Re: Domain Admin rights needed to sp_grantlogin and sp_grantdbaccess?

From: Clive Elsworth (clive_at_takethisbitout.elsworth.dircon.co.uk)
Date: 04/03/04

  • Next message: Clive Elsworth: "Re: Clearer version of my earlier question re sp_grantlogin and sp_grantdbaccess" 
    Date: Sat, 3 Apr 2004 18:39:24 +0100

    Greg / Tibor

    It is a permission denied type of error. Something like 'You don't have
    sufficient access rights to perform the action.'

    I have just tried it on my system here - logging in locally as an ordinary
    user, then attaching with osql as sa, and then running sp_grantlogin to
    grant access to 'MachineName\MyNetworkGroupName' and it worked!
    (Annoyingly).

    It definitely did *not* work at my customer's site. Perhaps it has to be a
    Domain network, rather than a workgroup for the problem to arise?

    I'd be interested if you have any other suggestions as to how to get to the
    bottom of it.

    Many thanks

    Clive Elsworth

    P.S. Actually I've just realised that I've done the test on a SQL Server
    (Developer Edition) instead of MSDE 2000. I'll try MSDE at some point and
    report back!

    "Greg Low (MVP)" <greglow@lowell.com.au> wrote in message
    news:eMCTtkpEEHA.712@tk2msftngp13.phx.gbl...
    > Hi Clive,
    >
    > Unless something's been "fiddled with", sa works just as well as the
    > built-in admin accounts for doing such things. We do this all the time.
    What
    > errors are returned? Is it a permission denied type error?
    >
    > Regards,
    >
    > --
    > Greg Low (MVP)
    > MSDE Manager SQL Tools
    > www.whitebearconsulting.com
    >
    > "Clive Elsworth" <clive@takethisbitout.elsworth.dircon.co.uk> wrote in
    > message news:u7fmTGmEEHA.4016@TK2MSFTNGP09.phx.gbl...
    > > I have developed an app for my customer and it assigns different
    privilege
    > > levels to users based on which domain network group they belong to.
    > >
    > > However it seems that in order to grant them access to the server and
    > > database I need to log into their network as Domain Admin. Is that
    > correct?
    > > (I have to go to another site in order to be allowed to do this - v.
    > > inconvenient).
    > >
    > > I was surprised that logging into MSDE as sa did not let me run the
    > > following:
    > >
    > > use AppDB
    > >
    > > exec sp_grantlogin 'TheirDomain\AppManagers'
    > > exec sp_grantdbaccess 'TheirDomain\AppManagers'
    > >
    > > exec sp_grantlogin 'TheirDomain\AppReadWrite'
    > > exec sp_grantdbaccess 'TheirDomain\AppReadWrite'
    > >
    > > etc.
    > >
    > > Is this a bug or a feature?
    > >
    > > Can someone let me know if I could get a trusted connection to MSDE as
    > > something less than Domain Admin? What network rights would I need?
    > >
    > > Many thanks in advance!
    > >
    > > Clive Elsworth (London UK)
    > >
    > >
    > > --
    > > www.EndorphinSoftware.co.uk
    > >
    > >
    > > ---
    > > Outgoing mail is certified Virus Free.
    > > Checked by AVG anti-virus system (http://www.grisoft.com).
    > > Version: 6.0.631 / Virus Database: 404 - Release Date: 17/03/2004
    > >
    > >
    >
    > 

    ---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.648 / Virus Database: 415 - Release Date: 31/03/2004
  • Next message: Clive Elsworth: "Re: Clearer version of my earlier question re sp_grantlogin and sp_grantdbaccess"