SQL 2005 security questions

[kodaksmile]

Hi All,

We are going through a government required security change for several of our systems. One of the requirements it to revoke almost all access from the public role. While I can do most of that (will probably break the system) there are several (200 or so) permissions that cannot be revoked. For example:

REVOKE SELECT ON xml_schema_wildcards from public

will return:

Cannot find the object 'xml_schema_wildcards', because it does not exist or you do not have permission.

However this item does show up on the security scan. Does anyone know if there is any documentation on the fact that some permissions cannot be revoked?

Thanks,

 

[mrdenny]

I would simply tell them that rights to system objects can not be revoked as this can prevent the system from working correctly.

Is this private sector or public sector? If private which regulations are you dealing with?

Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration / Microsoft Office SharePoint Server 2007: Configuration)
MCITP Database Administrator (SQL 2005) / Database Developer (SQL 2005)

My Blog

 

[kodaksmile]

We are dealing with DIACAP requirements - the irony is how many of them conflict.

 

[mrdenny]

Ouch, Public Sector DoD protocals.

Is there room in the Doc (I really don't see myself reading all 53 pages in the doc I found via Google) that allows for commonly known best practices? You may want to try calling Microsoft and see if they have a paper written on why they have granted the default rights which they have granted.

Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration / Microsoft Office SharePoint Server 2007: Configuration)
MCITP Database Administrator (SQL 2005) / Database Developer (SQL 2005)

My Blog