account to the Role Assignments with
System Administrator privliges. When I log into RS, I see all of the
relevant administrator options, but when I try to publish a new report via
VS I get the error message: "Permissions granted for user x are
insufficient for performing this operation"
What am I doing wrong?
ThanksYou need to grant the user permission in the correct folder. There is a
default role called Content Manager. Make your user this role in the
appropriate folder.
--
-Daniel
This posting is provided "AS IS" with no warranties, and confers no rights.
"troark" <t.roark@.excite.com.n0sp@.m> wrote in message
news:es0Px60nEHA.3868@.TK2MSFTNGP11.phx.gbl...
> Here's the setup:
> I've got a RS server set up in a QA domain. When I publish reports to it,
> it prompts me for a username and password. I enter the ADMINISTRATOR
> account and password and all is well.
> I've now set up a RS server in the production domain and I need to publish
> my reports to it. I've added my domain account to the Role Assignments
with
> System Administrator privliges. When I log into RS, I see all of the
> relevant administrator options, but when I try to publish a new report via
> VS I get the error message: "Permissions granted for user x are
> insufficient for performing this operation"
> What am I doing wrong?
> Thanks
>
>|||DOH! Thanks.
"Daniel Reib [MSFT]" <danreib@.online.microsoft.com> wrote in message
news:uiFmju1nEHA.2024@.TK2MSFTNGP09.phx.gbl...
> You need to grant the user permission in the correct folder. There is a
> default role called Content Manager. Make your user this role in the
> appropriate folder.
> --
> -Daniel
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
> "troark" <t.roark@.excite.com.n0sp@.m> wrote in message
> news:es0Px60nEHA.3868@.TK2MSFTNGP11.phx.gbl...
> > Here's the setup:
> > I've got a RS server set up in a QA domain. When I publish reports to
it,
> > it prompts me for a username and password. I enter the ADMINISTRATOR
> > account and password and all is well.
> >
> > I've now set up a RS server in the production domain and I need to
publish
> > my reports to it. I've added my domain account to the Role Assignments
> with
> > System Administrator privliges. When I log into RS, I see all of the
> > relevant administrator options, but when I try to publish a new report
via
> > VS I get the error message: "Permissions granted for user x are
> > insufficient for performing this operation"
> >
> > What am I doing wrong?
> >
> > Thanks
> >
> >
> >
> >
>

Permissions for Domain user account

Hi,
I want to use a domain user account not belonging to local admin or domain admin groups in SQL 2000/2005 Enterprise edition. This is what I've done so far..
On the machine that is the Domain Controller:
- installed SQL 2005 as a domain admin

- created a domain user account using Active Directory Users and Computers. This user is only

"Member of" domain users; not any Administrators group.

- added this user to SQL Server Management Studio->Logins and in Server Roles assigned

sysadmin role.
Question 1: Do I need to give any additional permissions to this user to work with SQL?
Question 2: How can I test this user for basic SQL operations like database creation? Can I use Osql?
Question 3: Can I use this user account to login to my domain controller using remote desktop? I tried adding this user to remote users, but in vain.

Thanks!

Hi there,

Just a few of my thoughts....

Question 1: Do I need to give any additional permissions to this user to work with SQL?

Well, going off what you have said (making the domain user part of the sysadmin server role) this will allow the domain user to do any action on your database server.

Whether this is a good thing or not is debatable as it's pretty good practice to only give a user the lowest level of permissions they need in order to do whatever work they need to do. Not knowing your exact situation, giving the domain user the level of privilege you have might be overkill - but like I said it depends on what you're intending etc.

I would recommend you review security topics in SQL Server Books Online and use the info there in conjunction with your knowledge of the circumstances to select the appropriate strategy for giving permission to this user and any other users whose accounts you need to add.

Question 2: How can I test this user for basic SQL operations like database creation? Can I use Osql?

There are a few options here, I'll go into a few....

A) Yes you can use the OSQL or iSQL command line utilities to execute T-SQL if you're working with SQL Server 2000. Once again, SQL Server Books Online is a good resource for this.

If you're working with SQL Server 2005, it's better to use sqlcmd if you're looking to do things via a command line (http://msdn2.microsoft.com/en-us/library/ms170207(SQL.90).aspx)

B) It's easier to use graphical tools, I think. If you can use something like Query Analyzer (SQL Server 2000) or Management Studio (SQL Server 2005) to connect to your DB as the domain user (e.g. logging onto a machine with those tools installed as the domain user and then using those tools to connect to your database server) then that would probably be easier

Question 3: Can I use this user account to login to my domain controller using remote desktop? I tried adding this user to remote users, but in vain.

From what you've written it seems like you're doing the right thing. Here's a tutorial on the complete process which may help: http://www.windowsnetworking.com/articles_tutorials/Windows_2003_Terminal_Services_Part1.html
(Note that it's split into two parts...The link I've included is to the first part but the first part connects to the second part via another link)

TechNet isn't bad either: http://technet2.microsoft.com/windowsserver/en/technologies/featured/termserv/default.mspx

Like I said, from what you've written it's a little hard to gauge the exact problem but it seems like you're doing the right things. However, if you want to run through the steps in the articles & stuff I've placed links to above then things should work for your Terminal Services setup (they did for me)

========

Hope this helps a bit
|||

Thanks alot for your help. Sorry for a delayed reply as I was reading the material you suggested and the good news is that I am able to implement the same and have got things working.
ref - Question 1: As for the permissions, as you suggested, I no longer give the user sysadmin role. The user has dbowner role and it suffices.
ref-Question 2: I used Query Analyser itself by logging in to the machine as the domain user.
ref- Question 3: I could not get Remote Desktop to work for the user. I guess some licensing issue. As a workaround, I used VNC to login as the domain user.

Thanks again.

Permissions BUILTIN/Administrator

We recently migrated from an NT4 domain to a Windows 2003 domain.
I was using the login olddomain\paulc and I now use newdomain\paulc
My pc and the SQL server have been moved to the new domain.
Our nt admins have created a new group for the sql admins/developers on the
new domain called "Sql Admins". I was an NT Domain Admin on the old domain.
I have added this new group to sql server however I am being validated as
BUILTIN\Administrators.
exec master..xp_logininfo 'DOMAIN\username'
Any idea why this is? I think this is an NT issue. I believe there is an NT
trust between the old and
new domains.
Regards
Paul CahillPaul,
Not sure if I understand your situation right, but basically the
BUILTIN\Admins is the same as you local administrators group on the
server. If your new account is a member of this local administrators
group, either direct or through group membership SQL Server will
validate you as BUILTIN\Administrators
Markus|||Cheers Markus.
I'll have a look or words with our IS admins.
<m.bohse@.quest-consultants.com> wrote in message
news:1133356379.166090.122130@.g47g2000cwa.googlegroups.com...
> Paul,
> Not sure if I understand your situation right, but basically the
> BUILTIN\Admins is the same as you local administrators group on the
> server. If your new account is a member of this local administrators
> group, either direct or through group membership SQL Server will
> validate you as BUILTIN\Administrators
> Markus
>|||The IS guys had made all us Sql dba/developers domain admins and domain
admins has been added to the local administator group.
All is cool.
Thanks again Markus.
Paul
<m.bohse@.quest-consultants.com> wrote in message
news:1133356379.166090.122130@.g47g2000cwa.googlegroups.com...
> Paul,
> Not sure if I understand your situation right, but basically the
> BUILTIN\Admins is the same as you local administrators group on the
> server. If your new account is a member of this local administrators
> group, either direct or through group membership SQL Server will
> validate you as BUILTIN\Administrators
> Markus
>

Permissions

hi all

my computer = NZ3 (sql Server)
my computer = the report server

I can design / view / publish to local host (myserver)
others in domain can only view local host (myserver) and no content

so to test added one person - as content manager
he can now see all reports - but when he goes to run
gets the error cannot create a connection to the datasource?

I am using sql server 2005 standard

where else should I be changing or setting permissions

thanks
jewel

Hi,

seems that you are using Integrated Authentication. Although the user can manage the content (the actual report / permissions etc) he does not have access to the database. If you want to grant him access to the appropiate tables with the data, you will have to priviledge him on the database, otherwise he won′t be able to connect nor access the database. Open the SSMS and navigate to the security node of the server. Add the Windows user as a login and grant him the appropiate rights in the database.

HTH, Jens K. Suessmeyer.

http://www.sqlserver2005.de

|||

thanks Jens

that enabled him to see now cool.

So when I have a group set up - do I have to add each one in the Security Logins to enable this to work?

thanks

Jewel

|||

Hi,

yes you need to Map those Windows User group to Security Node and then Assign them proper privilage for Database and Objects of Database for access as per the Role/Group.

Hemantgiri S. Goswami

Permissions

How can i Deny access to my domain users to my sql databases and grant acces
s
only to some users. If a make Deny to all users in domain and if a create th
e
necessary users with Grant Access to some databases, the can access the
databases?
Best RegardsCreate a group and add the users you want tio deny access
Take a look at below stored procedure in the BOL.
sp_revokedbaccess [ @.name_in_db = ] 'name'
"icrp@.msn.com" <icrpmsncom@.discussions.microsoft.com> wrote in message
news:9F945ED7-1C19-44CC-A15E-C44D30CCEB65@.microsoft.com...
> How can i Deny access to my domain users to my sql databases and grant
> access
> only to some users. If a make Deny to all users in domain and if a create
> the
> necessary users with Grant Access to some databases, the can access the
> databases?
> Best Regards|||Hi,
what happen if you create seprate user and assign each of them a
permissions , it will be hectic if # users are large , rather if you create
a
ROLE(department wise) and then assign them a proper permissions and then map
a user / group ( it could be sql or windows user/group) . it will save your
time and purpose tooo.
HTH
Regards
--
Andy Davis
Activecrypt Team
---
SQL Server Encryption Software
http://www.activecrypt.com
"Uri Dimant" wrote:

> Create a group and add the users you want tio deny access
> Take a look at below stored procedure in the BOL.
> sp_revokedbaccess [ @.name_in_db = ] 'name'
>
> "icrp@.msn.com" <icrpmsncom@.discussions.microsoft.com> wrote in message
> news:9F945ED7-1C19-44CC-A15E-C44D30CCEB65@.microsoft.com...
>
>

permission question

Hi,

I granted a domain user login:
--read only to our production db.
--db_owner to msdb.

I want this login to be able to create jobs & dts packages.
he's able to create dts packages, but when he tries to create a new job, in the db dropdown menu (steps tab) he can't see the production db. He only sees msdb, master & temp... he needs to see the production db, so that he can create a job.

please help!
MeeraHowdy

You have done the right thing allowing access to MSDB. He should be able to create DTS packages anyway ( anyone can ) .

With his login, what is his default database? Also, has his login ( not a group etc ) been actually granted access to the production database?

I say this as the Public group in a database can be emptied in the database, thereby not everyone on the server is granted access automatically to the database.

Cheers

SG|||Thanks for replying!

This guy belongs to a domain user group called dbCustomReports. So, when he registers his servers in Enterprise manager using the runas command, he'll be registered as Domain/dbCustomReports.

His default db is the production db.

The login in SQL server is actually Domain/dbCustomReports. That login has db_owner permissions on msdb & production.

Which login should I grant permissions to? I didn't follow that part of your question... (he doesn't have any individual sql server login)

Any help is appreciated.
Thanks,
Meera|||you should grant the domain/dbCustomReports access to you production database. Setting a default database does not grant access to that database. You have granted permissions to the group to which the user belongs. Be aware that anyone else belonging to that group has the same privileges in the database.|||That account has been granted db_owner priviliges to the production db & then I set the default db :)
Meera|||can the user see the production database in the enterprise manager or also only msdb, master and temp?|||in EM, the user can see the production db and all the other db (of course when he tries to see the tables, it won't let him.)

Thanks,
Meera|||How did you set up the permissions for this user? Are there any other privileges or database roles granted?|||database called CR -- db_owner
msdb -- db_owner
database called Prod -- read only

Meera|||I think you should only give read only to the first one too

Paulo

Originally posted by meeraarvind
database called CR -- db_owner
msdb -- db_owner
database called Prod -- read only

Meera

Permission levels for MSDE, ASAP

We seem to have a problem with permission levels and connecting to an MSDE (MSSQL) server. If the user is under the Domain Admins group, the the access projet (front end) will open correctly and connect to the data server. If they are not part of that group then the front end can ever establish a file to the database server. We do not want to make all the users Domain Admins, so is there a way to make MSDE let them trough even though they are on a lower level.

I've done many tests, and also tried many things. I've even went to the extent to give Full Control to the whole MSSQL folder in program files for Everyone. I have made sure that the database file itself inherieted it's parents security settings, which were what I had just described.

Any ideas how how to make MSDE let anyone connect? Thanks in advance!Domain admins are allowed into the database by virtue of the fact that they are included in the Local Administrators group in the machine running MSDE. So, the quickest thing you could do is make your users local admins, rather than domain admins. In order to reduce their permissions further, you will have to settle what you want the users to be able to do. Local Admins can do anything to the instance of MSDE (configure settings, drop/add databases, forget to backup their data, etc.), but then, these are MSDE users, so they are usually only affecting themselves.|||Thanks again for replying so quickly! I am a little unsure what you mean by local admin though. It is an NT server, by the way. There is no group called Local Admin. I tried the group Administrators, but that didn't work. Do you mean on each workstation?|||We may have to back up a step here. MSDE is usually installed on workstations (my assumption, my bad). You have one central server, with various workstations connecting to the instance of MSDE on that server, then? Now we have a bit of a rat hole. Welcome to the world of SQL Server permissions. In other words, not much is going to be automatic here. Here is how you will likely have to start:

1) Create a domain group for the users who need to use the application.

2) On the server, with a command window, run
osql -E (-S servername\instancename)

NOTE: You may need to supply the MSDE instance name. If you get a numbered prompt, you are in.

3) switch to the application database by running the following:

1>use (dbname)
2>go

4) Run the following commands:

1>exec sp_grantlogin '(domain\new group from above)'
2>exec sp_grantdbaccess '(domain\new group from above)'
3>exec sp_addrolemember db_owner, '(domain\new group from above)'

Once you have done all that, you should be able to run without making people domain admins. I am not too wild about having you grant db_owner to the users, but they would have had sysadmin otherwise, but that is a long debate between programmers and DBAs that I probably do not need to invoke here. Good luck.|||I thank you very much for getting back with me. I apoligize for not replying in a few days, as I was vey busy. The method you described is what I was basically looking to do. I did exactly what you said, but it did not seem to work. I'm afraid I've done it wrong. I just wanted to make sure of the notiation you meant for me to use when typing it. Let's say for example:
1. the user group is called SQL Users
2. the domain is called DOMAIN
3. the server is called SERVER1
4. the database is called IT Help Desk

Would this be correct?

osql -E -S SERVER1

1>use [IT Help Desk]
2>go

1>exec sp_grantlogin '(DOMAIN\SQL Users)'
2>exec sp_grantdbaccess '(DOMAIN\SQL Users)'
3>exec sp_addrolemember db_owner, '(DOMAIN\SQL Users)'

Also...the single quotes...in the command prompt, there are open and close ones. The one that is usually used for both (located near the enter key on he keyboard) shows up as a close single quote. So what should be used? An open then close one? Both closed? Just wondering. If anyone else knows, feel fee to post as well.|||can you access the database thru sql enterprise manager?|||I'm using MSDE!! This is the free version of MSSQL that comes with MS Office. There is no EM for it.|||Sorry. If you lose the parentheses, you should be able to get it to work. If not, post whatever output (error message) you do get.|||It's not really an error message. It's just not able to connect to the server because of permission settings. I know this, but I can't get the server to let anyone connect. I tried without the pathrenthesis, but it still didn't work. TO be more detailed, when in MS Access, and trying to open a form (the point at which it needs to talk to the server) it gives me a run time error 18456, which says that the database could not log onto the server and to verify that the log on info is correct. I know that it's the groups that is the issue, because when I add the user that I am currently logged on as in the Domain Users group, it works fine. I think you were going in the right direction. I just wish MSDE had an interface to work with. I hate this stupid command line stuff. Too much coding. I'm not a professional programmer, altough I have taken VB a few years ago and know most of that. Other then that, web programming is all I know. Anyways, I'm heaing home for the holidays, this project isn't top priority, so I'll work on it when I get back. If you have any other ideas, please let me know. If you want to contact me directly, please email pilotboi@.comcast.net, thanks! Happy holidays!|||I had a similar problem with XP. If using Windows XP your (regular) local user will have very restricted user rights concerning writing to the registry. In addition there may be problems using the .NET framework and MSDE.
It may not be enough for installing or even using the MSDE. The MSDE requires writing to the registry, therefore the user does not need administrator rights but local user rights of a poweruser. We had the same problem. Have a look to the MSDE installation guide and/or readmes and the security settings of your .NET framework. This was helping us, the error messages did not lead to the right conclusions.|||You can use 3rd party tools to manage MSDE and the Enterprise Manager

Permission for Jobs

I have a user who needs to create jobs and also manage some already existing
jobs owned by dbo. I have added her Windows domain id in MSDB data which will
allow her to create and manage her own jobs. I was trying to add her to the
TargetServersRole but this role has been denied access to stored procedures
e.g. sp_update_job in MSDB database. How can I achieve this. Please advise.
Thanks..Fraz
Only members of the sysadmin server role can alter, delete and start jobs
owned by another user. This is hardcoded into the respective system stored
procedures (sp_update_job, sp_start_job etc), so if you want you can change
these stored procedures in msdb to take out the check to see if the user is
a member of the sysadmin role or owns the job. This is unsupported though.
Jacco Schalkwijk
SQL Server MVP
"Fraz" <Fraz@.discussions.microsoft.com> wrote in message
news:43343195-6BEC-4AC6-9178-B94B92CE57D5@.microsoft.com...
>I have a user who needs to create jobs and also manage some already
>existing
> jobs owned by dbo. I have added her Windows domain id in MSDB data which
> will
> allow her to create and manage her own jobs. I was trying to add her to
> the
> TargetServersRole but this role has been denied access to stored
> procedures
> e.g. sp_update_job in MSDB database. How can I achieve this. Please
> advise.
> Thanks..Fraz

Permission for Jobs

I have a user who needs to create jobs and also manage some already existing
jobs owned by dbo. I have added her Windows domain id in MSDB data which will
allow her to create and manage her own jobs. I was trying to add her to the
TargetServersRole but this role has been denied access to stored procedures
e.g. sp_update_job in MSDB database. How can I achieve this. Please advise.
Thanks..FrazOnly members of the sysadmin server role can alter, delete and start jobs
owned by another user. This is hardcoded into the respective system stored
procedures (sp_update_job, sp_start_job etc), so if you want you can change
these stored procedures in msdb to take out the check to see if the user is
a member of the sysadmin role or owns the job. This is unsupported though.
--
Jacco Schalkwijk
SQL Server MVP
"Fraz" <Fraz@.discussions.microsoft.com> wrote in message
news:43343195-6BEC-4AC6-9178-B94B92CE57D5@.microsoft.com...
>I have a user who needs to create jobs and also manage some already
>existing
> jobs owned by dbo. I have added her Windows domain id in MSDB data which
> will
> allow her to create and manage her own jobs. I was trying to add her to
> the
> TargetServersRole but this role has been denied access to stored
> procedures
> e.g. sp_update_job in MSDB database. How can I achieve this. Please
> advise.
> Thanks..Fraz

Permission for Jobs

I have a user who needs to create jobs and also manage some already existing
jobs owned by dbo. I have added her Windows domain id in MSDB data which wil
l
allow her to create and manage her own jobs. I was trying to add her to the
TargetServersRole but this role has been denied access to stored procedures
e.g. sp_update_job in MSDB database. How can I achieve this. Please advise.
Thanks..FrazOnly members of the sysadmin server role can alter, delete and start jobs
owned by another user. This is hardcoded into the respective system stored
procedures (sp_update_job, sp_start_job etc), so if you want you can change
these stored procedures in msdb to take out the check to see if the user is
a member of the sysadmin role or owns the job. This is unsupported though.
Jacco Schalkwijk
SQL Server MVP
"Fraz" <Fraz@.discussions.microsoft.com> wrote in message
news:43343195-6BEC-4AC6-9178-B94B92CE57D5@.microsoft.com...
>I have a user who needs to create jobs and also manage some already
>existing
> jobs owned by dbo. I have added her Windows domain id in MSDB data which
> will
> allow her to create and manage her own jobs. I was trying to add her to
> the
> TargetServersRole but this role has been denied access to stored
> procedures
> e.g. sp_update_job in MSDB database. How can I achieve this. Please
> advise.
> Thanks..Fraz

Permission clarification - dbo vs domain\user.dbo

Our developers have been given dbcreator rights on the server and have dbo
rights for a given database. This is a slight change from what was
previously dolled out as rights on the database. When the developer create
s
a view, rather than the view being created as dbo.myview, it is created as
Domain\developername.dbo.myview. I am not sure this is what I want. Is
there a permission I can add that will allow the developer to create DBO onl
y
views on the given database?
--
Regards,
JamieBOL says:
The dbo is a user that has implied permissions to perform all activities in
the database. Any member of the sysadmin fixed server role who uses a
database is mapped to the special user inside each database called dbo.
Also, any object created by any member of the sysadmin fixed server role
belongs to dbo automatically.
For example, if user Andrew is a member of the sysadmin fixed server role
and creates a table T1, T1 belongs to dbo and is qualified as dbo.T1, not as
Andrew.T1. Conversely, if Andrew is not a member of the sysadmin fixed
server role but is a member only of the db_owner fixed database role and
creates a table T1, T1 belongs to Andrew and is qualified as Andrew.T1. The
table belongs to Andrew because he did not qualify the table as dbo.T1.
The dbo user cannot be deleted and is always present in every database.
Only objects created by members of the sysadmin fixed server role (or by the
dbo user) belong to dbo. Objects created by any other user who is not also a
member of the sysadmin fixed server role (including members of the db_owner
fixed database role):
a.. Belong to the user creating the object, not dbo.
b.. Are qualified with the name of the user who created the object.
"thejamie" <thejamie@.discussions.microsoft.com> wrote in message
news:051962BF-4DDA-4FDC-BF7B-C2B241C1E3DE@.microsoft.com...
> Our developers have been given dbcreator rights on the server and have dbo
> rights for a given database. This is a slight change from what was
> previously dolled out as rights on the database. When the developer
> creates
> a view, rather than the view being created as dbo.myview, it is created as
> Domain\developername.dbo.myview. I am not sure this is what I want.
> Is
> there a permission I can add that will allow the developer to create DBO
> only
> views on the given database?
> --
> Regards,
> Jamie