Default User Permissions
Hi All,
We recently had an incident with RDM where someone managed to delete all of our folders through the application. We found out that this user was not part of the user list of RDM (File -> Administration -> Users). We then started to notice that some users who were not part of the same list get default Administrative rights - we tested this by created a dummy account in ActiveDirectory.
Have we missed something here? Is there a setting that prevents users who are not part of the RDM User list access to the database or at least prevent them from defaulting to an adminstrator?
Thanks in advance!
All Comments (8)
Hi,
Could you verify if they have the DB_OWNER/SYSDBA right in SQL Server? This might explains the problem. You can see that quicly by checking the about when your are logged with your dummy account. As soon as they get authenticated by SQL Server, you get the default right from it. In RDMS, we don't have the problem because you are not directly connected to the database.
David Hervieux
Hi David,
Yes, the DB_OWNER/SYSDBA shows up on the dummy account
is there a way to prevent them from getting this access right?
That's the problem, if they are DB_OWNER, the have a full access to the database if they use SQL Management Studio. For now it's not possible to limit their access with the SQL Server data source. In Remote Desktop Manager Server, you would not have this problem. Is it possible to remove them those access?
David Hervieux
I've tried setting their permissions on SQL Management Studio to everything else except dbo and the dummy account still is a DB owner and System DBA
Is it possible that's an inherited rights?
David Hervieux
It's possible, but still confused as to why this dummy account can access the database via RDM even when all of its accounts are removed via the Server Management Studio
if it helps, i'm using Integrated Security Mode when connecting (would that have an affect?)
Could you access SQL Management Studio with this Dummy user?
David Hervieux
Btw, we have DOMAIN USERS as part of the "SECURITY" folder for the database - i think that might have given this dummy account access as its part of the domain.