Precedence between AD Group permissions and explicit user permissions.

• James Lavery

  SSC Eights!

  Points: 808

  More actions

  February 3, 2010 at 6:04 am

  #138659

  Hi all,

  We've got a database which is accessed by a set of Java services, using a login called SVCAcct.

  Recently, I was asked to help sort out a separate access problem and was asked, as part of this solution, to grant access to an AD group called 'DOMAINNAME\DBNAME SQL RW' - the users in question are members of this group in AD.

  To do this, I added a login called 'DOMAINNAME\DBNAME SQL RW', and mapped it to a 'DOMAINNAME\DBNAME SQL RW' user in the database.

  It now turns out that the SVCAcct AD user is also a member of the 'DOMAINNAME\DBNAME SQL RW' AD group (unbeknown to me!), and since I added the group's login and user, the services are having problems:crying:

  What precedence is SQL going to apply in this scenario when the SVCAcct user attempts to connect - do the group login privileges override the user login?

  Thanks,

  James

• Jack Corbett

  SSC Guru

  Points: 184394

  More actions

  February 3, 2010 at 7:41 am

  #1112888

  A good place to start to understand how this works would be these 2 blog posts by K. Brian Kelley:

  http://www.sqlservercentral.com/blogs/brian_kelley/archive/2009/10/27/sql-university-diving-into-authorization.aspx

  http://www.sqlservercentral.com/blogs/brian_kelley/archive/2009/10/30/sql-university-multiple-paths-and-ownership-chaining.aspx

  Jack Corbett
  Consultant - Straight Path Solutions
  Check out these links on how to get faster and more accurate answers:
  Forum Etiquette: How to post data/code on a forum to get the best help
  Need an Answer? Actually, No ... You Need a Question