Permissions with Windows groups and view to other databases

I am having a problem with permissions using Windows groups. I have a database (database1) that has permissions granted via Windows groups. Two groups (group1 and group2) are members of the db_datareader role in database1, and this work fine. Do to the number of tables that get created during our work, using db_datareader is the easiest way to keep up with permissions without creating a maintenance problem. Now I have a table that I want to add to this database, but I only want group2 to have select permission on this one table which is a problem because group1 has the db_datareader role. So I thought I could create a view in this database to the restricted table that I put in database2. Then in database2 I only added group2 as a user with the permission to select from this table. Unfortunately the group membership does not seem to get interpretted correctly in database2 and no one can successfult select from the view in database1.

In other words, user1 who belongs to group1 connects to database1 and cannot select from the restricted view -- this is what I would expect. However, when user2 who belongs to group2 connects to database1 they also cannot select from the restricted view -- not the behvior I would expect. Now, if I make user2 a user in database2 with select on the restricted table then user2 can connect to database1 and successfuly get data from the restricted view. So it looks like the fact that user2 belongs to group2 is never passed to database2 via the select from the view on database1. Is this indeed the way that Windows group security is working or is meant to work in SQL Server?

I realize I could solve this simplified version of the problem by creating my own role in database1 for group1 etc., but I am trying to solve a bigger problem in our environment that has hundreds of databases across numerous servers.

Thanks

Rob

Why not simply deny SELECT permission to group1 for that particular table? The rule that you need to remember is that a deny will trump a grant, so the deny will take precedence over the db_datareader membership.

Thanks

Laurentiu

|||Well, that won't quite work. The two Windows groups we are talking about have some overlapping members, but one group is not a complete subset of the other. So if I deny SELECT to group1 then some people that I want to access the data (group2) because they are in both groups and as you point out deny has a higher priority. Is there any reason group permissions are not valid in database2 when selecting from the view in database1?|||

This is the expected behavior; but it sounds like you may be trying to attempt cross-database ownership chaining (also known as CDOC, look for “Using ownership chains” topic in BOL). CDOC is a feature that is disabled by default and we recommend against using it because of the security risks inherent from this feature. For more information on CDOC look for “Using ownership chains” topic in BOL.

The reason why user2 is failing to access the table is that there is a separate user token for database1 and database2 (both derived from the same Windows login token). On database1 the user2 token will look similar to this:

Primary identity:

· user2, Windows user

Secondary identities:

· group2, Windows group

· db_datareader, role

When accessing the view, the permissions are checked against this token, and they will succeed, but the view is making reference to database2.<some_schema>.restricted_table, therefore it is necessary to create a token for database2.

On your first attempt (without creating a user in Database2, and granting permission to access the table) the user token creation process for database2 should have failed with a “user cannot access this database”-type of error.

Here are a few potential workarounds that may help you:

Instead of using db_datareader you can use different schemas and grant SELECT based on the schemas to differentiate groups, for example:

GRANT SELECT ON SCHEMA::[Schema_group1] TO group1

GRANT SELECT ON SCHEMA::[Schema_group2] TO group2

GRANT SELECT ON SCHEMA::[Schema_all] TO group1, group2

That way the SELECT permission would be restricted to only the schemas you defined.

Another alternative for cross-DB access could be using signatures, similar to the one I described in the following article: http://blogs.msdn.com/raulga/archive/2006/10/30/using-a-digital-signature-as-a-secondary-identity-to-replace-cross-database-ownership-chaining.aspx

Please, let us know if any of this alternatives worked for you or if you have any additional questions.

Thanks a lot,

-Raul Garcia

SDE/T

SQL Server Engine

Permissions with Windows groups and view to other databases

I am having a problem with permissions using Windows groups. I have a database (database1) that has permissions granted via Windows groups. Two groups (group1 and group2) are members of the db_datareader role in database1, and this work fine. Do to the number of tables that get created during our work, using db_datareader is the easiest way to keep up with permissions without creating a maintenance problem. Now I have a table that I want to add to this database, but I only want group2 to have select permission on this one table which is a problem because group1 has the db_datareader role. So I thought I could create a view in this database to the restricted table that I put in database2. Then in database2 I only added group2 as a user with the permission to select from this table. Unfortunately the group membership does not seem to get interpretted correctly in database2 and no one can successfult select from the view in database1.

In other words, user1 who belongs to group1 connects to database1 and cannot select from the restricted view -- this is what I would expect. However, when user2 who belongs to group2 connects to database1 they also cannot select from the restricted view -- not the behvior I would expect. Now, if I make user2 a user in database2 with select on the restricted table then user2 can connect to database1 and successfuly get data from the restricted view. So it looks like the fact that user2 belongs to group2 is never passed to database2 via the select from the view on database1. Is this indeed the way that Windows group security is working or is meant to work in SQL Server?

I realize I could solve this simplified version of the problem by creating my own role in database1 for group1 etc., but I am trying to solve a bigger problem in our environment that has hundreds of databases across numerous servers.

Thanks

Rob

Why not simply deny SELECT permission to group1 for that particular table? The rule that you need to remember is that a deny will trump a grant, so the deny will take precedence over the db_datareader membership.

Thanks

Laurentiu

|||Well, that won't quite work. The two Windows groups we are talking about have some overlapping members, but one group is not a complete subset of the other. So if I deny SELECT to group1 then some people that I want to access the data (group2) because they are in both groups and as you point out deny has a higher priority. Is there any reason group permissions are not valid in database2 when selecting from the view in database1?|||

This is the expected behavior; but it sounds like you may be trying to attempt cross-database ownership chaining (also known as CDOC, look for “Using ownership chains” topic in BOL). CDOC is a feature that is disabled by default and we recommend against using it because of the security risks inherent from this feature. For more information on CDOC look for “Using ownership chains” topic in BOL.

The reason why user2 is failing to access the table is that there is a separate user token for database1 and database2 (both derived from the same Windows login token). On database1 the user2 token will look similar to this:

Primary identity:

· user2, Windows user

Secondary identities:

· group2, Windows group

· db_datareader, role

When accessing the view, the permissions are checked against this token, and they will succeed, but the view is making reference to database2.<some_schema>.restricted_table, therefore it is necessary to create a token for database2.

On your first attempt (without creating a user in Database2, and granting permission to access the table) the user token creation process for database2 should have failed with a “user cannot access this database”-type of error.

Here are a few potential workarounds that may help you:

Instead of using db_datareader you can use different schemas and grant SELECT based on the schemas to differentiate groups, for example:

GRANT SELECT ON SCHEMA::[Schema_group1] TO group1

GRANT SELECT ON SCHEMA::[Schema_group2] TO group2

GRANT SELECT ON SCHEMA::[Schema_all] TO group1, group2

That way the SELECT permission would be restricted to only the schemas you defined.

Another alternative for cross-DB access could be using signatures, similar to the one I described in the following article: http://blogs.msdn.com/raulga/archive/2006/10/30/using-a-digital-signature-as-a-secondary-identity-to-replace-cross-database-ownership-chaining.aspx

Please, let us know if any of this alternatives worked for you or if you have any additional questions.

Thanks a lot,

-Raul Garcia

SDE/T

SQL Server Engine

permissions via roles query (SQL Server 2000)

Is anybody willing to share a query which shows all permissions granted
to a user, including permissions granted via roles? The complexity is
that a role can be granted to a role, and therefore this becomes a
bill-of-materials explosion / tree hierarchy / adjacency list problem.
Example:
create role r1
grant select on t1 to r1
grant select on t2 to r1
create role r2
grant select on t3 to r2
grant select on t4 to r2
create role r3
grant r1 to r3
grant r2 to r3
grant r3 to user1
The end result is that you want to be able to see that user1 has select
on t1, t2, t3, t4. An added bonus would be able to see the lineage.
I have found general discussion about solving these kinds of problems.
I'm curious if anybody has a working example for permissions and roles
in SQLServer 2000.sp_helprotect
<rc8740@.netscape.net> wrote in message
news:1149690495.671940.102730@.i39g2000cwa.googlegroups.com...
> Is anybody willing to share a query which shows all permissions granted
> to a user, including permissions granted via roles? The complexity is
> that a role can be granted to a role, and therefore this becomes a
> bill-of-materials explosion / tree hierarchy / adjacency list problem.
> Example:
> create role r1
> grant select on t1 to r1
> grant select on t2 to r1
> create role r2
> grant select on t3 to r2
> grant select on t4 to r2
> create role r3
> grant r1 to r3
> grant r2 to r3
> grant r3 to user1
> The end result is that you want to be able to see that user1 has select
> on t1, t2, t3, t4. An added bonus would be able to see the lineage.
> I have found general discussion about solving these kinds of problems.
> I'm curious if anybody has a working example for permissions and roles
> in SQLServer 2000.
>|||There are some good ones up on sqlservercentral.com
It sounds like you may be looking for one like this one:
http://www.sqlservercentral.com/scr...butions/268.asp
-Sue
On 7 Jun 2006 07:28:15 -0700, rc8740@.netscape.net wrote:

>Is anybody willing to share a query which shows all permissions granted
>to a user, including permissions granted via roles? The complexity is
>that a role can be granted to a role, and therefore this becomes a
>bill-of-materials explosion / tree hierarchy / adjacency list problem.
>Example:
>create role r1
>grant select on t1 to r1
>grant select on t2 to r1
>create role r2
>grant select on t3 to r2
>grant select on t4 to r2
>create role r3
>grant r1 to r3
>grant r2 to r3
>grant r3 to user1
>The end result is that you want to be able to see that user1 has select
>on t1, t2, t3, t4. An added bonus would be able to see the lineage.
>I have found general discussion about solving these kinds of problems.
>I'm curious if anybody has a working example for permissions and roles
>in SQLServer 2000.|||There are some good ones up on sqlservercentral.com
It sounds like you may be looking for one like this one:
http://www.sqlservercentral.com/scr...butions/268.asp
-Sue
On 7 Jun 2006 07:28:15 -0700, rc8740@.netscape.net wrote:

>Is anybody willing to share a query which shows all permissions granted
>to a user, including permissions granted via roles? The complexity is
>that a role can be granted to a role, and therefore this becomes a
>bill-of-materials explosion / tree hierarchy / adjacency list problem.
>Example:
>create role r1
>grant select on t1 to r1
>grant select on t2 to r1
>create role r2
>grant select on t3 to r2
>grant select on t4 to r2
>create role r3
>grant r1 to r3
>grant r2 to r3
>grant r3 to user1
>The end result is that you want to be able to see that user1 has select
>on t1, t2, t3, t4. An added bonus would be able to see the lineage.
>I have found general discussion about solving these kinds of problems.
>I'm curious if anybody has a working example for permissions and roles
>in SQLServer 2000.|||I was really hopeful when I found this...but I'm getting zero records when
I run the SP created by the script.... any other tools or suggestions?
Thanks.
Neil
"Sue Hoegemeier" <Sue_H@.nomail.please> wrote in message
news:u7sr8217iivmuojp2cq7msh6mc7vplde0f@.
4ax.com...
> There are some good ones up on sqlservercentral.com
> It sounds like you may be looking for one like this one:
> http://www.sqlservercentral.com/scr...butions/268.asp
> -Sue
> On 7 Jun 2006 07:28:15 -0700, rc8740@.netscape.net wrote:
>
>|||I was really hopeful when I found this...but I'm getting zero records when
I run the SP created by the script.... any other tools or suggestions?
Thanks.
Neil
"Sue Hoegemeier" <Sue_H@.nomail.please> wrote in message
news:u7sr8217iivmuojp2cq7msh6mc7vplde0f@.
4ax.com...
> There are some good ones up on sqlservercentral.com
> It sounds like you may be looking for one like this one:
> http://www.sqlservercentral.com/scr...butions/268.asp
> -Sue
> On 7 Jun 2006 07:28:15 -0700, rc8740@.netscape.net wrote:
>
>

permissions to run sp_configure

Is possible to run sp_configure 'allow updates',1 by user
who is not granted sysadmin role?Yes, the servadmin role also has permissions. Here's the check inside
sp_configure:
if (not is_srvrolemember('serveradmin') = 1)
begin
raiserror(15247,-1,-1)
return (1)
end
Also, for this to be in effect, you need to run RECONFIGURE as well, and
according to BOL:
RECONFIGURE permissions default to members of the sysadmin and serveradmin
fixed server roles, and are not transferable.
--
Tibor Karaszi
"kim" <anonymous@.discussions.microsoft.com> wrote in message
news:040c01c3a31d$56d95a90$a401280a@.phx.gbl...
> Is possible to run sp_configure 'allow updates',1 by user
> who is not granted sysadmin role?

Permissions on views

Although I have granted select permissions on the views in my database that
are the recordesource for reports in a visual basic application, I cannot
open the reports from the application. I get the VB error 1005 ("can't open
recordset"). It would seem to be a permissions problem because everything
else in the app works fine except the reports that are based on views. I
haven't found anything in Books on Line that has solved the problem. The D
B
was developed in sql 2000 and the compatability level for this DB in sql 200
5
is 80. I'm grateful for any help.Pam
Make sure that you connect with the "right" user from application to run
reports.
Why do you have 80 compatibilty level for SQL Server 2005?
"Pam Davey" <PamDavey@.discussions.microsoft.com> wrote in message
news:16199EB3-EC0B-4A5E-B68F-1EEF73DDDF60@.microsoft.com...
> Although I have granted select permissions on the views in my database
> that
> are the recordesource for reports in a visual basic application, I cannot
> open the reports from the application. I get the VB error 1005 ("can't
> open
> recordset"). It would seem to be a permissions problem because everything
> else in the app works fine except the reports that are based on views. I
> haven't found anything in Books on Line that has solved the problem. The
> DB
> was developed in sql 2000 and the compatability level for this DB in sql
> 2005
> is 80. I'm grateful for any help.|||Hi!
Create view with view_metadata attribute.
Micle.
"Pam Davey" <PamDavey@.discussions.microsoft.com> wrote in message
news:16199EB3-EC0B-4A5E-B68F-1EEF73DDDF60@.microsoft.com...
> Although I have granted select permissions on the views in my database
> that
> are the recordesource for reports in a visual basic application, I cannot
> open the reports from the application. I get the VB error 1005 ("can't
> open
> recordset"). It would seem to be a permissions problem because everything
> else in the app works fine except the reports that are based on views. I
> haven't found anything in Books on Line that has solved the problem. The
> DB
> was developed in sql 2000 and the compatability level for this DB in sql
> 2005
> is 80. I'm grateful for any help.|||Hi Uri-
Thank you. I am connecting with the correct user. I have the database of
interset that resides on SQL Server 2005 set to compatability level 80 so
that it will have backward compatability with SQL server 2000 on which it wa
s
developed.
"Uri Dimant" wrote:

> Pam
> Make sure that you connect with the "right" user from application to run
> reports.
> Why do you have 80 compatibilty level for SQL Server 2005?
>
> "Pam Davey" <PamDavey@.discussions.microsoft.com> wrote in message
> news:16199EB3-EC0B-4A5E-B68F-1EEF73DDDF60@.microsoft.com...
>
>|||Hi Micle-
Thank you for your input. Unfortunely, it didn't seem to make any
difference. I get the same error. Oddly, I can get to all the underlying
tables that make up the view. I just can't get to the view, even when it's
created as you suggested.
"Micle" wrote:

> Hi!
> Create view with view_metadata attribute.
> Micle.
>
> "Pam Davey" <PamDavey@.discussions.microsoft.com> wrote in message
> news:16199EB3-EC0B-4A5E-B68F-1EEF73DDDF60@.microsoft.com...
>
>|||Pam Davey (PamDavey@.discussions.microsoft.com) writes:
> Although I have granted select permissions on the views in my database
> that are the recordesource for reports in a visual basic application, I
> cannot open the reports from the application. I get the VB error 1005
> ("can't open recordset"). It would seem to be a permissions problem
> because everything else in the app works fine except the reports that
> are based on views. I haven't found anything in Books on Line that has
> solved the problem. The DB was developed in sql 2000 and the
> compatability level for this DB in sql 2005 is 80. I'm grateful for any
> help.
Do the reports work when you run it on SQL 2000? Hav you verified that the
queries work when you run them from Query Analyzer or Management Studio.
Could you post the code you are using?
I would not expect a permissons problem, unless you are doing a poor job
of handling errors from SQL server. Nevertheless, here is a kind of shot
in the dark that you can try:
GRANT VIEW DEFINITION ON SCHEMA::dbo TO <user>
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx|||Thanks for your help Erland. Yes, the queries work in SQL 2000 as well as
when run from the Query Analyzer and Management Studio.
There's very little code actually. I have a 3rd party report control from
Component One that renders reports from report definitions stored in an xml
file. I've checked the xml file and the various report definitions within th
e
file have the correct queries named as their recordsource.
Thanks for the "GRANT..." thought. Didn't make a difference though. Still, I
appreciate your help.
"Erland Sommarskog" wrote:

> Pam Davey (PamDavey@.discussions.microsoft.com) writes:
> Do the reports work when you run it on SQL 2000? Hav you verified that the
> queries work when you run them from Query Analyzer or Management Studio.
> Could you post the code you are using?
> I would not expect a permissons problem, unless you are doing a poor job
> of handling errors from SQL server. Nevertheless, here is a kind of shot
> in the dark that you can try:
> GRANT VIEW DEFINITION ON SCHEMA::dbo TO <user>
>
> --
> Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
> Books Online for SQL Server 2005 at
> http://www.microsoft.com/technet/pr...oads/books.mspx
> Books Online for SQL Server 2000 at
> http://www.microsoft.com/sql/prodin...ions/books.mspx
>|||Pam Davey (PamDavey@.discussions.microsoft.com) writes:
> Thanks for your help Erland. Yes, the queries work in SQL 2000 as well as
> when run from the Query Analyzer and Management Studio.
> There's very little code actually. I have a 3rd party report control
> from Component One that renders reports from report definitions stored
> in an xml file. I've checked the xml file and the various report
> definitions within the file have the correct queries named as their
> recordsource.
> Thanks for the "GRANT..." thought. Didn't make a difference though.
> Still, I appreciate your help.
I'm afraid that there is very little to work on. Maybe the best is to
contact the vendor.
All I can really suggest is to use Profiler to eavesdrop on what the
report tool sends to SQL Server. You can include Error events in
the trace, so you can see if any errors are reported.
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx|||Okay, I'll give it a try. Thank you again.
"Erland Sommarskog" wrote:

> Pam Davey (PamDavey@.discussions.microsoft.com) writes:
> I'm afraid that there is very little to work on. Maybe the best is to
> contact the vendor.
> All I can really suggest is to use Profiler to eavesdrop on what the
> report tool sends to SQL Server. You can include Error events in
> the trace, so you can see if any errors are reported.
> --
> Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
> Books Online for SQL Server 2005 at
> http://www.microsoft.com/technet/pr...oads/books.mspx
> Books Online for SQL Server 2000 at
> http://www.microsoft.com/sql/prodin...ions/books.mspx
>|||"Pam Davey" <PamDavey@.discussions.microsoft.com> wrote in message
news:DEB58306-AC92-45FA-A657-A08EA6CD6D2A@.microsoft.com...[vbcol=seagreen]
> Okay, I'll give it a try. Thank you again.
> "Erland Sommarskog" wrote:
>
A good reality check would be to execute the application under an account
that's an admin (as in NT account that is a member of the sysadmin fixed
server role) on the SQL box. If it still doesn't work, the reason is not
permissions! If it does work under admin privileges, the next reality check
might be to grant all to guest; if that works revoke the last grant and
grant all to public.
Another tactic would be to write a quickie script to open a recordset on
that view, and execute it from an end-user-level login context -- that will
allow you to see any error output that the report control may be eating.
Divide and conquer, that's the game. :-)
Good Luck,
Mark
[vbcol=seagreen]

permissions mystery: ActiveDirectory issue?

I don't see why my user cannot see a view when she can see the tables that
underlie it and has also been granted select permission on the view.
exec sp_grantlogin [OURDOMAIN\user99]
exec sp_grantdbaccess [OURDOMAIN\user99], 'SARAH'
exec sp_addrole 'TheRole'
exec sp_addrolemember 'TheRole', 'SARAH'create view TestView
as select * from table1
inner join table2
on t1.id = t2.anotherid
grant select on table1 to TheRole
grant select on table2 to TheRole
grant select on TestView to TheRole
User SARAH can see the tables but not the view.
We're using SQL Server 2000 and Windows 2003 Server with ActiveDirectory.
Thanks
TimoI've installed Query Analyzer on the user's desktop, and she CAN see the
view. So the problem has to do with the client application (Access 2000 ADP)
and/or ActiveDirectory. Our domain admin put the Access 2000 ADP on his PC
and he can see the view fine.
Timo
"Timo" <Timo@.unspam.biz> wrote in message
news:eRc2XxAeFHA.2420@.TK2MSFTNGP12.phx.gbl...
> I don't see why my user cannot see a view when she can see the tables that
> underlie it and has also been granted select permission on the view.
> exec sp_grantlogin [OURDOMAIN\user99]
> exec sp_grantdbaccess [OURDOMAIN\user99], 'SARAH'
> exec sp_addrole 'TheRole'
> exec sp_addrolemember 'TheRole', 'SARAH'create view TestView
> as select * from table1
> inner join table2
> on t1.id = t2.anotherid
>
> grant select on table1 to TheRole
> grant select on table2 to TheRole
> grant select on TestView to TheRole
> User SARAH can see the tables but not the view.
> We're using SQL Server 2000 and Windows 2003 Server with ActiveDirectory.
> Thanks
> Timo
>

permissions granted to user 'NT AUTHORITY\NETWORK SERVICE' are ins

I am trying to read the WebServices to gather information about the catalog.
When I run the application from my development box and reading from the
Reporting Services server for the Catalog all run fine.
But when I transfer the application (asp.net) to the server it fails with:
System.Web.Services.Protocols.SoapException: The permissions granted to user
'NT AUTHORITY\NETWORK SERVICE' are insufficient for performing this
operation. -->
Microsoft.ReportingServices.Diagnostics.Utilities.AccessDeniedException: The
permissions granted to user 'NT AUTHORITY\NETWORK SERVICE' are insufficient
for performing this operation. at
Microsoft.ReportingServices.Library.RSService.ListChildren(String item,
Boolean recursive) at
Microsoft.ReportingServices.WebServer.ReportingService.ListChildren(String
Item, Boolean Recursive, CatalogItem[]& CatalogItems) -- End of inner
exception stack trace -- at
Microsoft.ReportingServices.WebServer.ReportingService.ListChildren(String
Item, Boolean Recursive, CatalogItem[]& CatalogItems)
The code is quite simple:
VB.NET
Dim rService As ReportingService = New ReportingService
rService.Credentials = System.Net.CredentialCache.DefaultCredentials
Dim catalogItems As CatalogItem()
catalogItems = rService.ListChildren(Global.ReportPath, True)
C#.NET
ReportingService rService = new ReportingService();
rService.Credentials = System.Net.CredentialCache.DefaultCredentials;
CatalogItem[][0] catalogItems;
catalogItems = rService.ListChildren(Global.ReportPath, true);
--
Regards
<<<Bryan Avery>>Found the problem to be with web.config file.
Adding the following line under
<authentication mode="Windows" />
<identity impersonate="true" />
And it all springs in to life
--
Regards
<<<Bryan Avery>>
"Bryan Avery" wrote:
> I am trying to read the WebServices to gather information about the catalog.
> When I run the application from my development box and reading from the
> Reporting Services server for the Catalog all run fine.
> But when I transfer the application (asp.net) to the server it fails with:
> System.Web.Services.Protocols.SoapException: The permissions granted to user
> 'NT AUTHORITY\NETWORK SERVICE' are insufficient for performing this
> operation. -->
> Microsoft.ReportingServices.Diagnostics.Utilities.AccessDeniedException: The
> permissions granted to user 'NT AUTHORITY\NETWORK SERVICE' are insufficient
> for performing this operation. at
> Microsoft.ReportingServices.Library.RSService.ListChildren(String item,
> Boolean recursive) at
> Microsoft.ReportingServices.WebServer.ReportingService.ListChildren(String
> Item, Boolean Recursive, CatalogItem[]& CatalogItems) -- End of inner
> exception stack trace -- at
> Microsoft.ReportingServices.WebServer.ReportingService.ListChildren(String
> Item, Boolean Recursive, CatalogItem[]& CatalogItems)
> The code is quite simple:
> VB.NET
> Dim rService As ReportingService = New ReportingService
> rService.Credentials => System.Net.CredentialCache.DefaultCredentials
> Dim catalogItems As CatalogItem()
> catalogItems = rService.ListChildren(Global.ReportPath, True)
> C#.NET
> ReportingService rService = new ReportingService();
> rService.Credentials => System.Net.CredentialCache.DefaultCredentials;
> CatalogItem[][0] catalogItems;
> catalogItems = rService.ListChildren(Global.ReportPath, true);
> --
> Regards
> <<<Bryan Avery>>

permissions granted to user '<domain\username>' are insufficient for performing th

When deploying to my production report server, I am getting the
following error:
The permissions granted to user '<domain\username>'are insufficient for
performing this operation.
1> my domain/user acct is a member of the report server machine's
administrator's account.
2> my domain/user has "content manager" and "publisher" rights in
Report Manager for the appropriate directories; in this case, "Models"
and "Home."
3> I am deploying from VS 2005 to a server in the domain
4> my domain/user can see all administrative components when I view the
Report Manager.
Not sure what to try next. Any suggestions?
Thanks.Evidently (at least in my case), Content Manager is not by default set
to manage models. After configuring the Content Manager role, it works
fine. To configure the content manager role:
Site Settings > Configure item-level role definititions > Content
Manager
select: "manage models" and "view models"
Rob

permissions granted to an application intead of a user

I have an application that talks to an access db located on a 2000 server. I would like grant permissions to the application instead of a specific user. Any help would be great...

Such capability is not available - permissions are grantable to accounts, not to applications.

Thanks
Laurentiu

|||

I am including a link to a related entry in this forum where we have a detailed discussion on this topic:

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=786513&SiteID=1

I hope this information will be useful.

Thanks,

-Raul Garcia

SDE/T

SQL Server Engine

|||

let me restate:

the db is on a mapped drive on the 2000 server.

i want the prgm to have access to it but not to the general public.

i need a way to limit access to myself and the prgm only....

i have admin rights and would like to give the prgm the same...

|||

Answer is the same - Windows security works by assigning permissions to users - permissions cannot be assigned to applications.

You should read the post that Raul pointed out. You can attempt to use application roles or have the application connect with specific credentials to the database, but a smart user can reverse-engineer the application and figure out how to connect directly to the database, hence there is no security guarantee of the type you seek.

Thanks
Laurentiu

Permissions granted from Domain credentials

I am working with Visual Studio.net and creating a front end for a SQL datab
ase. Now with the access front end, it uses the domain credentials of the l
ogged in user to determine what permissions they have for editing records in
the SQL (2000) database.
I need the same to be done with the web front end I am creating now. I have
gone into the WEB.CONFIG file and put in my credentials there, identity i
mpersonate="true" userName="domain\johndoe" password="password"
Now this is ok if...I didn't change my password regularly and I wanted every
one to have full access...but obviously I don't. Is there some syntax that
I need there so that it will use the credentials of the logged in user? Or a
m I in the wrong file and s
hould be making changes elsewhere? I am new to this but I am learning. In
the OleDB connection for the datagrid on the page, I have added the line...
Trusted Connection=SSPI. What am I missing? I am using OleDb connection a
nd OleDb Command. Like I s
aid...with my credential in the web.config, it works fine. But that is only
good for now. I need the security set so when I get to creating a page tha
t only administrators have access to I can get those to work correctly.
Thanks All!!I am assuming that with the Trusted Connection = SSPI the connection is
failing. If so, what error message do you get when it fails?
Rand
This posting is provided "as is" with no warranties and confers no rights.|||You need to allow Kerberos Authentication to occur. The middle machine
must be trusted for Security Delegation. Also , the SQL Server service
account needs to have the Service Principal Name set.
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.

Permissions granted for user x are insufficient for performing this operation

Here's the setup:
I've got a RS server set up in a QA domain. When I publish reports to it,
it prompts me for a username and password. I enter the ADMINISTRATOR
account and password and all is well.
I've now set up a RS server in the production domain and I need to publish
my reports to it. I've added my domain account to the Role Assignments with
System Administrator privliges. When I log into RS, I see all of the
relevant administrator options, but when I try to publish a new report via
VS I get the error message: "Permissions granted for user x are
insufficient for performing this operation"
What am I doing wrong?
ThanksYou need to grant the user permission in the correct folder. There is a
default role called Content Manager. Make your user this role in the
appropriate folder.
--
-Daniel
This posting is provided "AS IS" with no warranties, and confers no rights.
"troark" <t.roark@.excite.com.n0sp@.m> wrote in message
news:es0Px60nEHA.3868@.TK2MSFTNGP11.phx.gbl...
> Here's the setup:
> I've got a RS server set up in a QA domain. When I publish reports to it,
> it prompts me for a username and password. I enter the ADMINISTRATOR
> account and password and all is well.
> I've now set up a RS server in the production domain and I need to publish
> my reports to it. I've added my domain account to the Role Assignments
with
> System Administrator privliges. When I log into RS, I see all of the
> relevant administrator options, but when I try to publish a new report via
> VS I get the error message: "Permissions granted for user x are
> insufficient for performing this operation"
> What am I doing wrong?
> Thanks
>
>|||DOH! Thanks.
"Daniel Reib [MSFT]" <danreib@.online.microsoft.com> wrote in message
news:uiFmju1nEHA.2024@.TK2MSFTNGP09.phx.gbl...
> You need to grant the user permission in the correct folder. There is a
> default role called Content Manager. Make your user this role in the
> appropriate folder.
> --
> -Daniel
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>
> "troark" <t.roark@.excite.com.n0sp@.m> wrote in message
> news:es0Px60nEHA.3868@.TK2MSFTNGP11.phx.gbl...
> > Here's the setup:
> > I've got a RS server set up in a QA domain. When I publish reports to
it,
> > it prompts me for a username and password. I enter the ADMINISTRATOR
> > account and password and all is well.
> >
> > I've now set up a RS server in the production domain and I need to
publish
> > my reports to it. I've added my domain account to the Role Assignments
> with
> > System Administrator privliges. When I log into RS, I see all of the
> > relevant administrator options, but when I try to publish a new report
via
> > VS I get the error message: "Permissions granted for user x are
> > insufficient for performing this operation"
> >
> > What am I doing wrong?
> >
> > Thanks
> >
> >
> >
> >
>

permissions for developers not working after 2005 upgrade

Prior to our move to 2005...permissions were granted to developers by adding them to the following fixed database roles...db_ddladmin, db_datareader, db_datawriter, and db_securityadmin. They created their objects using 'dbo' as the owner.

After upgrading to 2005, suddently they are having difficulty accessing their objects with this same security. Do they need permissions on the dbo schema?

Can you please elaborate on the access difficulty? Are you encountering errors and, if yes, what are those errors? It would help if you could give us an example of some action that used to work and now doesn't, and of what is the system response in this case.

Thanks
Laurentiu

|||

They are making a connection through Visual Studio using the MS OLE DB Provider for SQL Server with their domain account and receiving the following error...

SELECT permission denied on object 'Contact_Info', database 'GetLean', schema 'dbo'.

|||

Could you check what is the current execution context at the time when this error is obtained? You can use Profiler to figure out what is the current execution context.

There are two possibilities:

(1) current execution context is not a member of db_datareader, so you do not have SELECT permission.

(2) current execution context is explicitly denied SELECT permission on the Contact_Info table.

If you determine the current execution context, then you can check whether it's a member of db_datareader by looking at the sys.database_role_members catalog. You can check for the SELECT permission being denied by looking at the sys.database_permissions catalog.

Thanks
Laurentiu

|||

They are a member of the db_datareader, db_datawriter, db_ddladmin, and db_securityadmin roles. There are no permissions explicitly denied in this database.

Even though they have db_datareader, db_datawriter, db_ddladmin, and db_securityadmin rights....must I still assign them to the dbo schema?

|||

db_datareader grants select on the entire database, hence on the dbo schema as well (http://msdn2.microsoft.com/en-us/library/ms189612.aspx). You don't need to do a special permission grant for the dbo schema.

Can you try a little experiment? Create a test table in the dbo schema and then verify if those members of db_datareader can access it. Also, create a separate schema and a table in it and see if there is the same behavior for it as for the dbo schema.

Also, does this happen for all those developers or only for some? If some of them were added to db_denydatareader role, then that would prevent them from selecting from anything. Are they members of other roles than those four that you mentioned?

Thanks
Laurentiu

|||

It turned out not to be a DBA problem. Sorry, should have posted the resolution earlier.

It turned out to be a developer issue...a combination of failing to practice current standards and inexperience with Visual Studio. Aargh!

Permissions for creating views

In database permissions I have granted a user rights to create a view. When she tries to save the view (even save as) it automatically wants to save it to the dbo schema and says she does not have rights to save to the dbo schema.

Two questions:

1) Can I set it up to where she can save a view to a schema which she is the owner?

2) If not, then what permissions must be set to allow her to create / save views but not be able to create, etc. other objects such as tables and stored procedures?

From the description it seems like this is a question regarding tools (most likely Management studio).

I have moved the question to the appropriate forum, but if you have additional questions regarding the permissions please let us know.

Thanks,

-Raul Garcia

SDE/T

SQL Server Engine

|||Moved to Security|||

You will need to grant alter on the schema and create view on the database to the user who wants to create views.

T-SQL:

grant create view to user1

grant alter on schema:bo to user1

go

HTH,

-Steven Gott

SDE/T

SQL Server

Permissions and Connection

Hey All,
I have three questions:
(a) A new guy at work needs a list of type of permissions granted to users.
I really don't want to type all of it. Is there some software that exports
the permissions in a readable format from the SQL Server?
(b) I backed up our Master Database on the SQL Server. The host name is
SQLSERVERA. Now, we have a new computer with the host name SQLSERVERB. When
I restored the Master on this new server, I cannot open the SQL Server
connection in Enterprise manager! It says "login failed (edit registration
properties to change the login name)". I believe it's got something to do
with the change in the host name. Is this why? If so, how can I fix it? I
need to be able to restore Master on this server. I've tried all logins,
including domain admin, Sa and so on to connect.
(c) We have a computer connected to a card reader machine that makes an
entry into a table when a card is flashed in front of it. This software was
written in VB 6. Our SQL Server is a SQL 2000 SP 3A on a Windows 2003
Server. Sometimes, we get the error
"[Microsoft][ODBC SQL Server Driver][DBNETLIB]ConnectionRead
(WrapperRead()).
Server: Msg 11, Level 16, State 1, Line 0
General network error. Check your network documentation. "
After reading much about it, I changed the connection string to include a
OLE DB Services = -2. This does not help either! Does anybody have a
workable solution.
Thanks for your time.
Vince
Vince wrote:
> Hey All,
> I have three questions:
> (a) A new guy at work needs a list of type of permissions granted to
> users. I really don't want to type all of it. Is there some software
> that exports the permissions in a readable format from the SQL Server?
> (b) I backed up our Master Database on the SQL Server. The host name
> is SQLSERVERA. Now, we have a new computer with the host name
> SQLSERVERB. When I restored the Master on this new server, I cannot
> open the SQL Server connection in Enterprise manager! It says "login
> failed (edit registration properties to change the login name)". I
> believe it's got something to do with the change in the host name. Is
> this why? If so, how can I fix it? I need to be able to restore
> Master on this server. I've tried all logins, including domain admin,
> Sa and so on to connect.
> (c) We have a computer connected to a card reader machine that makes
> an entry into a table when a card is flashed in front of it. This
> software was written in VB 6. Our SQL Server is a SQL 2000 SP 3A on a
> Windows 2003 Server. Sometimes, we get the error
> "[Microsoft][ODBC SQL Server Driver][DBNETLIB]ConnectionRead
> (WrapperRead()).
> Server: Msg 11, Level 16, State 1, Line 0
> General network error. Check your network documentation. "
> After reading much about it, I changed the connection string to
> include a OLE DB Services = -2. This does not help either! Does
> anybody have a workable solution.
> Thanks for your time.
> Vince
A)
You can use the sp_helprotect system proc to report on all granted
access. I think the following will work (not tested):
Exec sp_helprotect NULL, NULL, NULL, NULL
David Gugick
Imceda Software
www.imceda.com
|||Vince wrote:
> Hey All,
> (b) I backed up our Master Database on the SQL Server. The host name
> is SQLSERVERA. Now, we have a new computer with the host name
> SQLSERVERB. When I restored the Master on this new server, I cannot
> open the SQL Server connection in Enterprise manager! It says "login
> failed (edit registration properties to change the login name)". I
> believe it's got something to do with the change in the host name. Is
> this why? If so, how can I fix it? I need to be able to restore
> Master on this server. I've tried all logins, including domain admin,
> Sa and so on to connect.
>
Change the name of the server back to SQLSERVERA. From QA, use
sp_addserver to add SQLSERVERB, and then change the server name back to
SQLSERVERB. I think that should do it.
David Gugick
Imceda Software
www.imceda.com
|||David,
Thank you.
A) The command EXEC sp_helprotect NULL, NULL, NULL,'O' does what I wanted.
B) I think that should do it too. I'll try it
Thanks, again. Any idea on C?
"David Gugick" <davidg-nospam@.imceda.com> wrote in message
news:elzDDAZ5EHA.1392@.tk2msftngp13.phx.gbl...
> Vince wrote:
> Change the name of the server back to SQLSERVERA. From QA, use
> sp_addserver to add SQLSERVERB, and then change the server name back to
> SQLSERVERB. I think that should do it.
> --
> David Gugick
> Imceda Software
> www.imceda.com
>
|||Vince wrote:
> David,
> Thank you.
> A) The command EXEC sp_helprotect NULL, NULL, NULL,'O' does what I
> wanted. B) I think that should do it too. I'll try it
> Thanks, again. Any idea on C?
>
Item C sounds like an application issue. How does the application
normally connect to the server? ADO, ODBC, RDO? You might try installing
SQL Server SP3a Service Pack on the client PC to update the client
tools. Or refreshing the ADO installation if MDAC is used. If ODBC, make
sure the ODBC DSN is set up correctly.
Some articles to look at:
http://support.microsoft.com/default...;en-us;Q229564
http://support.microsoft.com/default...b;en-us;827452
David Gugick
Imceda Software
www.imceda.com
|||Thanks for your reply. I use OLEDB, ADO to connect to the SQL Server. I
already looked into the support pages / updated MDAC / Added the OLE DB
Services= -2 but I still get this error at random intervals. Sometimes after
5 days, sometimes the same day. It happens so randomly that I cannot
establish any pattern! The last I got the error was about 5 days back. The
frequency is around 2 or 3 times a week. Low, but annoying.
Vince
"David Gugick" <davidg-nospam@.imceda.com> wrote in message
news:%23eQvnbf5EHA.2540@.TK2MSFTNGP09.phx.gbl...
> Vince wrote:
> Item C sounds like an application issue. How does the application
> normally connect to the server? ADO, ODBC, RDO? You might try installing
> SQL Server SP3a Service Pack on the client PC to update the client
> tools. Or refreshing the ADO installation if MDAC is used. If ODBC, make
> sure the ODBC DSN is set up correctly.
> Some articles to look at:
> http://support.microsoft.com/default...;en-us;Q229564
> http://support.microsoft.com/default...b;en-us;827452
>
>
> --
> David Gugick
> Imceda Software
> www.imceda.com
>
|||b) You have to make sure that the SQL Server service accounts from SERVERB
have access to SERVERA before you backup the master on SERVERA. Otherwise,
when you restore to SERVERB, SQL Server will gain access using base system
access but nothing else will function.
c) Make sure you update the MDAC on the client machine. If you've installed
the NETLIB system files, you will need to make sure they have been upgrades
to SP3a as well.
Sincerely,
Anthony Thomas

"Vince" <nmvkPLEASERMVTHIS@.vsnl.net> wrote in message
news:%23Y5IIdX5EHA.3644@.tk2msftngp13.phx.gbl...
Hey All,
I have three questions:
(a) A new guy at work needs a list of type of permissions granted to users.
I really don't want to type all of it. Is there some software that exports
the permissions in a readable format from the SQL Server?
(b) I backed up our Master Database on the SQL Server. The host name is
SQLSERVERA. Now, we have a new computer with the host name SQLSERVERB. When
I restored the Master on this new server, I cannot open the SQL Server
connection in Enterprise manager! It says "login failed (edit registration
properties to change the login name)". I believe it's got something to do
with the change in the host name. Is this why? If so, how can I fix it? I
need to be able to restore Master on this server. I've tried all logins,
including domain admin, Sa and so on to connect.
(c) We have a computer connected to a card reader machine that makes an
entry into a table when a card is flashed in front of it. This software was
written in VB 6. Our SQL Server is a SQL 2000 SP 3A on a Windows 2003
Server. Sometimes, we get the error
"[Microsoft][ODBC SQL Server Driver][DBNETLIB]ConnectionRead
(WrapperRead()).
Server: Msg 11, Level 16, State 1, Line 0
General network error. Check your network documentation. "
After reading much about it, I changed the connection string to include a
OLE DB Services = -2. This does not help either! Does anybody have a
workable solution.
Thanks for your time.
Vince
|||Thanks Anthony. I already updated MDAC (some 2 days back) and so far the
problem has not appeared. But, I'll know for sure at the end of the week.
Thanks, again.
Vince
"AnthonyThomas" <Anthony.Thomas@.CommerceBank.com> wrote in message
news:uXdEJel5EHA.1300@.TK2MSFTNGP14.phx.gbl...
> b) You have to make sure that the SQL Server service accounts from SERVERB
> have access to SERVERA before you backup the master on SERVERA.
Otherwise,
> when you restore to SERVERB, SQL Server will gain access using base system
> access but nothing else will function.
> c) Make sure you update the MDAC on the client machine. If you've
installed
> the NETLIB system files, you will need to make sure they have been
upgrades
> to SP3a as well.
> Sincerely,
>
> Anthony Thomas
>
> --
> "Vince" <nmvkPLEASERMVTHIS@.vsnl.net> wrote in message
> news:%23Y5IIdX5EHA.3644@.tk2msftngp13.phx.gbl...
> Hey All,
> I have three questions:
> (a) A new guy at work needs a list of type of permissions granted to
users.
> I really don't want to type all of it. Is there some software that exports
> the permissions in a readable format from the SQL Server?
> (b) I backed up our Master Database on the SQL Server. The host name is
> SQLSERVERA. Now, we have a new computer with the host name SQLSERVERB.
When
> I restored the Master on this new server, I cannot open the SQL Server
> connection in Enterprise manager! It says "login failed (edit registration
> properties to change the login name)". I believe it's got something to do
> with the change in the host name. Is this why? If so, how can I fix it? I
> need to be able to restore Master on this server. I've tried all logins,
> including domain admin, Sa and so on to connect.
> (c) We have a computer connected to a card reader machine that makes an
> entry into a table when a card is flashed in front of it. This software
was
> written in VB 6. Our SQL Server is a SQL 2000 SP 3A on a Windows 2003
> Server. Sometimes, we get the error
> "[Microsoft][ODBC SQL Server Driver][DBNETLIB]ConnectionRead
> (WrapperRead()).
> Server: Msg 11, Level 16, State 1, Line 0
> General network error. Check your network documentation. "
> After reading much about it, I changed the connection string to include a
> OLE DB Services = -2. This does not help either! Does anybody have a
> workable solution.
> Thanks for your time.
> Vince
>

Permissions and Connection

Hey All,
I have three questions:
(a) A new guy at work needs a list of type of permissions granted to users.
I really don't want to type all of it. Is there some software that exports
the permissions in a readable format from the SQL Server?
(b) I backed up our Master Database on the SQL Server. The host name is
SQLSERVERA. Now, we have a new computer with the host name SQLSERVERB. When
I restored the Master on this new server, I cannot open the SQL Server
connection in Enterprise manager! It says "login failed (edit registration
properties to change the login name)". I believe it's got something to do
with the change in the host name. Is this why? If so, how can I fix it? I
need to be able to restore Master on this server. I've tried all logins,
including domain admin, Sa and so on to connect.
(c) We have a computer connected to a card reader machine that makes an
entry into a table when a card is flashed in front of it. This software was
written in VB 6. Our SQL Server is a SQL 2000 SP 3A on a Windows 2003
Server. Sometimes, we get the error
"[Microsoft][ODBC SQL Server Driver][DBNETLIB]ConnectionRead
(WrapperRead()).
Server: Msg 11, Level 16, State 1, Line 0
General network error. Check your network documentation. "
After reading much about it, I changed the connection string to include a
OLE DB Services = -2. This does not help either! Does anybody have a
workable solution.
Thanks for your time.
VinceVince wrote:
> Hey All,
> I have three questions:
> (a) A new guy at work needs a list of type of permissions granted to
> users. I really don't want to type all of it. Is there some software
> that exports the permissions in a readable format from the SQL Server?
> (b) I backed up our Master Database on the SQL Server. The host name
> is SQLSERVERA. Now, we have a new computer with the host name
> SQLSERVERB. When I restored the Master on this new server, I cannot
> open the SQL Server connection in Enterprise manager! It says "login
> failed (edit registration properties to change the login name)". I
> believe it's got something to do with the change in the host name. Is
> this why? If so, how can I fix it? I need to be able to restore
> Master on this server. I've tried all logins, including domain admin,
> Sa and so on to connect.
> (c) We have a computer connected to a card reader machine that makes
> an entry into a table when a card is flashed in front of it. This
> software was written in VB 6. Our SQL Server is a SQL 2000 SP 3A on a
> Windows 2003 Server. Sometimes, we get the error
> "[Microsoft][ODBC SQL Server Driver][DBNETLIB]ConnectionRead
> (WrapperRead()).
> Server: Msg 11, Level 16, State 1, Line 0
> General network error. Check your network documentation. "
> After reading much about it, I changed the connection string to
> include a OLE DB Services = -2. This does not help either! Does
> anybody have a workable solution.
> Thanks for your time.
> Vince
A)
You can use the sp_helprotect system proc to report on all granted
access. I think the following will work (not tested):
Exec sp_helprotect NULL, NULL, NULL, NULL
David Gugick
Imceda Software
www.imceda.com|||Vince wrote:
> Hey All,
> (b) I backed up our Master Database on the SQL Server. The host name
> is SQLSERVERA. Now, we have a new computer with the host name
> SQLSERVERB. When I restored the Master on this new server, I cannot
> open the SQL Server connection in Enterprise manager! It says "login
> failed (edit registration properties to change the login name)". I
> believe it's got something to do with the change in the host name. Is
> this why? If so, how can I fix it? I need to be able to restore
> Master on this server. I've tried all logins, including domain admin,
> Sa and so on to connect.
>
Change the name of the server back to SQLSERVERA. From QA, use
sp_addserver to add SQLSERVERB, and then change the server name back to
SQLSERVERB. I think that should do it.
--
David Gugick
Imceda Software
www.imceda.com|||David,
Thank you.
A) The command EXEC sp_helprotect NULL, NULL, NULL,'O' does what I wanted.
B) I think that should do it too. I'll try it
Thanks, again. Any idea on C?
"David Gugick" <davidg-nospam@.imceda.com> wrote in message
news:elzDDAZ5EHA.1392@.tk2msftngp13.phx.gbl...
> Vince wrote:
> > Hey All,
> >
> > (b) I backed up our Master Database on the SQL Server. The host name
> > is SQLSERVERA. Now, we have a new computer with the host name
> > SQLSERVERB. When I restored the Master on this new server, I cannot
> > open the SQL Server connection in Enterprise manager! It says "login
> > failed (edit registration properties to change the login name)". I
> > believe it's got something to do with the change in the host name. Is
> > this why? If so, how can I fix it? I need to be able to restore
> > Master on this server. I've tried all logins, including domain admin,
> > Sa and so on to connect.
> >
> Change the name of the server back to SQLSERVERA. From QA, use
> sp_addserver to add SQLSERVERB, and then change the server name back to
> SQLSERVERB. I think that should do it.
> --
> David Gugick
> Imceda Software
> www.imceda.com
>|||Vince wrote:
> David,
> Thank you.
> A) The command EXEC sp_helprotect NULL, NULL, NULL,'O' does what I
> wanted. B) I think that should do it too. I'll try it
> Thanks, again. Any idea on C?
>
Item C sounds like an application issue. How does the application
normally connect to the server? ADO, ODBC, RDO? You might try installing
SQL Server SP3a Service Pack on the client PC to update the client
tools. Or refreshing the ADO installation if MDAC is used. If ODBC, make
sure the ODBC DSN is set up correctly.
Some articles to look at:
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q229564
http://support.microsoft.com/default.aspx?scid=kb;en-us;827452
David Gugick
Imceda Software
www.imceda.com|||Thanks for your reply. I use OLEDB, ADO to connect to the SQL Server. I
already looked into the support pages / updated MDAC / Added the OLE DB
Services= -2 but I still get this error at random intervals. Sometimes after
5 days, sometimes the same day. It happens so randomly that I cannot
establish any pattern! The last I got the error was about 5 days back. The
frequency is around 2 or 3 times a week. Low, but annoying.
Vince
"David Gugick" <davidg-nospam@.imceda.com> wrote in message
news:%23eQvnbf5EHA.2540@.TK2MSFTNGP09.phx.gbl...
> Vince wrote:
> > David,
> >
> > Thank you.
> > A) The command EXEC sp_helprotect NULL, NULL, NULL,'O' does what I
> > wanted. B) I think that should do it too. I'll try it
> >
> > Thanks, again. Any idea on C?
> >
> Item C sounds like an application issue. How does the application
> normally connect to the server? ADO, ODBC, RDO? You might try installing
> SQL Server SP3a Service Pack on the client PC to update the client
> tools. Or refreshing the ADO installation if MDAC is used. If ODBC, make
> sure the ODBC DSN is set up correctly.
> Some articles to look at:
> http://support.microsoft.com/default.aspx?scid=kb;en-us;Q229564
> http://support.microsoft.com/default.aspx?scid=kb;en-us;827452
>
>
> --
> David Gugick
> Imceda Software
> www.imceda.com
>|||b) You have to make sure that the SQL Server service accounts from SERVERB
have access to SERVERA before you backup the master on SERVERA. Otherwise,
when you restore to SERVERB, SQL Server will gain access using base system
access but nothing else will function.
c) Make sure you update the MDAC on the client machine. If you've installed
the NETLIB system files, you will need to make sure they have been upgrades
to SP3a as well.
Sincerely,
Anthony Thomas
"Vince" <nmvkPLEASERMVTHIS@.vsnl.net> wrote in message
news:%23Y5IIdX5EHA.3644@.tk2msftngp13.phx.gbl...
Hey All,
I have three questions:
(a) A new guy at work needs a list of type of permissions granted to users.
I really don't want to type all of it. Is there some software that exports
the permissions in a readable format from the SQL Server?
(b) I backed up our Master Database on the SQL Server. The host name is
SQLSERVERA. Now, we have a new computer with the host name SQLSERVERB. When
I restored the Master on this new server, I cannot open the SQL Server
connection in Enterprise manager! It says "login failed (edit registration
properties to change the login name)". I believe it's got something to do
with the change in the host name. Is this why? If so, how can I fix it? I
need to be able to restore Master on this server. I've tried all logins,
including domain admin, Sa and so on to connect.
(c) We have a computer connected to a card reader machine that makes an
entry into a table when a card is flashed in front of it. This software was
written in VB 6. Our SQL Server is a SQL 2000 SP 3A on a Windows 2003
Server. Sometimes, we get the error
"[Microsoft][ODBC SQL Server Driver][DBNETLIB]ConnectionRead
(WrapperRead()).
Server: Msg 11, Level 16, State 1, Line 0
General network error. Check your network documentation. "
After reading much about it, I changed the connection string to include a
OLE DB Services = -2. This does not help either! Does anybody have a
workable solution.
Thanks for your time.
Vince|||Thanks Anthony. I already updated MDAC (some 2 days back) and so far the
problem has not appeared. But, I'll know for sure at the end of the week.
Thanks, again.
Vince
"AnthonyThomas" <Anthony.Thomas@.CommerceBank.com> wrote in message
news:uXdEJel5EHA.1300@.TK2MSFTNGP14.phx.gbl...
> b) You have to make sure that the SQL Server service accounts from SERVERB
> have access to SERVERA before you backup the master on SERVERA.
Otherwise,
> when you restore to SERVERB, SQL Server will gain access using base system
> access but nothing else will function.
> c) Make sure you update the MDAC on the client machine. If you've
installed
> the NETLIB system files, you will need to make sure they have been
upgrades
> to SP3a as well.
> Sincerely,
>
> Anthony Thomas
>
> --
> "Vince" <nmvkPLEASERMVTHIS@.vsnl.net> wrote in message
> news:%23Y5IIdX5EHA.3644@.tk2msftngp13.phx.gbl...
> Hey All,
> I have three questions:
> (a) A new guy at work needs a list of type of permissions granted to
users.
> I really don't want to type all of it. Is there some software that exports
> the permissions in a readable format from the SQL Server?
> (b) I backed up our Master Database on the SQL Server. The host name is
> SQLSERVERA. Now, we have a new computer with the host name SQLSERVERB.
When
> I restored the Master on this new server, I cannot open the SQL Server
> connection in Enterprise manager! It says "login failed (edit registration
> properties to change the login name)". I believe it's got something to do
> with the change in the host name. Is this why? If so, how can I fix it? I
> need to be able to restore Master on this server. I've tried all logins,
> including domain admin, Sa and so on to connect.
> (c) We have a computer connected to a card reader machine that makes an
> entry into a table when a card is flashed in front of it. This software
was
> written in VB 6. Our SQL Server is a SQL 2000 SP 3A on a Windows 2003
> Server. Sometimes, we get the error
> "[Microsoft][ODBC SQL Server Driver][DBNETLIB]ConnectionRead
> (WrapperRead()).
> Server: Msg 11, Level 16, State 1, Line 0
> General network error. Check your network documentation. "
> After reading much about it, I changed the connection string to include a
> OLE DB Services = -2. This does not help either! Does anybody have a
> workable solution.
> Thanks for your time.
> Vince
>

Permissions

The permissions granted to user 'NT AUTHORITY\NETWORK SERVICE' are
insufficient for performing this operation
I am getting this error when I have installed my asp.net application on the
server, it runs fine on my development box, here is the code that is running:
Dim rService As ReportingService = New ReportingService
rService.Credentials = System.Net.CredentialCache.DefaultCredentials
Dim catalogItems As CatalogItem()
catalogItems = rService.ListChildren("/", True)
And it's falling over on the last line, anyone got any ideas?
--
Regards
<<<Bryan Avery>>Have your asp.net application run under different credentials. You can set
these for services on the Log On tab for the services property.
"Bryan Avery" wrote:
> The permissions granted to user 'NT AUTHORITY\NETWORK SERVICE' are
> insufficient for performing this operation
> I am getting this error when I have installed my asp.net application on the
> server, it runs fine on my development box, here is the code that is running:
> Dim rService As ReportingService = New ReportingService
> rService.Credentials = System.Net.CredentialCache.DefaultCredentials
> Dim catalogItems As CatalogItem()
> catalogItems = rService.ListChildren("/", True)
> And it's falling over on the last line, anyone got any ideas?
> --
> Regards
> <<<Bryan Avery>>|||Hi,
I'm a little unsure what you mean by setting different credentials for the
application, where and how do you set them?
--
Regards
<<<Bryan Avery>>
"Harolds" wrote:
> Have your asp.net application run under different credentials. You can set
> these for services on the Log On tab for the services property.
> "Bryan Avery" wrote:
> > The permissions granted to user 'NT AUTHORITY\NETWORK SERVICE' are
> > insufficient for performing this operation
> >
> > I am getting this error when I have installed my asp.net application on the
> > server, it runs fine on my development box, here is the code that is running:
> >
> > Dim rService As ReportingService = New ReportingService
> > rService.Credentials = System.Net.CredentialCache.DefaultCredentials
> > Dim catalogItems As CatalogItem()
> > catalogItems = rService.ListChildren("/", True)
> >
> > And it's falling over on the last line, anyone got any ideas?
> >
> > --
> > Regards
> >
> > <<<Bryan Avery>>|||Found the problem to be with web.config file.
Adding the following line under
<authentication mode="Windows" />
<identity impersonate="true" />
And it all springs in to life
--
Regards
<<<Bryan Avery>>
"Bryan Avery" wrote:
> Hi,
> I'm a little unsure what you mean by setting different credentials for the
> application, where and how do you set them?
> --
> Regards
> <<<Bryan Avery>>
>
> "Harolds" wrote:
> > Have your asp.net application run under different credentials. You can set
> > these for services on the Log On tab for the services property.
> >
> > "Bryan Avery" wrote:
> >
> > > The permissions granted to user 'NT AUTHORITY\NETWORK SERVICE' are
> > > insufficient for performing this operation
> > >
> > > I am getting this error when I have installed my asp.net application on the
> > > server, it runs fine on my development box, here is the code that is running:
> > >
> > > Dim rService As ReportingService = New ReportingService
> > > rService.Credentials = System.Net.CredentialCache.DefaultCredentials
> > > Dim catalogItems As CatalogItem()
> > > catalogItems = rService.ListChildren("/", True)
> > >
> > > And it's falling over on the last line, anyone got any ideas?
> > >
> > > --
> > > Regards
> > >
> > > <<<Bryan Avery>>

Permission tracking

Hi all,
i'm facing the following situation: user rights must be granted for a very
short period of time, so that the user does his insert/update/delete job.
The problem is that there are many users who have requests and giving &
revoking permissions are taking a lot of time. Did anybody implemented an
automated tracking system, and if yes, could you give me a hint please? A
good way to implement permission tracking would be triggers but unluckily,
in Sql 2000, they can't be used on system tables...:-(
--
Tudor Sofron
MCSE, MCSA
Ipsos- NMRTudot
I am not sure what did you mean?
Do you want the users to be able INSERT/UPDATE/DELETE operations for a short
time?
What is a short time ( one an hour, two minutes) ?
I suggest you using STORED PROCEDURES for security reasons. Don't grant
access on underlying tables ,instead grant EXECUTE permissions for the users
on stored procedures that they need to be run.
"Tudor Sofron" <tsofron@.cluj.astral.rom> wrote in message
news:uc9kgMXxEHA.1988@.TK2MSFTNGP12.phx.gbl...
> Hi all,
> i'm facing the following situation: user rights must be granted for a very
> short period of time, so that the user does his insert/update/delete job.
> The problem is that there are many users who have requests and giving &
> revoking permissions are taking a lot of time. Did anybody implemented an
> automated tracking system, and if yes, could you give me a hint please? A
> good way to implement permission tracking would be triggers but unluckily,
> in Sql 2000, they can't be used on system tables...:-(
> --
> Tudor Sofron
> MCSE, MCSA
> Ipsos- NMR
>
>|||Well...
this is the table i've created:
CREATE TABLE [User_RightsGranted] (
[User_Name] [varchar] (200) COLLATE SQL_Latin1_General_CP1_CI_AS NOT
NULL ,
[User_ID] [smallint] NULL ,
[User_SID] [varbinary] (85) NULL ,
[DB_Name] [varchar] (255) COLLATE SQL_Latin1_General_CP1_CI_AS NOT N
ULL ,
[Object_Name] [varchar] (200) COLLATE SQL_Latin1_General_CP1_CI_AS N
ULL ,
[Db_Owner] [tinyint] NULL ,
[Data_Reader] [tinyint] NULL ,
[Data_Writer] [tinyint] NULL ,
[Exec] [tinyint] NULL ,
[Select] [tinyint] NULL ,
[Insert] [tinyint] NULL ,
[Update] [tinyint] NULL ,
[Delete] [tinyint] NULL ,
[DateStart] [datetime] NOT NULL CONSTRAINT [DF_User_Rights_DateS
tart]
DEFAULT (getdate()),
[DateEnd] [datetime] NULL ,
[OpDate] [datetime] NOT NULL CONSTRAINT [DF_User_Rights_OpDate]
DEFAULT
(getdate()),
[OpUser] [varchar] (200) COLLATE SQL_Latin1_General_CP1_CI_AS NOT NU
LL
CONSTRAINT [DF_User_Rights_OpUser] DEFAULT (suser_sname() + '.' +
host_name())
) ON [PRIMARY]
GO
The column names are pretty explicit so it's no need to explain their
function. The problem I have is that I can't automatize the whole process,
so I have to complete the table manually. So...did anybody faced such
problems, and if yes, how did you solved them? See my comments to your post
below...
Thanks,
Tudor Sofron
MCSE, MCSA
Ipsos- NMR
"Uri Dimant" <urid@.iscar.co.il> wrote in message
news:eUVFySXxEHA.2040@.tk2msftngp13.phx.gbl...
> Tudot
> I am not sure what did you mean?
> Do you want the users to be able INSERT/UPDATE/DELETE operations for a
short
> time?
yes. I grant users INSERT/UPDATE/DELETE rights and complete the above table.
> What is a short time ( one an hour, two minutes) ?
about 30 minutes, after that I revoke the granted permissions...but I have
to do that manually...and update a similar table...

> I suggest you using STORED PROCEDURES for security reasons. Don't grant
> access on underlying tables ,instead grant EXECUTE permissions for the
users
> on stored procedures that they need to be run.
well...it's not that easy to implement the use of sp's...
>
>
> "Tudor Sofron" <tsofron@.cluj.astral.rom> wrote in message
> news:uc9kgMXxEHA.1988@.TK2MSFTNGP12.phx.gbl...
very[vbcol=seagreen]
job.[vbcol=seagreen]
an[vbcol=seagreen]
A[vbcol=seagreen]
unluckily,[vbcol=seagreen]
>|||Tudor
I am sorry but the table looks like a mess.
There is no primary key, lots of colums does allow NULL's

> The problem I have is that I can't automatize the whole process,
> so I have to complete the table manually
You mean that you would like to insert into the table all DML that users do?
If so, create a trigger on this table and start to manipuilate with DELETED
and INSERTED virtual tables
In my opinion I'd create an AUDIT table that will be gathering all info
about new/old columns
Something like that
create trigger tru_MyTable on MyTable after update
as
if @.@.ROWCOUNT = 0
return
insert MyAuditTable
select
i.ID
, d.MyColumn
, i.MyColumn
from
inserted i
join
deleted d on d.ID = o.Id
go
"Tudor Sofron" <tsofron@.cluj.astral.rom> wrote in message
news:%23QH8akXxEHA.3896@.TK2MSFTNGP10.phx.gbl...
> Well...
> this is the table i've created:
> CREATE TABLE [User_RightsGranted] (
> [User_Name] [varchar] (200) COLLATE SQL_Latin1_General_CP1_CI_AS NOT NULL

,
> [User_ID] [smallint] NULL ,
> [User_SID] [varbinary] (85) NULL ,
> [DB_Name] [varchar] (255) COLLATE SQL_Latin1_General_CP1_CI_AS NO
T NULL ,
> [Object_Name] [varchar] (200) COLLATE SQL_Latin1_General_CP1_CI_A
S NULL ,
> [Db_Owner] [tinyint] NULL ,
> [Data_Reader] [tinyint] NULL ,
> [Data_Writer] [tinyint] NULL ,
> [Exec] [tinyint] NULL ,
> [Select] [tinyint] NULL ,
> [Insert] [tinyint] NULL ,
> [Update] [tinyint] NULL ,
> [Delete] [tinyint] NULL ,
> [DateStart] [datetime] NOT NULL CONSTRAINT [DF_User_Rights_Da
teStart]
> DEFAULT (getdate()),
> [DateEnd] [datetime] NULL ,
> [OpDate] [datetime] NOT NULL CONSTRAINT [DF_User_Rights_OpDat
e] DEFAULT
> (getdate()),
> [OpUser] [varchar] (200) COLLATE SQL_Latin1_General_CP1_CI_AS NOT
NULL
> CONSTRAINT [DF_User_Rights_OpUser] DEFAULT (suser_sname() + '.' +
> host_name())
> ) ON [PRIMARY]
> GO
> The column names are pretty explicit so it's no need to explain their
> function. The problem I have is that I can't automatize the whole process,
> so I have to complete the table manually. So...did anybody faced such
> problems, and if yes, how did you solved them? See my comments to your
post
> below...
> Thanks,
> Tudor Sofron
> MCSE, MCSA
> Ipsos- NMR
>
> "Uri Dimant" <urid@.iscar.co.il> wrote in message
> news:eUVFySXxEHA.2040@.tk2msftngp13.phx.gbl...
> short
> yes. I grant users INSERT/UPDATE/DELETE rights and complete the above
table.
> about 30 minutes, after that I revoke the granted permissions...but I have
> to do that manually...and update a similar table...
>
grant[vbcol=seagreen]
> users
> well...it's not that easy to implement the use of sp's...
> very
> job.
&[vbcol=seagreen]
> an
please?[vbcol=seagreen]
> A
> unluckily,
>|||well...the table design is in 'development phase' :-)...but i hope that soon
this will be done.
Tudor Sofron
MCSE, MCSA
Ipsos- NMR
"Uri Dimant" <urid@.iscar.co.il> wrote in message
news:uuqlkwXxEHA.1264@.TK2MSFTNGP12.phx.gbl...
> Tudor
> I am sorry but the table looks like a mess.
> There is no primary key, lots of colums does allow NULL's
>
>
> You mean that you would like to insert into the table all DML that users
do?
> If so, create a trigger on this table and start to manipuilate with
DELETED
> and INSERTED virtual tables
> In my opinion I'd create an AUDIT table that will be gathering all info
> about new/old columns
> Something like that
> create trigger tru_MyTable on MyTable after update
> as
> if @.@.ROWCOUNT = 0
> return
> insert MyAuditTable
> select
> i.ID
> , d.MyColumn
> , i.MyColumn
> from
> inserted i
> join
> deleted d on d.ID = o.Id
> go
>
>
> "Tudor Sofron" <tsofron@.cluj.astral.rom> wrote in message
> news:%23QH8akXxEHA.3896@.TK2MSFTNGP10.phx.gbl...
NULL[vbcol=seagreen]
> ,
,[vbcol=seagreen]
,[vbcol=seagreen]
process,[vbcol=seagreen]
> post
> table.
have[vbcol=seagreen]
> grant
a[vbcol=seagreen]
giving[vbcol=seagreen]
> &
implemented[vbcol=seagreen]
> please?
>

Permission to run DBCC DROPCLEANBUFFERS

Were using SQL Server 2000.
Whilst the devevelopers have reasonably good access to do most things on the
Dev box, we are not granted SA rights.
For performance tuning of queries, I need to be able to run DBCC
DROPCLEANBUFFERS but apparently you need to be SA to do this.
Does anybody know how we can get around this so the DBA's can affectivly
give me these permissions without making me SA.
Any help would be great.
Thanks,
JoeI'm pretty sure that only sysadmin role members can execute DBCC
DROPCLEANBUFFERS. That's the requirement in SQL 2005 so the same probably
applies to SQL 2000.
Hope this helps.
Dan Guzman
SQL Server MVP
"KCSL" <KCSL@.discussions.microsoft.com> wrote in message
news:AE187C22-F0DC-44C9-902B-D87C14CCD8B6@.microsoft.com...
> Were using SQL Server 2000.
> Whilst the devevelopers have reasonably good access to do most things on
> the
> Dev box, we are not granted SA rights.
> For performance tuning of queries, I need to be able to run DBCC
> DROPCLEANBUFFERS but apparently you need to be SA to do this.
> Does anybody know how we can get around this so the DBA's can affectivly
> give me these permissions without making me SA.
> Any help would be great.
> Thanks,
> Joe
>|||Not possible. You have to be an member of the sysadmin role to issue that
command. There is a reason for that. You are going to purge every buffer
in the system which will force SQL Server to read everything back off disk.
Only a sysadmin should have the authority to make that decision.
Mike
http://www.solidqualitylearning.com
Disclaimer: This communication is an original work and represents my sole
views on the subject. It does not represent the views of any other person
or entity either by inference or direct reference.
"KCSL" <KCSL@.discussions.microsoft.com> wrote in message
news:AE187C22-F0DC-44C9-902B-D87C14CCD8B6@.microsoft.com...
> Were using SQL Server 2000.
> Whilst the devevelopers have reasonably good access to do most things on
> the
> Dev box, we are not granted SA rights.
> For performance tuning of queries, I need to be able to run DBCC
> DROPCLEANBUFFERS but apparently you need to be SA to do this.
> Does anybody know how we can get around this so the DBA's can affectivly
> give me these permissions without making me SA.
> Any help would be great.
> Thanks,
> Joe
>|||"KCSL" <KCSL@.discussions.microsoft.com> wrote in message
news:AE187C22-F0DC-44C9-902B-D87C14CCD8B6@.microsoft.com...
> Were using SQL Server 2000.
> Whilst the devevelopers have reasonably good access to do most things on
> the
> Dev box, we are not granted SA rights.
> For performance tuning of queries, I need to be able to run DBCC
> DROPCLEANBUFFERS but apparently you need to be SA to do this.
> Does anybody know how we can get around this so the DBA's can affectivly
> give me these permissions without making me SA.
>
You shouldn't be using DBCC DROPCLEANBUFFERS for performance tuning.
SET STATISTICS IO ON
SET STATISTICS TIME ON
Give you better information. With the large memory sizes of servers, you
never have purged buffers, and your query performance in that situration is
not meaningful. To tune queries the most important metric is amount of
logical IO. You can measure that on production systems or test systems, and
it is very, very highly correlated with elapsed time and CPU utilization.
If you minimize logical IO, you will minimize query cost.
David

permission question

Hi,

I granted a domain user login:
--read only to our production db.
--db_owner to msdb.

I want this login to be able to create jobs & dts packages.
he's able to create dts packages, but when he tries to create a new job, in the db dropdown menu (steps tab) he can't see the production db. He only sees msdb, master & temp... he needs to see the production db, so that he can create a job.

please help!
MeeraHowdy

You have done the right thing allowing access to MSDB. He should be able to create DTS packages anyway ( anyone can ) .

With his login, what is his default database? Also, has his login ( not a group etc ) been actually granted access to the production database?

I say this as the Public group in a database can be emptied in the database, thereby not everyone on the server is granted access automatically to the database.

Cheers

SG|||Thanks for replying!

This guy belongs to a domain user group called dbCustomReports. So, when he registers his servers in Enterprise manager using the runas command, he'll be registered as Domain/dbCustomReports.

His default db is the production db.

The login in SQL server is actually Domain/dbCustomReports. That login has db_owner permissions on msdb & production.

Which login should I grant permissions to? I didn't follow that part of your question... (he doesn't have any individual sql server login)

Any help is appreciated.
Thanks,
Meera|||you should grant the domain/dbCustomReports access to you production database. Setting a default database does not grant access to that database. You have granted permissions to the group to which the user belongs. Be aware that anyone else belonging to that group has the same privileges in the database.|||That account has been granted db_owner priviliges to the production db & then I set the default db :)
Meera|||can the user see the production database in the enterprise manager or also only msdb, master and temp?|||in EM, the user can see the production db and all the other db (of course when he tries to see the tables, it won't let him.)

Thanks,
Meera|||How did you set up the permissions for this user? Are there any other privileges or database roles granted?|||database called CR -- db_owner
msdb -- db_owner
database called Prod -- read only

Meera|||I think you should only give read only to the first one too

Paulo

Originally posted by meeraarvind
database called CR -- db_owner
msdb -- db_owner
database called Prod -- read only

Meera

Permission problem

I get the following error at times:

The permissions granted to user 'PMS\rforkner' are insufficient for performing this operation. (rsAccessDenied) (Report Services SOAP Proxy Source)

The user is me and I am the administrator and owner of the SQL Server 2005 database. SQL Server is running on Windows 2003 Server Enterprise SP1. How is it I don’t have permission to change a change a permission. For the past several days I have added users and set the permissions (in Report Server). What I had done was uncheck Browser for my account and that worked. When I tried to check Browser and OK is when I got the error.

Any ideas, suggestions, or comments are certainly welcome

Roy

Hi RoyAF,
i guess it is possible that when you check Browser (I really don't know the exact place where you do that) you are using another user. It is just as logging with your NT user accnt and surfing by the built-in accnt for IIS; that built-in accnt is NOT admin on the Report Server and this is why you get the error.
I have posted a question on about the same problem - it seems that you must have admin rights on the RS to do anything (including viewing reports).
I am waiting for someone to confirm that this problem goes away if you uninstall SP1 for W2K3.
If you get to talk to anybody and can shed more light, please post back,
thanks,
kowalsky|||kowalsky,
I have full privilages to the server, sql server and of course RS. I have sa rights. The strange thing is, that it worked until I unchecked browser on I had rights then but, a few minutes later when I tried to check browser on built in I no longer had the rights.
It is really frustrating and I have no idea where to get answers other than here. I have posted numerous questions about problems and I have had only 2 answers. Maybe my questions are so easy no one wants to bother answering.
I really like the product and I know it is beta but it seems to work for some; I just wish I could make it work for me.
Roy
|||This is crazy; today all the permission problems have disappeared and all is working as it should. The face that yesterday was a problem and today isn't makes me wonder what is happening.|||

RS has to call out to the Domain Controller to ensure you are who you say you are. If the network connectivity between the DC and RS is unstable, this kind of issue can occur.

Removing the Browser role should not affect your ability to set permissions because the default definition of Browser does not grant you this right.

Hope that helps,

-Lukasz

This posting is provided "AS IS" with no warranties, and confers no rights.