Wednesday, October 8, 2014

Preventing logins and users to see metadata in SQL Server

To hide databases to all LOGINS, remove/revoke "VIEW ANY DATABASE" permission from the public server role


USE master;
GO

REVOKE VIEW ANY DATABASE
 TO PUBLIC;



To allow only some logins to view all databases, Jus create a user-defined server role


USE master;

CREATE SERVER ROLE [DBViewer];
GO

GRANT VIEW ANY DATABASE
 TO [DBViewer];

ALTER SERVER ROLE [DBViewer] ADD MEMBER [MyLogin];

This code creates a server role named DBViewer and grants the
VIEW ANY DATABASE permission to it. It then adds the login MyLogin to it.

Note: MASTER and TEMPDB will always be visible to all logins,We cannot make them invisible.

No comments:

Post a Comment