permissions to view jobs but not change them

is there any combination of permissions or a role that will let a user view
stored procedures and their success without being able to modify them? Thanks.
What do you exactly mean by "view stored procedures"? Look at the source code? Everyone can do that
unless you have encrypted the procedure (then no-one can do that).
Also, what do you mean by "and their success"?
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"J Jetson" <JJetson@.discussions.microsoft.com> wrote in message
news:7D66188B-9C98-42B3-8989-8CC23E7C97DC@.microsoft.com...
> is there any combination of permissions or a role that will let a user view
> stored procedures and their success without being able to modify them? Thanks.
|||Sorry, I meant view jobs... in the Jobs viewer in Enterprise Manager. Is
there a combination of permissions or a role that would let a user view a job
and check its success without being able to modify it in any way. Thanks.
"Tibor Karaszi" wrote:

> What do you exactly mean by "view stored procedures"? Look at the source code? Everyone can do that
> unless you have encrypted the procedure (then no-one can do that).
> Also, what do you mean by "and their success"?
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
>
> "J Jetson" <JJetson@.discussions.microsoft.com> wrote in message
> news:7D66188B-9C98-42B3-8989-8CC23E7C97DC@.microsoft.com...
>
>
|||There is no such feature. SQL Server Agent doesn't have any "role" scheme or similar. You could try
playing with the TargetServersRole. It *might* do what you want, but it is designed for something
else...
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"J Jetson" <JJetson@.discussions.microsoft.com> wrote in message
news:F0678877-B513-4AC6-BE4F-DA44830D9048@.microsoft.com...[vbcol=seagreen]
> Sorry, I meant view jobs... in the Jobs viewer in Enterprise Manager. Is
> there a combination of permissions or a role that would let a user view a job
> and check its success without being able to modify it in any way. Thanks.
> "Tibor Karaszi" wrote:
that[vbcol=seagreen]

permissions to view jobs but not change them

is there any combination of permissions or a role that will let a user view
stored procedures and their success without being able to modify them? Thanks.What do you exactly mean by "view stored procedures"? Look at the source code? Everyone can do that
unless you have encrypted the procedure (then no-one can do that).
Also, what do you mean by "and their success"?
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"J Jetson" <JJetson@.discussions.microsoft.com> wrote in message
news:7D66188B-9C98-42B3-8989-8CC23E7C97DC@.microsoft.com...
> is there any combination of permissions or a role that will let a user view
> stored procedures and their success without being able to modify them? Thanks.|||Sorry, I meant view jobs... in the Jobs viewer in Enterprise Manager. Is
there a combination of permissions or a role that would let a user view a job
and check its success without being able to modify it in any way. Thanks.
"Tibor Karaszi" wrote:
> What do you exactly mean by "view stored procedures"? Look at the source code? Everyone can do that
> unless you have encrypted the procedure (then no-one can do that).
> Also, what do you mean by "and their success"?
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
>
> "J Jetson" <JJetson@.discussions.microsoft.com> wrote in message
> news:7D66188B-9C98-42B3-8989-8CC23E7C97DC@.microsoft.com...
> > is there any combination of permissions or a role that will let a user view
> > stored procedures and their success without being able to modify them? Thanks.
>
>|||There is no such feature. SQL Server Agent doesn't have any "role" scheme or similar. You could try
playing with the TargetServersRole. It *might* do what you want, but it is designed for something
else...
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"J Jetson" <JJetson@.discussions.microsoft.com> wrote in message
news:F0678877-B513-4AC6-BE4F-DA44830D9048@.microsoft.com...
> Sorry, I meant view jobs... in the Jobs viewer in Enterprise Manager. Is
> there a combination of permissions or a role that would let a user view a job
> and check its success without being able to modify it in any way. Thanks.
> "Tibor Karaszi" wrote:
> > What do you exactly mean by "view stored procedures"? Look at the source code? Everyone can do
that
> > unless you have encrypted the procedure (then no-one can do that).
> >
> > Also, what do you mean by "and their success"?
> >
> > --
> > Tibor Karaszi, SQL Server MVP
> > http://www.karaszi.com/sqlserver/default.asp
> > http://www.solidqualitylearning.com/
> >
> >
> > "J Jetson" <JJetson@.discussions.microsoft.com> wrote in message
> > news:7D66188B-9C98-42B3-8989-8CC23E7C97DC@.microsoft.com...
> > > is there any combination of permissions or a role that will let a user view
> > > stored procedures and their success without being able to modify them? Thanks.
> >
> >
> >

permissions to run start and stop jobs

Using SS2000 SP4. I have a user who is able to start and stop jobs. The user
only has db_owner permissions in a few databases. Should someone who is in
the db_owner role be able to start and stop jobs or run dts packages?
The user didn't used to be able to even see the jobs so I'm not sure what
changed.
--
Dan D.Normally, a user needs to be a member of sysadmins SQL
server role to start and stop any and all jobs. If not a
sysadmin, the user can only start and stop jobs that they
own.
Who owns the jobs? If the user owns the jobs, they can start
and stop the job. Also, did you verify that the user is
really using their login? Maybe they have EM registered with
a sysadmin login - that wouldn't be too hard to see in
sysprocesses when the user is connected - just check with
the hostname, program_name, loginame.
Another thing to check would be if the user is actually in
the sysamin server role inherited through Windows group
membership. If you left the BUILTIN\Administrators login in
SQL Server set to the default, was the user added to the
local administrators group on the server? That would be one
way...other ways would depend on what Windows groups are in
the syadmin SQL Server role. Then check to see if that user
is a member of any Windows group.
-Sue
On Thu, 7 Sep 2006 07:42:02 -0700, Dan D.
<DanD@.discussions.microsoft.com> wrote:

>Using SS2000 SP4. I have a user who is able to start and stop jobs. The use
r
>only has db_owner permissions in a few databases. Should someone who is in
>the db_owner role be able to start and stop jobs or run dts packages?
>The user didn't used to be able to even see the jobs so I'm not sure what
>changed.|||BUILTIN\Administrators doesn't exist. Domain\Administrator and Administrator
exist but they do not have any sysadmin type permissions.
I have another domain user setup and is the login for the SQLServer Agent
service and that user owns all jobs.
We checked the administrator groups for the domain and locally and the users
are not in there or part of a group that is in the admin group.
How would the user show up in sysprocesses? I see several entries for 'sa'
but they're all in the master database and background except for one that ha
s
'no database context' and is sleeping. Same for 'system' user.
There is an 'NT Authority\System' login that has sysadmin permisions. Is
there any way a user could use that login?
Thanks for so many choices.
--
Dan D.
"Sue Hoegemeier" wrote:

> Normally, a user needs to be a member of sysadmins SQL
> server role to start and stop any and all jobs. If not a
> sysadmin, the user can only start and stop jobs that they
> own.
> Who owns the jobs? If the user owns the jobs, they can start
> and stop the job. Also, did you verify that the user is
> really using their login? Maybe they have EM registered with
> a sysadmin login - that wouldn't be too hard to see in
> sysprocesses when the user is connected - just check with
> the hostname, program_name, loginame.
> Another thing to check would be if the user is actually in
> the sysamin server role inherited through Windows group
> membership. If you left the BUILTIN\Administrators login in
> SQL Server set to the default, was the user added to the
> local administrators group on the server? That would be one
> way...other ways would depend on what Windows groups are in
> the syadmin SQL Server role. Then check to see if that user
> is a member of any Windows group.
> -Sue
> On Thu, 7 Sep 2006 07:42:02 -0700, Dan D.
> <DanD@.discussions.microsoft.com> wrote:
>
>|||Well...the user needs to be connected to see them in
sysprocesses. You'd want to know what PC they use - that
would show up in hostname.
But probably stepping back a bit is a good idea. All the
same things I posted apply but how do you know the user is
executing jobs? Do you know how the user is executing jobs -
such as does the user connect from Enterprise Manager and
just start and stop jobs at will?
-Sue
On Thu, 7 Sep 2006 09:14:02 -0700, Dan D.
<DanD@.discussions.microsoft.com> wrote:

>BUILTIN\Administrators doesn't exist. Domain\Administrator and Administrato
r
>exist but they do not have any sysadmin type permissions.
>I have another domain user setup and is the login for the SQLServer Agent
>service and that user owns all jobs.
>We checked the administrator groups for the domain and locally and the user
s
>are not in there or part of a group that is in the admin group.
>How would the user show up in sysprocesses? I see several entries for 'sa'
>but they're all in the master database and background except for one that h
as
>'no database context' and is sleeping. Same for 'system' user.
>There is an 'NT Authority\System' login that has sysadmin permisions. Is
>there any way a user could use that login?
>Thanks for so many choices.|||The user said that he could start a job. And I know that someone stopped a
job the other day. Also, the user said that he could backup the database.
I'll keep an eye on the hostname and see if anyone is logged on as 'sa'. I
also might change the 'sa' password on this server.
Thanks for your suggestions.
--
Dan D.
"Sue Hoegemeier" wrote:

> Well...the user needs to be connected to see them in
> sysprocesses. You'd want to know what PC they use - that
> would show up in hostname.
> But probably stepping back a bit is a good idea. All the
> same things I posted apply but how do you know the user is
> executing jobs? Do you know how the user is executing jobs -
> such as does the user connect from Enterprise Manager and
> just start and stop jobs at will?
> -Sue
> On Thu, 7 Sep 2006 09:14:02 -0700, Dan D.
> <DanD@.discussions.microsoft.com> wrote:
>
>|||Yup...changing he password in case they got ahold of that is
a good idea. You may also want to run a trace when the user
is at work. Had to do those before. You tend to find other
more interesting activities they do. Often has some
entertainment value if nothing else.
-Sue
On Fri, 8 Sep 2006 11:22:01 -0700, Dan D.
<DanD@.discussions.microsoft.com> wrote:

>The user said that he could start a job. And I know that someone stopped a
>job the other day. Also, the user said that he could backup the database.
>I'll keep an eye on the hostname and see if anyone is logged on as 'sa'. I
>also might change the 'sa' password on this server.
>Thanks for your suggestions.|||A little extra entertainment is good. Thanks.
--
Dan D.
"Sue Hoegemeier" wrote:

> Yup...changing he password in case they got ahold of that is
> a good idea. You may also want to run a trace when the user
> is at work. Had to do those before. You tend to find other
> more interesting activities they do. Often has some
> entertainment value if nothing else.
> -Sue
> On Fri, 8 Sep 2006 11:22:01 -0700, Dan D.
> <DanD@.discussions.microsoft.com> wrote:
>
>sql

permissions to run start and stop jobs

Using SS2000 SP4. I have a user who is able to start and stop jobs. The user
only has db_owner permissions in a few databases. Should someone who is in
the db_owner role be able to start and stop jobs or run dts packages?
The user didn't used to be able to even see the jobs so I'm not sure what
changed.
--
Dan D.Normally, a user needs to be a member of sysadmins SQL
server role to start and stop any and all jobs. If not a
sysadmin, the user can only start and stop jobs that they
own.
Who owns the jobs? If the user owns the jobs, they can start
and stop the job. Also, did you verify that the user is
really using their login? Maybe they have EM registered with
a sysadmin login - that wouldn't be too hard to see in
sysprocesses when the user is connected - just check with
the hostname, program_name, loginame.
Another thing to check would be if the user is actually in
the sysamin server role inherited through Windows group
membership. If you left the BUILTIN\Administrators login in
SQL Server set to the default, was the user added to the
local administrators group on the server? That would be one
way...other ways would depend on what Windows groups are in
the syadmin SQL Server role. Then check to see if that user
is a member of any Windows group.
-Sue
On Thu, 7 Sep 2006 07:42:02 -0700, Dan D.
<DanD@.discussions.microsoft.com> wrote:
>Using SS2000 SP4. I have a user who is able to start and stop jobs. The user
>only has db_owner permissions in a few databases. Should someone who is in
>the db_owner role be able to start and stop jobs or run dts packages?
>The user didn't used to be able to even see the jobs so I'm not sure what
>changed.|||BUILTIN\Administrators doesn't exist. Domain\Administrator and Administrator
exist but they do not have any sysadmin type permissions.
I have another domain user setup and is the login for the SQLServer Agent
service and that user owns all jobs.
We checked the administrator groups for the domain and locally and the users
are not in there or part of a group that is in the admin group.
How would the user show up in sysprocesses? I see several entries for 'sa'
but they're all in the master database and background except for one that has
'no database context' and is sleeping. Same for 'system' user.
There is an 'NT Authority\System' login that has sysadmin permisions. Is
there any way a user could use that login?
Thanks for so many choices.:)
--
Dan D.
"Sue Hoegemeier" wrote:
> Normally, a user needs to be a member of sysadmins SQL
> server role to start and stop any and all jobs. If not a
> sysadmin, the user can only start and stop jobs that they
> own.
> Who owns the jobs? If the user owns the jobs, they can start
> and stop the job. Also, did you verify that the user is
> really using their login? Maybe they have EM registered with
> a sysadmin login - that wouldn't be too hard to see in
> sysprocesses when the user is connected - just check with
> the hostname, program_name, loginame.
> Another thing to check would be if the user is actually in
> the sysamin server role inherited through Windows group
> membership. If you left the BUILTIN\Administrators login in
> SQL Server set to the default, was the user added to the
> local administrators group on the server? That would be one
> way...other ways would depend on what Windows groups are in
> the syadmin SQL Server role. Then check to see if that user
> is a member of any Windows group.
> -Sue
> On Thu, 7 Sep 2006 07:42:02 -0700, Dan D.
> <DanD@.discussions.microsoft.com> wrote:
> >Using SS2000 SP4. I have a user who is able to start and stop jobs. The user
> >only has db_owner permissions in a few databases. Should someone who is in
> >the db_owner role be able to start and stop jobs or run dts packages?
> >
> >The user didn't used to be able to even see the jobs so I'm not sure what
> >changed.
>|||Well...the user needs to be connected to see them in
sysprocesses. You'd want to know what PC they use - that
would show up in hostname.
But probably stepping back a bit is a good idea. All the
same things I posted apply but how do you know the user is
executing jobs? Do you know how the user is executing jobs -
such as does the user connect from Enterprise Manager and
just start and stop jobs at will?
-Sue
On Thu, 7 Sep 2006 09:14:02 -0700, Dan D.
<DanD@.discussions.microsoft.com> wrote:
>BUILTIN\Administrators doesn't exist. Domain\Administrator and Administrator
>exist but they do not have any sysadmin type permissions.
>I have another domain user setup and is the login for the SQLServer Agent
>service and that user owns all jobs.
>We checked the administrator groups for the domain and locally and the users
>are not in there or part of a group that is in the admin group.
>How would the user show up in sysprocesses? I see several entries for 'sa'
>but they're all in the master database and background except for one that has
>'no database context' and is sleeping. Same for 'system' user.
>There is an 'NT Authority\System' login that has sysadmin permisions. Is
>there any way a user could use that login?
>Thanks for so many choices.:)|||The user said that he could start a job. And I know that someone stopped a
job the other day. Also, the user said that he could backup the database.
I'll keep an eye on the hostname and see if anyone is logged on as 'sa'. I
also might change the 'sa' password on this server.
Thanks for your suggestions.
--
Dan D.
"Sue Hoegemeier" wrote:
> Well...the user needs to be connected to see them in
> sysprocesses. You'd want to know what PC they use - that
> would show up in hostname.
> But probably stepping back a bit is a good idea. All the
> same things I posted apply but how do you know the user is
> executing jobs? Do you know how the user is executing jobs -
> such as does the user connect from Enterprise Manager and
> just start and stop jobs at will?
> -Sue
> On Thu, 7 Sep 2006 09:14:02 -0700, Dan D.
> <DanD@.discussions.microsoft.com> wrote:
> >BUILTIN\Administrators doesn't exist. Domain\Administrator and Administrator
> >exist but they do not have any sysadmin type permissions.
> >
> >I have another domain user setup and is the login for the SQLServer Agent
> >service and that user owns all jobs.
> >
> >We checked the administrator groups for the domain and locally and the users
> >are not in there or part of a group that is in the admin group.
> >
> >How would the user show up in sysprocesses? I see several entries for 'sa'
> >but they're all in the master database and background except for one that has
> >'no database context' and is sleeping. Same for 'system' user.
> >
> >There is an 'NT Authority\System' login that has sysadmin permisions. Is
> >there any way a user could use that login?
> >
> >Thanks for so many choices.:)
>|||Yup...changing he password in case they got ahold of that is
a good idea. You may also want to run a trace when the user
is at work. Had to do those before. You tend to find other
more interesting activities they do. Often has some
entertainment value if nothing else.
-Sue
On Fri, 8 Sep 2006 11:22:01 -0700, Dan D.
<DanD@.discussions.microsoft.com> wrote:
>The user said that he could start a job. And I know that someone stopped a
>job the other day. Also, the user said that he could backup the database.
>I'll keep an eye on the hostname and see if anyone is logged on as 'sa'. I
>also might change the 'sa' password on this server.
>Thanks for your suggestions.|||A little extra entertainment is good. Thanks.
--
Dan D.
"Sue Hoegemeier" wrote:
> Yup...changing he password in case they got ahold of that is
> a good idea. You may also want to run a trace when the user
> is at work. Had to do those before. You tend to find other
> more interesting activities they do. Often has some
> entertainment value if nothing else.
> -Sue
> On Fri, 8 Sep 2006 11:22:01 -0700, Dan D.
> <DanD@.discussions.microsoft.com> wrote:
> >The user said that he could start a job. And I know that someone stopped a
> >job the other day. Also, the user said that he could backup the database.
> >
> >I'll keep an eye on the hostname and see if anyone is logged on as 'sa'. I
> >also might change the 'sa' password on this server.
> >
> >Thanks for your suggestions.
>

Permissions required to run DTS packages and jobs

What SQL Server permission(s) are required to run DTS packages and jobs in
SQL Server 2000 and SQL Server 2005?
Thank you.
--
MikeMike
SQL Server 2000
1) You are the owner of the package
2) Jobs are ran under account that SQL Server Agent are runing under.
3) Lookuop TargerServerRole in the BOL
SQL Server 2005
1) I haven't played to much with this issue. If I remember well you can
create a proxy account to run jobs
with an acount that is not a member of sysadmin server role.
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:57249ED9-D4A8-4733-BF06-F903C65CCD83@.microsoft.com...
> What SQL Server permission(s) are required to run DTS packages and jobs in
> SQL Server 2000 and SQL Server 2005?
> Thank you.
> --
> Mikesql

Permissions question

Hi,
I need to give access to a domain user group DOMAIN\Developers so that they
can ONLY start/stop SQL Jobs. Which is the best role to grant.
Thanks
Reddipermissions to run sp_stop_job and sp_start_job(msdb) plus permissions to
execute xp_sqlagent_enum_jobs(master) if accounts are not in sysadmins
and/or do not own the sqlagent jobs
"Reddi" <Reddi@.discussions.microsoft.com> wrote in message
news:2F34F361-C7B3-426B-AAC2-976E93039EC6@.microsoft.com...
> Hi,
> I need to give access to a domain user group DOMAIN\Developers so that
they
> can ONLY start/stop SQL Jobs. Which is the best role to grant.
> Thanks
> Reddi

Permissions Issue Not Allowing Job Run

Hi,
I'm having a problem running jobs. I can not get my test
backup job to work. The job history indicates that
Servername\Administrator can't be determined to have
server access. I recently changed from Windows
Authentication to SQL and Windows.
I'm going through the SQL Server 2000 Administration
Training Kit. I believe that the account that should have
been used is Domainname\Administrator. Also, when I setup
my server initially, which is a domain controller, I used
SelfPacedSQL.local rather than SelfPacedSQL.msft as
instructed, because I could get the .msft domain suffix.
I'm new to Active Directory. Please help.You may be running into a problem with Domain local groups.
825042 FIX: SQL Server Jobs That Are Owned by Non-sysadmin Users May Not
Start
http://support.microsoft.com/?id=825042
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.

Permission/role needed to both modify and execute jobs

What SQL Server permission(s) are required to both modify and execute jobs in
SQL Server 2000 and SQL Server 2005?
Thank you.
--
MikeMike
You posted this in microsoft.public.sqlserver.security on 6 Jan, and
microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
John
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
> What SQL Server permission(s) are required to both modify and execute jobs
> in
> SQL Server 2000 and SQL Server 2005?
> Thank you.
> --
> Mike|||I don 't see an answer for SQL Server 2005 (please see below). Any help
would be appreciated. Thank you.
SQL Server 2005
1) I haven't played to much with this issue. If I remember well you can
create a proxy account to run jobs
with an acount that is not a member of sysadmin server role.
--
Mike
"John Bell" wrote:
> Mike
> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
> John
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
> > What SQL Server permission(s) are required to both modify and execute jobs
> > in
> > SQL Server 2000 and SQL Server 2005?
> >
> > Thank you.
> > --
> > Mike
>
>|||Additionally, if you would have read my new questions, you would have noticed
that they had changed from just run, to both modify and run/execute.
Thank you.
--
Mike
"John Bell" wrote:
> Mike
> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
> John
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
> > What SQL Server permission(s) are required to both modify and execute jobs
> > in
> > SQL Server 2000 and SQL Server 2005?
> >
> > Thank you.
> > --
> > Mike
>
>|||BOL for 2005 has lots of very good information on this subject. Much more
than you can expect someone to post here. There is no reason to reinvent the
wheel so have a look at this section of BOL for a start.
ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/d728a2f5-6a2d-40f7-aba7-ed51b930072d.htm
Andrew J. Kelly SQL MVP
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
>I don 't see an answer for SQL Server 2005 (please see below). Any help
> would be appreciated. Thank you.
> SQL Server 2005
> 1) I haven't played to much with this issue. If I remember well you can
> create a proxy account to run jobs
> with an acount that is not a member of sysadmin server role.
> --
> Mike
>
> "John Bell" wrote:
>> Mike
>> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
>> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
>> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
>> John
>> "Mike" <Mike@.discussions.microsoft.com> wrote in message
>> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
>> > What SQL Server permission(s) are required to both modify and execute
>> > jobs
>> > in
>> > SQL Server 2000 and SQL Server 2005?
>> >
>> > Thank you.
>> > --
>> > Mike
>>|||Are you a Microsoft employee? If not, I still don't have answers for the
question below. Microsoft, if you could please help, I would highly
appreciate it.
Are different permissions required to both modify and run SQL Server 2000
jobs and DTS packages?
Thank you.
--
Mike
"Andrew J. Kelly" wrote:
> BOL for 2005 has lots of very good information on this subject. Much more
> than you can expect someone to post here. There is no reason to reinvent the
> wheel so have a look at this section of BOL for a start.
> ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/d728a2f5-6a2d-40f7-aba7-ed51b930072d.htm
>
> --
> Andrew J. Kelly SQL MVP
>
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
> >I don 't see an answer for SQL Server 2005 (please see below). Any help
> > would be appreciated. Thank you.
> >
> > SQL Server 2005
> >
> > 1) I haven't played to much with this issue. If I remember well you can
> > create a proxy account to run jobs
> > with an acount that is not a member of sysadmin server role.
> > --
> > Mike
> >
> >
> > "John Bell" wrote:
> >
> >> Mike
> >>
> >> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
> >> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
> >> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
> >>
> >> John
> >>
> >> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> >> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
> >> > What SQL Server permission(s) are required to both modify and execute
> >> > jobs
> >> > in
> >> > SQL Server 2000 and SQL Server 2005?
> >> >
> >> > Thank you.
> >> > --
> >> > Mike
> >>
> >>
> >>
>
>|||What does my employment status have to do with if you have an answer or not?
You specifically stated that you needed an answer for SQL2005. This is from
your last post:
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
> >I don 't see an answer for SQL Server 2005 (please see below). Any help
> > would be appreciated. Thank you.
> >
And here is the answer that Allan Mitchell gave you in the DTS group that
you cross posted to.
Hello mike,
In 2K, So long as you can access the package you can change it.
In 2K5 a way of implementing security can be found here in BOL
ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/extran9/html/9702e90c-fada-4978-a473-1b1423017d80.htm
<<
You replied:
Thank you, and have a great weekend.
--
Mike
<<
So I am confused as to what you really want. Do you just not trust the
answers since we are not MS employees or is there something else?
Andrew J. Kelly SQL MVP
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:E42F971F-E556-4D5B-9203-2AF587D4A7A6@.microsoft.com...
> Are you a Microsoft employee? If not, I still don't have answers for the
> question below. Microsoft, if you could please help, I would highly
> appreciate it.
> Are different permissions required to both modify and run SQL Server 2000
> jobs and DTS packages?
> Thank you.
> --
> Mike
>
> "Andrew J. Kelly" wrote:
>> BOL for 2005 has lots of very good information on this subject. Much
>> more
>> than you can expect someone to post here. There is no reason to reinvent
>> the
>> wheel so have a look at this section of BOL for a start.
>> ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/d728a2f5-6a2d-40f7-aba7-ed51b930072d.htm
>>
>> --
>> Andrew J. Kelly SQL MVP
>>
>> "Mike" <Mike@.discussions.microsoft.com> wrote in message
>> news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
>> >I don 't see an answer for SQL Server 2005 (please see below). Any help
>> > would be appreciated. Thank you.
>> >
>> > SQL Server 2005
>> >
>> > 1) I haven't played to much with this issue. If I remember well you can
>> > create a proxy account to run jobs
>> > with an acount that is not a member of sysadmin server role.
>> > --
>> > Mike
>> >
>> >
>> > "John Bell" wrote:
>> >
>> >> Mike
>> >>
>> >> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
>> >> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to
>> >> this.
>> >> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
>> >>
>> >> John
>> >>
>> >> "Mike" <Mike@.discussions.microsoft.com> wrote in message
>> >> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
>> >> > What SQL Server permission(s) are required to both modify and
>> >> > execute
>> >> > jobs
>> >> > in
>> >> > SQL Server 2000 and SQL Server 2005?
>> >> >
>> >> > Thank you.
>> >> > --
>> >> > Mike
>> >>
>> >>
>> >>
>>|||The BOL link that Andy posted has 100% of the information you are looking
for in it. Microsoft spends millions on writing BOL, so that answers to at
least 80% or more of the questions that could get asked are already
answered, as long as people actually read it.
Someone's employment status has absolutely nothing whatsoever to do with
posting an answer. No, Andy isn't a Microsoft employee and that is
completely irrelevant. He is a SQL Server MVP and has been for a long time.
The MVP program was created to provide online support for customers of
products. With a few exceptions, the people in the MVP program are the best
information resources that exist in the industry.
If you want anyone to actually answer your questions, then I'd suggest that
you don't insult people who take their time to answer questions.
--
Mike
Mentor
Solid Quality Learning
http://www.solidqualitylearning.com
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:E42F971F-E556-4D5B-9203-2AF587D4A7A6@.microsoft.com...
> Are you a Microsoft employee? If not, I still don't have answers for the
> question below. Microsoft, if you could please help, I would highly
> appreciate it.
> Are different permissions required to both modify and run SQL Server 2000
> jobs and DTS packages?
> Thank you.
> --
> Mike
>
> "Andrew J. Kelly" wrote:
>> BOL for 2005 has lots of very good information on this subject. Much
>> more
>> than you can expect someone to post here. There is no reason to reinvent
>> the
>> wheel so have a look at this section of BOL for a start.
>> ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/d728a2f5-6a2d-40f7-aba7-ed51b930072d.htm
>>
>> --
>> Andrew J. Kelly SQL MVP
>>
>> "Mike" <Mike@.discussions.microsoft.com> wrote in message
>> news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
>> >I don 't see an answer for SQL Server 2005 (please see below). Any help
>> > would be appreciated. Thank you.
>> >
>> > SQL Server 2005
>> >
>> > 1) I haven't played to much with this issue. If I remember well you can
>> > create a proxy account to run jobs
>> > with an acount that is not a member of sysadmin server role.
>> > --
>> > Mike
>> >
>> >
>> > "John Bell" wrote:
>> >
>> >> Mike
>> >>
>> >> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
>> >> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to
>> >> this.
>> >> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
>> >>
>> >> John
>> >>
>> >> "Mike" <Mike@.discussions.microsoft.com> wrote in message
>> >> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
>> >> > What SQL Server permission(s) are required to both modify and
>> >> > execute
>> >> > jobs
>> >> > in
>> >> > SQL Server 2000 and SQL Server 2005?
>> >> >
>> >> > Thank you.
>> >> > --
>> >> > Mike
>> >>
>> >>
>> >>
>>

Permission/role needed to both modify and execute jobs

What SQL Server permission(s) are required to both modify and execute jobs in
SQL Server 2000 and SQL Server 2005?
Thank you.
Mike
Mike
You posted this in microsoft.public.sqlserver.security on 6 Jan, and
microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
John
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
> What SQL Server permission(s) are required to both modify and execute jobs
> in
> SQL Server 2000 and SQL Server 2005?
> Thank you.
> --
> Mike
|||I don 't see an answer for SQL Server 2005 (please see below). Any help
would be appreciated. Thank you.
SQL Server 2005
1) I haven't played to much with this issue. If I remember well you can
create a proxy account to run jobs
with an acount that is not a member of sysadmin server role.
Mike
"John Bell" wrote:

> Mike
> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
> John
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
>
>
|||Additionally, if you would have read my new questions, you would have noticed
that they had changed from just run, to both modify and run/execute.
Thank you.
Mike
"John Bell" wrote:

> Mike
> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
> John
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
>
>
|||BOL for 2005 has lots of very good information on this subject. Much more
than you can expect someone to post here. There is no reason to reinvent the
wheel so have a look at this section of BOL for a start.
ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/d728a2f5-6a2d-40f7-aba7-ed51b930072d.htm
Andrew J. Kelly SQL MVP
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...[vbcol=seagreen]
>I don 't see an answer for SQL Server 2005 (please see below). Any help
> would be appreciated. Thank you.
> SQL Server 2005
> 1) I haven't played to much with this issue. If I remember well you can
> create a proxy account to run jobs
> with an acount that is not a member of sysadmin server role.
> --
> Mike
>
> "John Bell" wrote:
|||Are you a Microsoft employee? If not, I still don't have answers for the
question below. Microsoft, if you could please help, I would highly
appreciate it.
Are different permissions required to both modify and run SQL Server 2000
jobs and DTS packages?
Thank you.
Mike
"Andrew J. Kelly" wrote:

> BOL for 2005 has lots of very good information on this subject. Much more
> than you can expect someone to post here. There is no reason to reinvent the
> wheel so have a look at this section of BOL for a start.
> ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/d728a2f5-6a2d-40f7-aba7-ed51b930072d.htm
>
> --
> Andrew J. Kelly SQL MVP
>
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
>
>
|||What does my employment status have to do with if you have an answer or not?
You specifically stated that you needed an answer for SQL2005. This is from
your last post:
[vbcol=seagreen]
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
And here is the answer that Allan Mitchell gave you in the DTS group that
you cross posted to.
[vbcol=seagreen]
Hello mike,
In 2K, So long as you can access the package you can change it.
In 2K5 a way of implementing security can be found here in BOL
ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/extran9/html/9702e90c-fada-4978-a473-1b1423017d80.htm
<<
You replied:
[vbcol=seagreen]
Thank you, and have a great weekend.
Mike
<<
So I am confused as to what you really want. Do you just not trust the
answers since we are not MS employees or is there something else?
Andrew J. Kelly SQL MVP
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:E42F971F-E556-4D5B-9203-2AF587D4A7A6@.microsoft.com...[vbcol=seagreen]
> Are you a Microsoft employee? If not, I still don't have answers for the
> question below. Microsoft, if you could please help, I would highly
> appreciate it.
> Are different permissions required to both modify and run SQL Server 2000
> jobs and DTS packages?
> Thank you.
> --
> Mike
>
> "Andrew J. Kelly" wrote:
|||The BOL link that Andy posted has 100% of the information you are looking
for in it. Microsoft spends millions on writing BOL, so that answers to at
least 80% or more of the questions that could get asked are already
answered, as long as people actually read it.
Someone's employment status has absolutely nothing whatsoever to do with
posting an answer. No, Andy isn't a Microsoft employee and that is
completely irrelevant. He is a SQL Server MVP and has been for a long time.
The MVP program was created to provide online support for customers of
products. With a few exceptions, the people in the MVP program are the best
information resources that exist in the industry.
If you want anyone to actually answer your questions, then I'd suggest that
you don't insult people who take their time to answer questions.
Mike
Mentor
Solid Quality Learning
http://www.solidqualitylearning.com
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:E42F971F-E556-4D5B-9203-2AF587D4A7A6@.microsoft.com...[vbcol=seagreen]
> Are you a Microsoft employee? If not, I still don't have answers for the
> question below. Microsoft, if you could please help, I would highly
> appreciate it.
> Are different permissions required to both modify and run SQL Server 2000
> jobs and DTS packages?
> Thank you.
> --
> Mike
>
> "Andrew J. Kelly" wrote:

Permission/role needed to both modify and execute jobs

What SQL Server permission(s) are required to both modify and execute jobs i
n
SQL Server 2000 and SQL Server 2005?
Thank you.
--
MikeMike
You posted this in microsoft.public.sqlserver.security on 6 Jan, and
microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
John
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
> What SQL Server permission(s) are required to both modify and execute jobs
> in
> SQL Server 2000 and SQL Server 2005?
> Thank you.
> --
> Mike|||I don 't see an answer for SQL Server 2005 (please see below). Any help
would be appreciated. Thank you.
SQL Server 2005
1) I haven't played to much with this issue. If I remember well you can
create a proxy account to run jobs
with an acount that is not a member of sysadmin server role.
--
Mike
"John Bell" wrote:

> Mike
> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
> John
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
>
>|||Additionally, if you would have read my new questions, you would have notice
d
that they had changed from just run, to both modify and run/execute.
Thank you.
--
Mike
"John Bell" wrote:

> Mike
> You posted this in microsoft.public.sqlserver.security on 6 Jan, and
> microsoft.public.sqlserver.dts 8 Jan Uri and Allan have replied to this.
> Please do not muti-post http://www.aspfaq.com/etiquette.asp?id=5003
> John
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:1767DE69-A68F-44AD-A821-924352B87079@.microsoft.com...
>
>|||BOL for 2005 has lots of very good information on this subject. Much more
than you can expect someone to post here. There is no reason to reinvent the
wheel so have a look at this section of BOL for a start.
ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/d728a2f5-6a2d-40f7-aba7-ed51
b930072d.htm
Andrew J. Kelly SQL MVP
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...[vbcol=seagreen]
>I don 't see an answer for SQL Server 2005 (please see below). Any help
> would be appreciated. Thank you.
> SQL Server 2005
> 1) I haven't played to much with this issue. If I remember well you can
> create a proxy account to run jobs
> with an acount that is not a member of sysadmin server role.
> --
> Mike
>
> "John Bell" wrote:
>|||Are you a Microsoft employee? If not, I still don't have answers for the
question below. Microsoft, if you could please help, I would highly
appreciate it.
Are different permissions required to both modify and run SQL Server 2000
jobs and DTS packages?
Thank you.
--
Mike
"Andrew J. Kelly" wrote:

> BOL for 2005 has lots of very good information on this subject. Much more
> than you can expect someone to post here. There is no reason to reinvent t
he
> wheel so have a look at this section of BOL for a start.
> ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/d728a2f5-6a2d-40f7-aba7-ed
51b930072d.htm
>
> --
> Andrew J. Kelly SQL MVP
>
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
>
>|||What does my employment status have to do with if you have an answer or not?
You specifically stated that you needed an answer for SQL2005. This is from
your last post:
[vbcol=seagreen]
> "Mike" <Mike@.discussions.microsoft.com> wrote in message
> news:63F20246-5FAC-421F-9A2E-80C68064226F@.microsoft.com...
And here is the answer that Allan Mitchell gave you in the DTS group that
you cross posted to.
[vbcol=seagreen]
Hello mike,
In 2K, So long as you can access the package you can change it.
In 2K5 a way of implementing security can be found here in BOL
ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/extran9/html/9702e90c-fada-4978-a473-1
b1423017d80.htm
<<
You replied:
[vbcol=seagreen]
Thank you, and have a great weekend.
--
Mike
<<
So I am confused as to what you really want. Do you just not trust the
answers since we are not MS employees or is there something else?
Andrew J. Kelly SQL MVP
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:E42F971F-E556-4D5B-9203-2AF587D4A7A6@.microsoft.com...[vbcol=seagreen]
> Are you a Microsoft employee? If not, I still don't have answers for the
> question below. Microsoft, if you could please help, I would highly
> appreciate it.
> Are different permissions required to both modify and run SQL Server 2000
> jobs and DTS packages?
> Thank you.
> --
> Mike
>
> "Andrew J. Kelly" wrote:
>|||The BOL link that Andy posted has 100% of the information you are looking
for in it. Microsoft spends millions on writing BOL, so that answers to at
least 80% or more of the questions that could get asked are already
answered, as long as people actually read it.
Someone's employment status has absolutely nothing whatsoever to do with
posting an answer. No, Andy isn't a Microsoft employee and that is
completely irrelevant. He is a SQL Server MVP and has been for a long time.
The MVP program was created to provide online support for customers of
products. With a few exceptions, the people in the MVP program are the best
information resources that exist in the industry.
If you want anyone to actually answer your questions, then I'd suggest that
you don't insult people who take their time to answer questions.
Mike
Mentor
Solid Quality Learning
http://www.solidqualitylearning.com
"Mike" <Mike@.discussions.microsoft.com> wrote in message
news:E42F971F-E556-4D5B-9203-2AF587D4A7A6@.microsoft.com...[vbcol=seagreen]
> Are you a Microsoft employee? If not, I still don't have answers for the
> question below. Microsoft, if you could please help, I would highly
> appreciate it.
> Are different permissions required to both modify and run SQL Server 2000
> jobs and DTS packages?
> Thank you.
> --
> Mike
>
> "Andrew J. Kelly" wrote:
>

Permission to view only jobs

Hi
what are the permissions to be given for sql user if I
want him to see only jobs listed in the jobs section
under sql agent.
I tried giving ready only permissions on msdb & execute
permissions on sp_help_jobhistory. But still user cant
see the jobs listed.
Help will be appreciated.
Thanks,
ManojPlace him in the TargetServersRole role in msdb. He will not be able to
create or alter jobs, but can see them all.
Russell Fields
"Manoj Gadhia" <manoj.gadhia@.upbna.com> wrote in message
news:178501c47bd2$4efdc8e0$a601280a@.phx.gbl...
> Hi
> what are the permissions to be given for sql user if I
> want him to see only jobs listed in the jobs section
> under sql agent.
> I tried giving ready only permissions on msdb & execute
> permissions on sp_help_jobhistory. But still user cant
> see the jobs listed.
> Help will be appreciated.
> Thanks,
> Manoj|||Thanks
It worked Great
Manoj
>--Original Message--
>Place him in the TargetServersRole role in msdb. He
will not be able to
>create or alter jobs, but can see them all.
>Russell Fields
>"Manoj Gadhia" <manoj.gadhia@.upbna.com> wrote in message
>news:178501c47bd2$4efdc8e0$a601280a@.phx.gbl...
execute[vbcol=seagreen]
>
>.
>

Permission to run the schduled jobs

Hi,
What permission / privilege / role should be given to a user who can
just run the scheduled jobs without modifying the jobs or any other
database access?
Thanks
John Jayaseelan
*** Sent via Developersdex http://www.examnotes.net ***
Don't just participate in USENET...get rewarded for it!John,
I do not think that you can. You may have to write an app that logins with a
powerful enough account and present a list of jobs with a start button. If
they own the job they could do it, but then they can change the job.
From the BOL for sp_start_job:
Execute permissions default to the public role in the msdb database. A user
who can execute this procedure and is a member of the sysadmin fixed role ca
n start any job. A user who is not a member of the sysadmin role can use sp_
start_job to start only the
jobs he/she owns.
Norman

Permission to execute specific jobs only

Is there a way to grant a group of users the ability to execute some jobs on a server, but restrict their access to others.

We'd like to grant our developers the permission to execute their jobs (many developers and we'd like to avoid a shared account) without giving them the ability to execute our backup, reindex, etc jobs.

Is there a way to grant execute on some jobs, but not all to a Windows group?

We're using the new msdb SQLAgent role to allow them to see all jobs and view output, but there doesn't seem to be a way to grant execute on specific jobs only.

Thanks

Under normal circumstances, a user will be able to start a Job that he/she 'owns'.

Of course, success depends upon have permissions to execute each step of the Job.

|||You could consider having a table populated that indicates what the groups can do. Then make the first step of the job a query which raises an error if the permission shouldn't apply. Only continue the job if the query succeeds.

Alternatively, you could fake this by having a tiny table for each job. So you have a "sec_backup" table (with a single column and row), which is only queryable by those who also have permission to run the job.

It's not particularly elegant, but you could quite easily produce the security model you're after this way.

Rob

permission question

Hi,

I granted a domain user login:
--read only to our production db.
--db_owner to msdb.

I want this login to be able to create jobs & dts packages.
he's able to create dts packages, but when he tries to create a new job, in the db dropdown menu (steps tab) he can't see the production db. He only sees msdb, master & temp... he needs to see the production db, so that he can create a job.

please help!
MeeraHowdy

You have done the right thing allowing access to MSDB. He should be able to create DTS packages anyway ( anyone can ) .

With his login, what is his default database? Also, has his login ( not a group etc ) been actually granted access to the production database?

I say this as the Public group in a database can be emptied in the database, thereby not everyone on the server is granted access automatically to the database.

Cheers

SG|||Thanks for replying!

This guy belongs to a domain user group called dbCustomReports. So, when he registers his servers in Enterprise manager using the runas command, he'll be registered as Domain/dbCustomReports.

His default db is the production db.

The login in SQL server is actually Domain/dbCustomReports. That login has db_owner permissions on msdb & production.

Which login should I grant permissions to? I didn't follow that part of your question... (he doesn't have any individual sql server login)

Any help is appreciated.
Thanks,
Meera|||you should grant the domain/dbCustomReports access to you production database. Setting a default database does not grant access to that database. You have granted permissions to the group to which the user belongs. Be aware that anyone else belonging to that group has the same privileges in the database.|||That account has been granted db_owner priviliges to the production db & then I set the default db :)
Meera|||can the user see the production database in the enterprise manager or also only msdb, master and temp?|||in EM, the user can see the production db and all the other db (of course when he tries to see the tables, it won't let him.)

Thanks,
Meera|||How did you set up the permissions for this user? Are there any other privileges or database roles granted?|||database called CR -- db_owner
msdb -- db_owner
database called Prod -- read only

Meera|||I think you should only give read only to the first one too

Paulo

Originally posted by meeraarvind
database called CR -- db_owner
msdb -- db_owner
database called Prod -- read only

Meera

permission needed to run CmdExec job steps

Hi, Can someone tell me what permissions are needed for logins to be able
to run CmdExec Jobs'
I recently removed everyone from System Admin and have been working through
all kind of issues. I now have some jobs that fail and here is the message
that they fail with>> "Non-SysAdmins have been denied permission to run
CmdExec job steps. The step failed." There are 3 Analysts who create DTS
packages and schedule them to run at various times, so they need to own
their jobs, but what it the minimum permissions they can be provided to be
able to run these type of jobs'
Thank you..How you would go about this depends on the version of SQL
Server - it's different for all versions. Since you mention
DTS I am guessing you are on SQL Server 2000.
On 2000, if a non-sysadmin is going to be running a CmdExec
job, first you need to enable SQL Agent to allow
non-sysadmins to execute CmdExec steps. Right click on SQL
Agent, select properties and then go to the Job System tab.
From here, remove the check which restricts CmdExec and
ActiveX job steps to Sysadmins only.
You will then need to configure the proxy account. The proxy
account is the security context that will be used for the
jobs. You can find information on the proxy account as well
as some of the security issues you are running into in books
online under: xp_sqlagent_proxy_account
-Sue
On Tue, 5 Sep 2006 16:08:48 -0500, "WANNABE" <breichenbach
AT istate DOT com> wrote:

>Hi, Can someone tell me what permissions are needed for logins to be able
>to run CmdExec Jobs'
>I recently removed everyone from System Admin and have been working through
>all kind of issues. I now have some jobs that fail and here is the message
>that they fail with>> "Non-SysAdmins have been denied permission to run
>CmdExec job steps. The step failed." There are 3 Analysts who create DTS
>packages and schedule them to run at various times, so they need to own
>their jobs, but what it the minimum permissions they can be provided to be
>able to run these type of jobs'
>Thank you..
>|||Thanks Sue, You are correct SQL2000 is what I speak of. I believe you have
provided me with all the right stuff. I will read what I can find under
xp_sqlagent_proxy_account.. Thanks again.
=======================================
"Sue Hoegemeier" <Sue_H@.nomail.please> wrote in message
news:nfvrf2dp55icp6a9r02i0hfdndjp77dr4k@.
4ax.com...
> How you would go about this depends on the version of SQL
> Server - it's different for all versions. Since you mention
> DTS I am guessing you are on SQL Server 2000.
> On 2000, if a non-sysadmin is going to be running a CmdExec
> job, first you need to enable SQL Agent to allow
> non-sysadmins to execute CmdExec steps. Right click on SQL
> Agent, select properties and then go to the Job System tab.
> From here, remove the check which restricts CmdExec and
> ActiveX job steps to Sysadmins only.
> You will then need to configure the proxy account. The proxy
> account is the security context that will be used for the
> jobs. You can find information on the proxy account as well
> as some of the security issues you are running into in books
> online under: xp_sqlagent_proxy_account
> -Sue
> On Tue, 5 Sep 2006 16:08:48 -0500, "WANNABE" <breichenbach
> AT istate DOT com> wrote:
>
>

Permission for Jobs

I have a user who needs to create jobs and also manage some already existing
jobs owned by dbo. I have added her Windows domain id in MSDB data which will
allow her to create and manage her own jobs. I was trying to add her to the
TargetServersRole but this role has been denied access to stored procedures
e.g. sp_update_job in MSDB database. How can I achieve this. Please advise.
Thanks..Fraz
Only members of the sysadmin server role can alter, delete and start jobs
owned by another user. This is hardcoded into the respective system stored
procedures (sp_update_job, sp_start_job etc), so if you want you can change
these stored procedures in msdb to take out the check to see if the user is
a member of the sysadmin role or owns the job. This is unsupported though.
Jacco Schalkwijk
SQL Server MVP
"Fraz" <Fraz@.discussions.microsoft.com> wrote in message
news:43343195-6BEC-4AC6-9178-B94B92CE57D5@.microsoft.com...
>I have a user who needs to create jobs and also manage some already
>existing
> jobs owned by dbo. I have added her Windows domain id in MSDB data which
> will
> allow her to create and manage her own jobs. I was trying to add her to
> the
> TargetServersRole but this role has been denied access to stored
> procedures
> e.g. sp_update_job in MSDB database. How can I achieve this. Please
> advise.
> Thanks..Fraz

Permission for Jobs

I have a user who needs to create jobs and also manage some already existing
jobs owned by dbo. I have added her Windows domain id in MSDB data which will
allow her to create and manage her own jobs. I was trying to add her to the
TargetServersRole but this role has been denied access to stored procedures
e.g. sp_update_job in MSDB database. How can I achieve this. Please advise.
Thanks..FrazOnly members of the sysadmin server role can alter, delete and start jobs
owned by another user. This is hardcoded into the respective system stored
procedures (sp_update_job, sp_start_job etc), so if you want you can change
these stored procedures in msdb to take out the check to see if the user is
a member of the sysadmin role or owns the job. This is unsupported though.
--
Jacco Schalkwijk
SQL Server MVP
"Fraz" <Fraz@.discussions.microsoft.com> wrote in message
news:43343195-6BEC-4AC6-9178-B94B92CE57D5@.microsoft.com...
>I have a user who needs to create jobs and also manage some already
>existing
> jobs owned by dbo. I have added her Windows domain id in MSDB data which
> will
> allow her to create and manage her own jobs. I was trying to add her to
> the
> TargetServersRole but this role has been denied access to stored
> procedures
> e.g. sp_update_job in MSDB database. How can I achieve this. Please
> advise.
> Thanks..Fraz

Permission for Jobs

I have a user who needs to create jobs and also manage some already existing
jobs owned by dbo. I have added her Windows domain id in MSDB data which wil
l
allow her to create and manage her own jobs. I was trying to add her to the
TargetServersRole but this role has been denied access to stored procedures
e.g. sp_update_job in MSDB database. How can I achieve this. Please advise.
Thanks..FrazOnly members of the sysadmin server role can alter, delete and start jobs
owned by another user. This is hardcoded into the respective system stored
procedures (sp_update_job, sp_start_job etc), so if you want you can change
these stored procedures in msdb to take out the check to see if the user is
a member of the sysadmin role or owns the job. This is unsupported though.
Jacco Schalkwijk
SQL Server MVP
"Fraz" <Fraz@.discussions.microsoft.com> wrote in message
news:43343195-6BEC-4AC6-9178-B94B92CE57D5@.microsoft.com...
>I have a user who needs to create jobs and also manage some already
>existing
> jobs owned by dbo. I have added her Windows domain id in MSDB data which
> will
> allow her to create and manage her own jobs. I was trying to add her to
> the
> TargetServersRole but this role has been denied access to stored
> procedures
> e.g. sp_update_job in MSDB database. How can I achieve this. Please
> advise.
> Thanks..Fraz