Permissons Question

Hi All
Is it possible to grant a user permissons so they are
only able to execute a SQL Job and not have access to
anything else in a database.
Thanks
Hi
Yes, altough not with job, but with stored procecdure.
Andras Jakus MCDBA
"anonymous@.discussions.microsoft.com" wrote:

> Hi All
> Is it possible to grant a user permissons so they are
> only able to execute a SQL Job and not have access to
> anything else in a database.
> Thanks
>

permissions xp_cmdshell

Hi!!!
which permissions are necessary to execute xp_cmdshell?
-->without being SA
Error:
Msg 50001, Level 1, State 50001
xpsql.cpp: Error 87 from GetProxyAccount on line 604
tanks!!!You will need to set up a proxy account first using
"xp_sqlagent_proxy_account". Then you should get the permission associated
with the account you "set" up as your proxy account.
--
----
----
--
Need SQL Server Examples check out my website at
http://www.geocities.com/sqlserverexamples
"Joao Mossmann" <mossmann@.feevale.br> wrote in message
news:%234YPh1rLEHA.1556@.TK2MSFTNGP10.phx.gbl...
> Hi!!!
> which permissions are necessary to execute xp_cmdshell?
> -->without being SA
> Error:
> Msg 50001, Level 1, State 50001
> xpsql.cpp: Error 87 from GetProxyAccount on line 604
>
> tanks!!!
>
>|||Heres what Ive done in SQL 2000. RClick the SQL Agent/ props/ job system/
uncheck Only users with SA bla bla.../ fill in appropriate credentials. Most
imprtantly, DO NOT set permissions on xp_cmdshell itself.
"Joao Mossmann" <mossmann@.feevale.br> wrote in message
news:%234YPh1rLEHA.1556@.TK2MSFTNGP10.phx.gbl...
> Hi!!!
> which permissions are necessary to execute xp_cmdshell?
> -->without being SA
> Error:
> Msg 50001, Level 1, State 50001
> xpsql.cpp: Error 87 from GetProxyAccount on line 604
>
> tanks!!!
>
>

permissions xp_cmdshell

Hi!!!
which permissions are necessary to execute xp_cmdshell?
-->without being SA
Error:
Msg 50001, Level 1, State 50001
xpsql.cpp: Error 87 from GetProxyAccount on line 604
tanks!!!
You will need to set up a proxy account first using
"xp_sqlagent_proxy_account". Then you should get the permission associated
with the account you "set" up as your proxy account.
----
Need SQL Server Examples check out my website at
http://www.geocities.com/sqlserverexamples
"Joao Mossmann" <mossmann@.feevale.br> wrote in message
news:%234YPh1rLEHA.1556@.TK2MSFTNGP10.phx.gbl...
> Hi!!!
> which permissions are necessary to execute xp_cmdshell?
> -->without being SA
> Error:
> Msg 50001, Level 1, State 50001
> xpsql.cpp: Error 87 from GetProxyAccount on line 604
>
> tanks!!!
>
>
|||Heres what Ive done in SQL 2000. RClick the SQL Agent/ props/ job system/
uncheck Only users with SA bla bla.../ fill in appropriate credentials. Most
imprtantly, DO NOT set permissions on xp_cmdshell itself.
"Joao Mossmann" <mossmann@.feevale.br> wrote in message
news:%234YPh1rLEHA.1556@.TK2MSFTNGP10.phx.gbl...
> Hi!!!
> which permissions are necessary to execute xp_cmdshell?
> -->without being SA
> Error:
> Msg 50001, Level 1, State 50001
> xpsql.cpp: Error 87 from GetProxyAccount on line 604
>
> tanks!!!
>
>

permissions xp_cmdshell

Hi!!!
which permissions are necessary to execute xp_cmdshell?
-->without being SA
Error:
Msg 50001, Level 1, State 50001
xpsql.cpp: Error 87 from GetProxyAccount on line 604
tanks!!!You will need to set up a proxy account first using
"xp_sqlagent_proxy_account". Then you should get the permission associated
with the account you "set" up as your proxy account.
--
----
----
--
Need SQL Server Examples check out my website at
http://www.geocities.com/sqlserverexamples
"Joao Mossmann" <mossmann@.feevale.br> wrote in message
news:%234YPh1rLEHA.1556@.TK2MSFTNGP10.phx.gbl...
> Hi!!!
> which permissions are necessary to execute xp_cmdshell?
> -->without being SA
> Error:
> Msg 50001, Level 1, State 50001
> xpsql.cpp: Error 87 from GetProxyAccount on line 604
>
> tanks!!!
>
>|||Heres what Ive done in SQL 2000. RClick the SQL Agent/ props/ job system/
uncheck Only users with SA bla bla.../ fill in appropriate credentials. Most
imprtantly, DO NOT set permissions on xp_cmdshell itself.
"Joao Mossmann" <mossmann@.feevale.br> wrote in message
news:%234YPh1rLEHA.1556@.TK2MSFTNGP10.phx.gbl...
> Hi!!!
> which permissions are necessary to execute xp_cmdshell?
> -->without being SA
> Error:
> Msg 50001, Level 1, State 50001
> xpsql.cpp: Error 87 from GetProxyAccount on line 604
>
> tanks!!!
>
>sql

Permissions with sp

Hi,
I programmed a Sp, which I gave permissions to some users to execute,
nevertheless, inside the code makes inserts and updates to tables where they
only have select permissions. So whenever they execute them a error message
is produced. How can i turnaround this. I want the sp to actually write in
some tables which they only have select permissions. Is there a solution.
Thanks
--
Carlos DiasHi,
Execute permission on the SP for that user should be fine to Insert or
Delete or Update.
GRANT EXEC ON SPNAME TO Username
Thanks
Hari
SQL Server MVP
"Carlos Dias" <CarlosDias@.discussions.microsoft.com> wrote in message
news:1801CAC0-5691-4146-B63C-7E2E99E87405@.microsoft.com...
> Hi,
> I programmed a Sp, which I gave permissions to some users to execute,
> nevertheless, inside the code makes inserts and updates to tables where
> they
> only have select permissions. So whenever they execute them a error
> message
> is produced. How can i turnaround this. I want the sp to actually write in
> some tables which they only have select permissions. Is there a solution.
> Thanks
> --
> Carlos Dias|||It would help us better assist you if you could include table DDL, and the
entire stored procedure code. Without this effort from you, we are just
playing guessing games.
Arnie Rowland, Ph.D.
Westwood Consulting, Inc
Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous
"Carlos Dias" <CarlosDias@.discussions.microsoft.com> wrote in message
news:1801CAC0-5691-4146-B63C-7E2E99E87405@.microsoft.com...
> Hi,
> I programmed a Sp, which I gave permissions to some users to execute,
> nevertheless, inside the code makes inserts and updates to tables where
> they
> only have select permissions. So whenever they execute them a error
> message
> is produced. How can i turnaround this. I want the sp to actually write in
> some tables which they only have select permissions. Is there a solution.
> Thanks
> --
> Carlos Dias|||Users do not need any permissions on tables used in a stored procedure as
long as:
1) all objects are owned by the same user (SQL 2000) or have same schema
owner (SQL 2005)
2) you do not use dynamic SQL
This behavior is known as ownership chaining. See the Books Online for more
information.
Hope this helps.
Dan Guzman
SQL Server MVP
"Carlos Dias" <CarlosDias@.discussions.microsoft.com> wrote in message
news:1801CAC0-5691-4146-B63C-7E2E99E87405@.microsoft.com...
> Hi,
> I programmed a Sp, which I gave permissions to some users to execute,
> nevertheless, inside the code makes inserts and updates to tables where
> they
> only have select permissions. So whenever they execute them a error
> message
> is produced. How can i turnaround this. I want the sp to actually write in
> some tables which they only have select permissions. Is there a solution.
> Thanks
> --
> Carlos Dias

Permissions required for sp_databases

This may be the wrong forum for this - if so, please direct me to the appropriate forum.

I've

recently upgraded to MSSQL 2005 and I'm trying to execute the

sp_databases stored procedure, but I'm having what looks like

permissions problems. I can execute the stored procedure, but it

doesn't return any results. As far as I can tell, the problem is that

my userid can't see any rows in sys.master_files (I can select from the view, it just doesn't return any rows).

I've tried any

number of things to get this to work, but the only thing that's been

successful is to change my userid's database role membership to

db_owner. In the long run, this isn't really a viable solution for me,

since my userid should only really have read(select) access to the

database in question.

I'd appreciate any pointers that you can

give me - I figure I'm doing something stupid, but haven't been able to

figure out what, yet.

Thanks,
Jeff

If you grant VIEW ANY DEFINITION, you will be able to see this information for the databases that you can access. However, VIEW ANY DEFINITION will open other catalogs as well.

I suggest to write a wrapper procedure over sp_databases that is signed with a certificate and grant that certificate the VIEW ANY DEFINITION permission, then grant EXECUTE permission on the procedure to the principal that needs this functionality.

Thanks
Laurentiu

|||That seems to work, thanks!

Is there any way to grant permission for an individual database? My user is really only interested in the sp_databases row for a single database. The others are just ignored, so they could be dropped out of the result set with no loss of functionality (and that might limit the permissions that need to be granted).

Jeff|||

You can use a signed procedure to filter the results and only display the row for a certain database. You cannot do this only using permissions.

Thanks
Laurentiu

|||So if a procedure is created as dbo a user who has readonly access to the db in which it was created wouldn't be able to query sysobjects or use sp_helptext to view procedure information? In 2000 the user would be able to see the procedure but this is not so in 2005.

Permissions on sp_OASetProperty

We have a request to be able to execute the following from an application:
declare @.languageValue varchar(1000)
exec sp_OASetProperty @.languageValue, 'CharSet', 'Shift-JIS'
Currently the developer is unable to because they get an "EXECUTE permission
denied on object 'sp_OASetProperty', database 'master', owner 'dbo'." when
running this.
We have no users (other than dbo & guest) in the master database. How can
this be setup with the least amount of permissions being given.
I appreciate any suggestions.
thanks
Meenal> We have no users (other than dbo & guest) in the master database. How can
> this be setup with the least amount of permissions being given.
Assuming SQL 2000 SP3 or above, you can use cross-database ownership
chaining to allow limited access to the sp_OA* procs and other potentially
dangerous master procs. Note that you should enable 'db chaining' in an
sa-owned database when only sysadmin role members are permitted to create
dbo-owned objects in that database.
1) From Enterprise Manager, uncheck 'only uses with sysadmin...' under
Management-->SQL Server Agent-->Job System and specify a Windows proxy
account when prompted. This proxy account is used as the OS security
context for access to external resources.
2) Change your user database owner to 'sa':
USE MyDatabase
EXEC sp_changedbowner 'sa'
3) Enable the 'db chaining' database option
EXEC sp_dboption 'MyDatabase', 'db chaining', true
4) Create a proc to wrap the needed functionality:
CREATE PROC dbo.usp_DoSomething
@.MyData
AS
--initialization code, including sp_OACreate
EXEC sp_OASetProperty
@.token,
@.languageValue,
'CharSet',
'Shift-JIS'
--other code, including sp_OADestroy
GO
5) Create execute permission to users:
GRANT EXEC ON dbo.usp_DoSomething TO MyRole
This will provide an unbroken ownership chain because all of the objects
involved have the same owner (dbo) and both database owners are owned by the
same login (sa).
It is important that the proc be constructed in such a way as to prevent
ad-hoc execution of unintended commands.
Hope this helps.
Dan Guzman
SQL Server MVP
"Meenal Dhody" <meenal_dhody@.hotmail.com> wrote in message
news:%23EjS4BkaGHA.3992@.TK2MSFTNGP05.phx.gbl...
> We have a request to be able to execute the following from an application:
> declare @.languageValue varchar(1000)
> exec sp_OASetProperty @.languageValue, 'CharSet', 'Shift-JIS'
> Currently the developer is unable to because they get an "EXECUTE
> permission
> denied on object 'sp_OASetProperty', database 'master', owner 'dbo'." when
> running this.
> We have no users (other than dbo & guest) in the master database. How can
> this be setup with the least amount of permissions being given.
> I appreciate any suggestions.
> thanks
> Meenal
>
>
>|||Thanks alot for you suggestion- just a question or 2.
If the database is owned by an nt account and we use mixed mode for SQL
authenticate would I just set the proxy account up using the SQL NT login?
thanks
Meenal
"Dan Guzman" <guzmanda@.nospam-online.sbcglobal.net> wrote in message
news:OBMImNsaGHA.1812@.TK2MSFTNGP04.phx.gbl...
can[vbcol=seagreen]
> Assuming SQL 2000 SP3 or above, you can use cross-database ownership
> chaining to allow limited access to the sp_OA* procs and other potentially
> dangerous master procs. Note that you should enable 'db chaining' in an
> sa-owned database when only sysadmin role members are permitted to create
> dbo-owned objects in that database.
> 1) From Enterprise Manager, uncheck 'only uses with sysadmin...' under
> Management-->SQL Server Agent-->Job System and specify a Windows proxy
> account when prompted. This proxy account is used as the OS security
> context for access to external resources.
> 2) Change your user database owner to 'sa':
> USE MyDatabase
> EXEC sp_changedbowner 'sa'
> 3) Enable the 'db chaining' database option
> EXEC sp_dboption 'MyDatabase', 'db chaining', true
> 4) Create a proc to wrap the needed functionality:
> CREATE PROC dbo.usp_DoSomething
> @.MyData
> AS
> --initialization code, including sp_OACreate
> EXEC sp_OASetProperty
> @.token,
> @.languageValue,
> 'CharSet',
> 'Shift-JIS'
> --other code, including sp_OADestroy
> GO
> 5) Create execute permission to users:
> GRANT EXEC ON dbo.usp_DoSomething TO MyRole
>
> This will provide an unbroken ownership chain because all of the objects
> involved have the same owner (dbo) and both database owners are owned by
the
> same login (sa).
> It is important that the proc be constructed in such a way as to prevent
> ad-hoc execution of unintended commands.
> --
> Hope this helps.
> Dan Guzman
> SQL Server MVP
> "Meenal Dhody" <meenal_dhody@.hotmail.com> wrote in message
> news:%23EjS4BkaGHA.3992@.TK2MSFTNGP05.phx.gbl...
application:[vbcol=seagreen]
when[vbcol=seagreen]
can[vbcol=seagreen]
>|||I'm not sure why you ask this question. The proxy account is used as the
external OS security context when non-sysadmin users execute the sp_OA*
procs. That Windows account doesn't even need access to SQL Server.
Setting unless the code invoked via sp_OA* connects to SQL using a trusted
connection.
Unless you specify 'sa' as the user database owner, you'll need to add the
users to the master database and grant execute permissions on the sp_OA*
procs. It is technically possible to simply grant execute permissions to
guest or public but that's a very bad security practice.
Hope this helps.
Dan Guzman
SQL Server MVP
"Meenal Dhody" <meenal_dhody@.hotmail.com> wrote in message
news:eEF4P6UbGHA.3812@.TK2MSFTNGP04.phx.gbl...
> Thanks alot for you suggestion- just a question or 2.
> If the database is owned by an nt account and we use mixed mode for SQL
> authenticate would I just set the proxy account up using the SQL NT login?
> thanks
> Meenal
> "Dan Guzman" <guzmanda@.nospam-online.sbcglobal.net> wrote in message
> news:OBMImNsaGHA.1812@.TK2MSFTNGP04.phx.gbl...
> can
> the
> application:
> when
> can
>

permissions needed for executing stored procedures

We want to create a SQL login say user1 and the only privilges we want to
grant it is to be able to execute stored procedures in that database.
So is it just good enough to just do the following ?
Grant exec on sprocx to user1
Does this take care of conditions that include DMLs ( insert,updates,selects
and deletes) that are within the stored procedure ? What about creating temp
tables,etc. ?
Thanks
Yes, doing that is possible, if the owner of the stored procedure (other
than user1 in your example) is also the owner of the tables to do the INSERT,
DELETE, etc.
Take a look at Ownership Chains in BOL.
Hope this helps,
Ben Nevarez
Senior Database Administrator
AIG SunAmerica
"Hassan" wrote:

> We want to create a SQL login say user1 and the only privilges we want to
> grant it is to be able to execute stored procedures in that database.
> So is it just good enough to just do the following ?
> Grant exec on sprocx to user1
> Does this take care of conditions that include DMLs ( insert,updates,selects
> and deletes) that are within the stored procedure ? What about creating temp
> tables,etc. ?
> Thanks
>
|||Hassan (hassan@.test.com) writes:
> We want to create a SQL login say user1 and the only privilges we want to
> grant it is to be able to execute stored procedures in that database.
> So is it just good enough to just do the following ?
> Grant exec on sprocx to user1
> Does this take care of conditions that include DMLs (
> insert,updates,selects and deletes) that are within the stored procedure?
Yes, provided that the tables and the procedures have the same owner.
And provided that you don't engage in dynamic SQL.
Also beware that if your stored procedures goes beyond INSERT, UPDATE,
DELETE and SELECT, granting execution rights to the procedure is not
sufficient. However, SQL 2005 offers mechanisms that permit you to address
this. I have an article on by web site that discusses this in detail:
http://www.sommarskog.se/grantperm.html

> What about creating temp tables,etc. ?
Any user have the permission to create temp tables, stored procedures or
not.
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/prodtechnol/sql/2005/downloads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodinfo/previousversions/books.mspx

permissions needed for executing stored procedures

We want to create a SQL login say user1 and the only privilges we want to
grant it is to be able to execute stored procedures in that database.
So is it just good enough to just do the following ?
Grant exec on sprocx to user1
Does this take care of conditions that include DMLs ( insert,updates,selects
and deletes) that are within the stored procedure ? What about creating temp
tables,etc. ?
ThanksYes, doing that is possible, if the owner of the stored procedure (other
than user1 in your example) is also the owner of the tables to do the INSERT,
DELETE, etc.
Take a look at Ownership Chains in BOL.
Hope this helps,
Ben Nevarez
Senior Database Administrator
AIG SunAmerica
"Hassan" wrote:
> We want to create a SQL login say user1 and the only privilges we want to
> grant it is to be able to execute stored procedures in that database.
> So is it just good enough to just do the following ?
> Grant exec on sprocx to user1
> Does this take care of conditions that include DMLs ( insert,updates,selects
> and deletes) that are within the stored procedure ? What about creating temp
> tables,etc. ?
> Thanks
>|||Hassan (hassan@.test.com) writes:
> We want to create a SQL login say user1 and the only privilges we want to
> grant it is to be able to execute stored procedures in that database.
> So is it just good enough to just do the following ?
> Grant exec on sprocx to user1
> Does this take care of conditions that include DMLs (
> insert,updates,selects and deletes) that are within the stored procedure?
Yes, provided that the tables and the procedures have the same owner.
And provided that you don't engage in dynamic SQL.
Also beware that if your stored procedures goes beyond INSERT, UPDATE,
DELETE and SELECT, granting execution rights to the procedure is not
sufficient. However, SQL 2005 offers mechanisms that permit you to address
this. I have an article on by web site that discusses this in detail:
http://www.sommarskog.se/grantperm.html
> What about creating temp tables,etc. ?
Any user have the permission to create temp tables, stored procedures or
not.
--
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/prodtechnol/sql/2005/downloads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodinfo/previousversions/books.mspx

permissions needed for executing stored procedures

We want to create a SQL login say user1 and the only privilges we want to
grant it is to be able to execute stored procedures in that database.
So is it just good enough to just do the following ?
Grant exec on sprocx to user1
Does this take care of conditions that include DMLs ( insert,updates,selects
and deletes) that are within the stored procedure ? What about creating temp
tables,etc. ?
ThanksYes, doing that is possible, if the owner of the stored procedure (other
than user1 in your example) is also the owner of the tables to do the INSERT
,
DELETE, etc.
Take a look at Ownership Chains in BOL.
Hope this helps,
Ben Nevarez
Senior Database Administrator
AIG SunAmerica
"Hassan" wrote:

> We want to create a SQL login say user1 and the only privilges we want to
> grant it is to be able to execute stored procedures in that database.
> So is it just good enough to just do the following ?
> Grant exec on sprocx to user1
> Does this take care of conditions that include DMLs ( insert,updates,selec
ts
> and deletes) that are within the stored procedure ? What about creating te
mp
> tables,etc. ?
> Thanks
>|||Hassan (hassan@.test.com) writes:
> We want to create a SQL login say user1 and the only privilges we want to
> grant it is to be able to execute stored procedures in that database.
> So is it just good enough to just do the following ?
> Grant exec on sprocx to user1
> Does this take care of conditions that include DMLs (
> insert,updates,selects and deletes) that are within the stored procedure?
Yes, provided that the tables and the procedures have the same owner.
And provided that you don't engage in dynamic SQL.
Also beware that if your stored procedures goes beyond INSERT, UPDATE,
DELETE and SELECT, granting execution rights to the procedure is not
sufficient. However, SQL 2005 offers mechanisms that permit you to address
this. I have an article on by web site that discusses this in detail:
http://www.sommarskog.se/grantperm.html

> What about creating temp tables,etc. ?
Any user have the permission to create temp tables, stored procedures or
not.
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx

permissions for sp_OASetProperty

We have a request to be able to execute the following from an application:
declare @.languageValue varchar(1000)
exec sp_OASetProperty @.languageValue, 'CharSet', 'Shift-JIS'
Currently the developer is unable to because they get an "EXECUTE permission
denied on object 'sp_OASetProperty', database 'master', owner 'dbo'." when
running this.
We have no users (other than dbo & guest) in the master database. How can
this be setup with the least amount of permissions being given.
I appreciate any suggestions.
thanks
MeenalI answered your question in the security group.
Hope this helps.
Dan Guzman
SQL Server MVP
"Meenal Dhody" <meenal_dhody@.hotmail.com> wrote in message
news:eQW9OItaGHA.5108@.TK2MSFTNGP05.phx.gbl...
> We have a request to be able to execute the following from an application:
> declare @.languageValue varchar(1000)
> exec sp_OASetProperty @.languageValue, 'CharSet', 'Shift-JIS'
> Currently the developer is unable to because they get an "EXECUTE
> permission
> denied on object 'sp_OASetProperty', database 'master', owner 'dbo'." when
> running this.
> We have no users (other than dbo & guest) in the master database. How can
> this be setup with the least amount of permissions being given.
> I appreciate any suggestions.
> thanks
> Meenal
>
>
>
>

permissions for sp_OASetProperty

We have a request to be able to execute the following from an application:
declare @.languageValue varchar(1000)
exec sp_OASetProperty @.languageValue, 'CharSet', 'Shift-JIS'
Currently the developer is unable to because they get an "EXECUTE permission
denied on object 'sp_OASetProperty', database 'master', owner 'dbo'." when
running this.
We have no users (other than dbo & guest) in the master database. How can
this be setup with the least amount of permissions being given.
I appreciate any suggestions.
thanks
MeenalI answered your question in the security group.
--
Hope this helps.
Dan Guzman
SQL Server MVP
"Meenal Dhody" <meenal_dhody@.hotmail.com> wrote in message
news:eQW9OItaGHA.5108@.TK2MSFTNGP05.phx.gbl...
> We have a request to be able to execute the following from an application:
> declare @.languageValue varchar(1000)
> exec sp_OASetProperty @.languageValue, 'CharSet', 'Shift-JIS'
> Currently the developer is unable to because they get an "EXECUTE
> permission
> denied on object 'sp_OASetProperty', database 'master', owner 'dbo'." when
> running this.
> We have no users (other than dbo & guest) in the master database. How can
> this be setup with the least amount of permissions being given.
> I appreciate any suggestions.
> thanks
> Meenal
>
>
>
>

Permissions for running sp_Start_Job and xp_sqlagent_enum_jobs

Anybody know what permissions I need to give a user so
that they can execute msdb.dbo.sp_start_job and
xp_sqlagent_enum_jobs? I don't want to give them Admin
access..The user needs to own the job if you don't want them to be a
sysadmin.
-Sue
On Wed, 3 Sep 2003 08:21:05 -0700, "Rich"
<rslack@.asda.co.uk> wrote:
>Anybody know what permissions I need to give a user so
>that they can execute msdb.dbo.sp_start_job and
>xp_sqlagent_enum_jobs? I don't want to give them Admin
>access..

Permissions

If a person needs to see, modify, create, and execute stored procedures and
DTS Packages on SQL server, what would be the minimum set of permissions
using server roles or database roles to allow this to happen?
Message posted via http://www.droptable.com
2000: sysadmin.
2005: sysadmin or GRANT ALTER TRACE TO ...
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"Robert R via droptable.com" <u3288@.uwe> wrote in message news:570fb034e80e6@.uwe...
> If a person needs to see, modify, create, and execute stored procedures and
> DTS Packages on SQL server, what would be the minimum set of permissions
> using server roles or database roles to allow this to happen?
>
> --
> Message posted via http://www.droptable.com

Permissions

If a person needs to see, modify, create, and execute stored procedures and
DTS Packages on SQL server, what would be the minimum set of permissions
using server roles or database roles to allow this to happen?
Message posted via http://www.droptable.com2000: sysadmin.
2005: sysadmin or GRANT ALTER TRACE TO ...
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"Robert R via droptable.com" <u3288@.uwe> wrote in message news:570fb034e80e6@.uwe...eagreen">
> If a person needs to see, modify, create, and execute stored procedures an
d
> DTS Packages on SQL server, what would be the minimum set of permissions
> using server roles or database roles to allow this to happen?
>
> --
> Message posted via http://www.droptable.com

Permissions

If a person needs to see, modify, create, and execute stored procedures and
DTS Packages on SQL server, what would be the minimum set of permissions
using server roles or database roles to allow this to happen?
--
Message posted via http://www.sqlmonster.com2000: sysadmin.
2005: sysadmin or GRANT ALTER TRACE TO ...
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
Blog: http://solidqualitylearning.com/blogs/tibor/
"Robert R via SQLMonster.com" <u3288@.uwe> wrote in message news:570fb034e80e6@.uwe...
> If a person needs to see, modify, create, and execute stored procedures and
> DTS Packages on SQL server, what would be the minimum set of permissions
> using server roles or database roles to allow this to happen?
>
> --
> Message posted via http://www.sqlmonster.com

Permission/role needed to both modify and execute jobs

What SQL Server permission(s) are required to both modify and execute jobs in
SQL Server 2000 and SQL Server 2005?
Thank you.
--
MikeMike
You posted this in microsoft.public.sqlserver.security on 6 Jan, and
microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
John
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
> What SQL Server permission(s) are required to both modify and execute jobs
> in
> SQL Server 2000 and SQL Server 2005?
> Thank you.
> --
> Mike|||I don 't see an answer for SQL Server 2005 (please see below). Any help
would be appreciated. Thank you.
SQL Server 2005
1) I haven't played to much with this issue. If I remember well you can
create a proxy account to run jobs
with an acount that is not a member of sysadmin server role.
--
Mike
"John Bell" wrote:
> Mike
> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
> John
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
> > What SQL Server permission(s) are required to both modify and execute jobs
> > in
> > SQL Server 2000 and SQL Server 2005?
> >
> > Thank you.
> > --
> > Mike
>
>|||Additionally, if you would have read my new questions, you would have noticed
that they had changed from just run, to both modify and run/execute.
Thank you.
--
Mike
"John Bell" wrote:
> Mike
> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
> John
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
> > What SQL Server permission(s) are required to both modify and execute jobs
> > in
> > SQL Server 2000 and SQL Server 2005?
> >
> > Thank you.
> > --
> > Mike
>
>|||BOL for 2005 has lots of very good information on this subject. Much more
than you can expect someone to post here. There is no reason to reinvent the
wheel so have a look at this section of BOL for a start.
ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/d728a2f5-6a2d-40f7-aba7-ed51b930072d.htm
Andrew J. Kelly SQL MVP
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
>I don 't see an answer for SQL Server 2005 (please see below). Any help
> would be appreciated. Thank you.
> SQL Server 2005
> 1) I haven't played to much with this issue. If I remember well you can
> create a proxy account to run jobs
> with an acount that is not a member of sysadmin server role.
> --
> Mike
>
> "John Bell" wrote:
>> Mike
>> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
>> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
>> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
>> John
>> "Mike" <Mike@.discussions.microsoft.com> wrote in message
>> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
>> > What SQL Server permission(s) are required to both modify and execute
>> > jobs
>> > in
>> > SQL Server 2000 and SQL Server 2005?
>> >
>> > Thank you.
>> > --
>> > Mike
>>|||Are you a Microsoft employee? If not, I still don't have answers for the
question below. Microsoft, if you could please help, I would highly
appreciate it.
Are different permissions required to both modify and run SQL Server 2000
jobs and DTS packages?
Thank you.
--
Mike
"Andrew J. Kelly" wrote:
> BOL for 2005 has lots of very good information on this subject. Much more
> than you can expect someone to post here. There is no reason to reinvent the
> wheel so have a look at this section of BOL for a start.
> ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/d728a2f5-6a2d-40f7-aba7-ed51b930072d.htm
>
> --
> Andrew J. Kelly SQL MVP
>
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
> >I don 't see an answer for SQL Server 2005 (please see below). Any help
> > would be appreciated. Thank you.
> >
> > SQL Server 2005
> >
> > 1) I haven't played to much with this issue. If I remember well you can
> > create a proxy account to run jobs
> > with an acount that is not a member of sysadmin server role.
> > --
> > Mike
> >
> >
> > "John Bell" wrote:
> >
> >> Mike
> >>
> >> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
> >> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
> >> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
> >>
> >> John
> >>
> >> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> >> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
> >> > What SQL Server permission(s) are required to both modify and execute
> >> > jobs
> >> > in
> >> > SQL Server 2000 and SQL Server 2005?
> >> >
> >> > Thank you.
> >> > --
> >> > Mike
> >>
> >>
> >>
>
>|||What does my employment status have to do with if you have an answer or not?
You specifically stated that you needed an answer for SQL2005. This is from
your last post:
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
> >I don 't see an answer for SQL Server 2005 (please see below). Any help
> > would be appreciated. Thank you.
> >
And here is the answer that Allan Mitchell gave you in the DTS group that
you cross posted to.
Hello mike,
In 2K, So long as you can access the package you can change it.
In 2K5 a way of implementing security can be found here in BOL
ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/extran9/html/9702e90c-fada-4978-a473-1b1423017d80.htm
<<
You replied:
Thank you, and have a great weekend.
--
Mike
<<
So I am confused as to what you really want. Do you just not trust the
answers since we are not MS employees or is there something else?
Andrew J. Kelly SQL MVP
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:E42F971F-E556-4D5B-9203-2AF587D4A7A6@.microsoft.com...
> Are you a Microsoft employee? If not, I still don't have answers for the
> question below. Microsoft, if you could please help, I would highly
> appreciate it.
> Are different permissions required to both modify and run SQL Server 2000
> jobs and DTS packages?
> Thank you.
> --
> Mike
>
> "Andrew J. Kelly" wrote:
>> BOL for 2005 has lots of very good information on this subject. Much
>> more
>> than you can expect someone to post here. There is no reason to reinvent
>> the
>> wheel so have a look at this section of BOL for a start.
>> ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/d728a2f5-6a2d-40f7-aba7-ed51b930072d.htm
>>
>> --
>> Andrew J. Kelly SQL MVP
>>
>> "Mike" <Mike@.discussions.microsoft.com> wrote in message
>> news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
>> >I don 't see an answer for SQL Server 2005 (please see below). Any help
>> > would be appreciated. Thank you.
>> >
>> > SQL Server 2005
>> >
>> > 1) I haven't played to much with this issue. If I remember well you can
>> > create a proxy account to run jobs
>> > with an acount that is not a member of sysadmin server role.
>> > --
>> > Mike
>> >
>> >
>> > "John Bell" wrote:
>> >
>> >> Mike
>> >>
>> >> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
>> >> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to
>> >> this.
>> >> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
>> >>
>> >> John
>> >>
>> >> "Mike" <Mike@.discussions.microsoft.com> wrote in message
>> >> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
>> >> > What SQL Server permission(s) are required to both modify and
>> >> > execute
>> >> > jobs
>> >> > in
>> >> > SQL Server 2000 and SQL Server 2005?
>> >> >
>> >> > Thank you.
>> >> > --
>> >> > Mike
>> >>
>> >>
>> >>
>>|||The BOL link that Andy posted has 100% of the information you are looking
for in it. Microsoft spends millions on writing BOL, so that answers to at
least 80% or more of the questions that could get asked are already
answered, as long as people actually read it.
Someone's employment status has absolutely nothing whatsoever to do with
posting an answer. No, Andy isn't a Microsoft employee and that is
completely irrelevant. He is a SQL Server MVP and has been for a long time.
The MVP program was created to provide online support for customers of
products. With a few exceptions, the people in the MVP program are the best
information resources that exist in the industry.
If you want anyone to actually answer your questions, then I'd suggest that
you don't insult people who take their time to answer questions.
--
Mike
Mentor
Solid Quality Learning
http://www.solidqualitylearning.com
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:E42F971F-E556-4D5B-9203-2AF587D4A7A6@.microsoft.com...
> Are you a Microsoft employee? If not, I still don't have answers for the
> question below. Microsoft, if you could please help, I would highly
> appreciate it.
> Are different permissions required to both modify and run SQL Server 2000
> jobs and DTS packages?
> Thank you.
> --
> Mike
>
> "Andrew J. Kelly" wrote:
>> BOL for 2005 has lots of very good information on this subject. Much
>> more
>> than you can expect someone to post here. There is no reason to reinvent
>> the
>> wheel so have a look at this section of BOL for a start.
>> ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/d728a2f5-6a2d-40f7-aba7-ed51b930072d.htm
>>
>> --
>> Andrew J. Kelly SQL MVP
>>
>> "Mike" <Mike@.discussions.microsoft.com> wrote in message
>> news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
>> >I don 't see an answer for SQL Server 2005 (please see below). Any help
>> > would be appreciated. Thank you.
>> >
>> > SQL Server 2005
>> >
>> > 1) I haven't played to much with this issue. If I remember well you can
>> > create a proxy account to run jobs
>> > with an acount that is not a member of sysadmin server role.
>> > --
>> > Mike
>> >
>> >
>> > "John Bell" wrote:
>> >
>> >> Mike
>> >>
>> >> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
>> >> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to
>> >> this.
>> >> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
>> >>
>> >> John
>> >>
>> >> "Mike" <Mike@.discussions.microsoft.com> wrote in message
>> >> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
>> >> > What SQL Server permission(s) are required to both modify and
>> >> > execute
>> >> > jobs
>> >> > in
>> >> > SQL Server 2000 and SQL Server 2005?
>> >> >
>> >> > Thank you.
>> >> > --
>> >> > Mike
>> >>
>> >>
>> >>
>>

Permission/role needed to both modify and execute jobs

What SQL Server permission(s) are required to both modify and execute jobs in
SQL Server 2000 and SQL Server 2005?
Thank you.
Mike
Mike
You posted this in microsoft.public.sqlserver.security on 6 Jan, and
microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
John
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
> What SQL Server permission(s) are required to both modify and execute jobs
> in
> SQL Server 2000 and SQL Server 2005?
> Thank you.
> --
> Mike
|||I don 't see an answer for SQL Server 2005 (please see below). Any help
would be appreciated. Thank you.
SQL Server 2005
1) I haven't played to much with this issue. If I remember well you can
create a proxy account to run jobs
with an acount that is not a member of sysadmin server role.
Mike
"John Bell" wrote:

> Mike
> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
> John
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
>
>
|||Additionally, if you would have read my new questions, you would have noticed
that they had changed from just run, to both modify and run/execute.
Thank you.
Mike
"John Bell" wrote:

> Mike
> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
> John
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
>
>
|||BOL for 2005 has lots of very good information on this subject. Much more
than you can expect someone to post here. There is no reason to reinvent the
wheel so have a look at this section of BOL for a start.
ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/d728a2f5-6a2d-40f7-aba7-ed51b930072d.htm
Andrew J. Kelly SQL MVP
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...[vbcol=seagreen]
>I don 't see an answer for SQL Server 2005 (please see below). Any help
> would be appreciated. Thank you.
> SQL Server 2005
> 1) I haven't played to much with this issue. If I remember well you can
> create a proxy account to run jobs
> with an acount that is not a member of sysadmin server role.
> --
> Mike
>
> "John Bell" wrote:
|||Are you a Microsoft employee? If not, I still don't have answers for the
question below. Microsoft, if you could please help, I would highly
appreciate it.
Are different permissions required to both modify and run SQL Server 2000
jobs and DTS packages?
Thank you.
Mike
"Andrew J. Kelly" wrote:

> BOL for 2005 has lots of very good information on this subject. Much more
> than you can expect someone to post here. There is no reason to reinvent the
> wheel so have a look at this section of BOL for a start.
> ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/d728a2f5-6a2d-40f7-aba7-ed51b930072d.htm
>
> --
> Andrew J. Kelly SQL MVP
>
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
>
>
|||What does my employment status have to do with if you have an answer or not?
You specifically stated that you needed an answer for SQL2005. This is from
your last post:
[vbcol=seagreen]
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
And here is the answer that Allan Mitchell gave you in the DTS group that
you cross posted to.
[vbcol=seagreen]
Hello mike,
In 2K, So long as you can access the package you can change it.
In 2K5 a way of implementing security can be found here in BOL
ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/extran9/html/9702e90c-fada-4978-a473-1b1423017d80.htm
<<
You replied:
[vbcol=seagreen]
Thank you, and have a great weekend.
Mike
<<
So I am confused as to what you really want. Do you just not trust the
answers since we are not MS employees or is there something else?
Andrew J. Kelly SQL MVP
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:E42F971F-E556-4D5B-9203-2AF587D4A7A6@.microsoft.com...[vbcol=seagreen]
> Are you a Microsoft employee? If not, I still don't have answers for the
> question below. Microsoft, if you could please help, I would highly
> appreciate it.
> Are different permissions required to both modify and run SQL Server 2000
> jobs and DTS packages?
> Thank you.
> --
> Mike
>
> "Andrew J. Kelly" wrote:
|||The BOL link that Andy posted has 100% of the information you are looking
for in it. Microsoft spends millions on writing BOL, so that answers to at
least 80% or more of the questions that could get asked are already
answered, as long as people actually read it.
Someone's employment status has absolutely nothing whatsoever to do with
posting an answer. No, Andy isn't a Microsoft employee and that is
completely irrelevant. He is a SQL Server MVP and has been for a long time.
The MVP program was created to provide online support for customers of
products. With a few exceptions, the people in the MVP program are the best
information resources that exist in the industry.
If you want anyone to actually answer your questions, then I'd suggest that
you don't insult people who take their time to answer questions.
Mike
Mentor
Solid Quality Learning
http://www.solidqualitylearning.com
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:E42F971F-E556-4D5B-9203-2AF587D4A7A6@.microsoft.com...[vbcol=seagreen]
> Are you a Microsoft employee? If not, I still don't have answers for the
> question below. Microsoft, if you could please help, I would highly
> appreciate it.
> Are different permissions required to both modify and run SQL Server 2000
> jobs and DTS packages?
> Thank you.
> --
> Mike
>
> "Andrew J. Kelly" wrote:

Permission/role needed to both modify and execute jobs

What SQL Server permission(s) are required to both modify and execute jobs i
n
SQL Server 2000 and SQL Server 2005?
Thank you.
--
MikeMike
You posted this in microsoft.public.sqlserver.security on 6 Jan, and
microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
John
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
> What SQL Server permission(s) are required to both modify and execute jobs
> in
> SQL Server 2000 and SQL Server 2005?
> Thank you.
> --
> Mike|||I don 't see an answer for SQL Server 2005 (please see below). Any help
would be appreciated. Thank you.
SQL Server 2005
1) I haven't played to much with this issue. If I remember well you can
create a proxy account to run jobs
with an acount that is not a member of sysadmin server role.
--
Mike
"John Bell" wrote:

> Mike
> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
> John
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
>
>|||Additionally, if you would have read my new questions, you would have notice
d
that they had changed from just run, to both modify and run/execute.
Thank you.
--
Mike
"John Bell" wrote:

> Mike
> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
> John
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
>
>|||BOL for 2005 has lots of very good information on this subject. Much more
than you can expect someone to post here. There is no reason to reinvent the
wheel so have a look at this section of BOL for a start.
ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/d728a2f5-6a2d-40f7-aba7-ed51
b930072d.htm
Andrew J. Kelly SQL MVP
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...[vbcol=seagreen]
>I don 't see an answer for SQL Server 2005 (please see below). Any help
> would be appreciated. Thank you.
> SQL Server 2005
> 1) I haven't played to much with this issue. If I remember well you can
> create a proxy account to run jobs
> with an acount that is not a member of sysadmin server role.
> --
> Mike
>
> "John Bell" wrote:
>|||Are you a Microsoft employee? If not, I still don't have answers for the
question below. Microsoft, if you could please help, I would highly
appreciate it.
Are different permissions required to both modify and run SQL Server 2000
jobs and DTS packages?
Thank you.
--
Mike
"Andrew J. Kelly" wrote:

> BOL for 2005 has lots of very good information on this subject. Much more
> than you can expect someone to post here. There is no reason to reinvent t
he
> wheel so have a look at this section of BOL for a start.
> ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/d728a2f5-6a2d-40f7-aba7-ed
51b930072d.htm
>
> --
> Andrew J. Kelly SQL MVP
>
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
>
>|||What does my employment status have to do with if you have an answer or not?
You specifically stated that you needed an answer for SQL2005. This is from
your last post:
[vbcol=seagreen]
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
And here is the answer that Allan Mitchell gave you in the DTS group that
you cross posted to.
[vbcol=seagreen]
Hello mike,
In 2K, So long as you can access the package you can change it.
In 2K5 a way of implementing security can be found here in BOL
ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/extran9/html/9702e90c-fada-4978-a473-1
b1423017d80.htm
<<
You replied:
[vbcol=seagreen]
Thank you, and have a great weekend.
--
Mike
<<
So I am confused as to what you really want. Do you just not trust the
answers since we are not MS employees or is there something else?
Andrew J. Kelly SQL MVP
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:E42F971F-E556-4D5B-9203-2AF587D4A7A6@.microsoft.com...[vbcol=seagreen]
> Are you a Microsoft employee? If not, I still don't have answers for the
> question below. Microsoft, if you could please help, I would highly
> appreciate it.
> Are different permissions required to both modify and run SQL Server 2000
> jobs and DTS packages?
> Thank you.
> --
> Mike
>
> "Andrew J. Kelly" wrote:
>|||The BOL link that Andy posted has 100% of the information you are looking
for in it. Microsoft spends millions on writing BOL, so that answers to at
least 80% or more of the questions that could get asked are already
answered, as long as people actually read it.
Someone's employment status has absolutely nothing whatsoever to do with
posting an answer. No, Andy isn't a Microsoft employee and that is
completely irrelevant. He is a SQL Server MVP and has been for a long time.
The MVP program was created to provide online support for customers of
products. With a few exceptions, the people in the MVP program are the best
information resources that exist in the industry.
If you want anyone to actually answer your questions, then I'd suggest that
you don't insult people who take their time to answer questions.
Mike
Mentor
Solid Quality Learning
http://www.solidqualitylearning.com
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:E42F971F-E556-4D5B-9203-2AF587D4A7A6@.microsoft.com...[vbcol=seagreen]
> Are you a Microsoft employee? If not, I still don't have answers for the
> question below. Microsoft, if you could please help, I would highly
> appreciate it.
> Are different permissions required to both modify and run SQL Server 2000
> jobs and DTS packages?
> Thank you.
> --
> Mike
>
> "Andrew J. Kelly" wrote:
>

Permission to execute Stored Procedure

Which fixed database role allows a user to execute a user defined stored procedure while minimizing the amount of permissions given. I think db_Datareader will do the trick.Sorry, but db_datareader doesn't have permission to execute ANY stored procedures, although they can read any table or view (more accurately, db_datareaders has SELECT permissions on every object in the database).

The only group that has execute permissions on all of the objects in a database is db_owner. That's WAY too big a hammer to swing without considerable forethought, since it gives the user the "keys to the kingdom" as far as that database is concerned. They can do anything they please with any object in the database, which is a lot more than what you probably intended.

One crude way to work around this might be to create a db_runner group within your database, and schedule a job to grant permission to that group to execute every procedure and function in your database. You could run the job every few minutes, and get 99% of what you are looking for, and you could also exclude objects within your GRANT script if you see fit.

-PatP