Grant/Deny ddl on specific objects?
-
Is there a way to grant ddl on specific tables? It looks like the db_ddladmin role is the only one that addresses this, but it looks like it is all or nothing.
Basically, we'd like to allow users to create temp tables that can persist beyond their session being disconnected. However, we don't want them to be able to modify the production tables.
Thanks in advance!
Jon
-
How about global temp tables?? (##temp instead of #temp)
-
It is my understanding that global temp tables go away once all connections using that table are disconnected. So, if I create one and then 1 other user accesses that table, once the other user and myself disconnect, the temp table goes away. Is that not correct?
-
Pretty much. how is that not acceptable to your situation?
-
Our users get flat files from clients and set up temp tables to perform data manipulation on some large data sets thru QA. It doesn't happen a lot, but isn't uncommon. They often multi-task and/or spread their work over multiple days. They also do some work from home. So, we have a need for these tables to persist as they connect and disconnect, though. they are the only ones that access their temp tables.
-
How about creating a database for them where only that kind of data is used?
You could give them high access there and they couldn't do much damage (unless they start destroying to users tables... which could be controlled with your application?!).
-
Creating a secondary db might be an option if security doesn't provide the means.
Are there any other options?
-
If all they need to do is create tables, you could grant CREATE TABLE permission to them. However, they wouldn't be able to drop or alter the tables they create.
Greg
Greg
-
I don't know any other solutions since I've never had or met this problem. I'll keep thinking about it but I don't make any promises
.
Viewing 9 posts - 1 through 8 (of 8 total)
You must be logged in to reply to this topic. Login to reply