Showing posts with label security. Show all posts
Showing posts with label security. Show all posts

Friday, March 30, 2012

how to script security permissions?

I have a very large table that is refreshed periodically. Since it's
so big, I do a 'drop table', 'create table', 'create index' then a bulk
load. It's much faster than doing a 'delete from'. I also do a
'shrinkdb' as part of this process.

The problem, however, is that the user permissions are also dropped in
this process. So, how can I script the user permissions? For example,
how do I give 'MyUser' select access to 'MyTable' in 'MyDB'? Many
thanks!!

Eben Yong
yonglove@.yahoo.comGRANT SELECT ON MyTable TO MyUser|||Eben (yonglove@.yahoo.com) writes:
> I have a very large table that is refreshed periodically. Since it's
> so big, I do a 'drop table', 'create table', 'create index' then a bulk
> load. It's much faster than doing a 'delete from'. I also do a
> 'shrinkdb' as part of this process.

So why not do a TRUNCATE TABLE instead? This is a minimally logged
operation, and you maintain indexes, permissions etc.

> The problem, however, is that the user permissions are also dropped in
> this process. So, how can I script the user permissions? For example,
> how do I give 'MyUser' select access to 'MyTable' in 'MyDB'? Many
> thanks!!

I guess you can do this with DMO, if you want to do this programmatically.
However, I have not used DMO myself.

--
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se

Books Online for SQL Server SP3 at
http://www.microsoft.com/sql/techin.../2000/books.asp|||Erland Sommarskog wrote:
> Eben (yonglove@.yahoo.com) writes:
> > I have a very large table that is refreshed periodically. Since it's
> > so big, I do a 'drop table', 'create table', 'create index' then a bulk
> > load. It's much faster than doing a 'delete from'. I also do a
> > 'shrinkdb' as part of this process.
> So why not do a TRUNCATE TABLE instead? This is a minimally logged
> operation, and you maintain indexes, permissions etc.
Although keeping indexes is sometimes a good thing, it's also sometimes
beneficial to drop all indexes before the truncate and only add them
back when all the data loading is complete.

Of course, it depends on how the data loading is being managed (in my
case, I happen to be loading 3 1/2 million records from a non-R DBMS,
and having to do it one row at a time - I'd rather not have the indexes
rebuilt for every insert)

Damien|||Thank you, everyone. I did not know about the TRUNCATE TABLE option.
But accomplishing this objective using DROP TABLE, CREATE TABLE, and so
on, has required that I learn many other SQL Server methods, so it's
good for me. I spent more time developing the solution but SQL Server
doesn't care one way or the other and both methods still get the job
done in the same amount of time. So, once again, thanks everyone for
your input!

Sunday, February 19, 2012

How to restrict access to database to only IUSR_<machinename>

I am running IIS and SQL Server on the same Win2003 Server machine. Is there
a way to set up security such that only IUSR_<machine> is allowed to access
the SQL Server 2000, even if outsiders have the connection string to the
database?
Thanks for any assistance!only create the account iusr_computername
"Mark Findlay" <mfindlay@.speakeasy.org> wrote in message
news:%23OLNjKN%23EHA.2192@.TK2MSFTNGP14.phx.gbl...
> I am running IIS and SQL Server on the same Win2003 Server machine. Is
there
> a way to set up security such that only IUSR_<machine> is allowed to
access
> the SQL Server 2000, even if outsiders have the connection string to the
> database?
> Thanks for any assistance!
>|||Unfortunately that's not a reasonable alternative for me since there are
many accounts on that machine that make use of other resources on that
machine.
I believe the solution is to block port 1433, but I don't know how to block
port 1433 on Windows Server 2003. Can anyone assist?
Thanks!
"Olu Adedeji" <i-oluade@.microsoft.com> wrote in message
news:eKLc6hQ%23EHA.2452@.TK2MSFTNGP14.phx.gbl...
> only create the account iusr_computername
> "Mark Findlay" <mfindlay@.speakeasy.org> wrote in message
> news:%23OLNjKN%23EHA.2192@.TK2MSFTNGP14.phx.gbl...
> there
> access
>