Deny update on all tables for user

Question

Is there a way to deny a right for all tables in a database without explicitly defining each table in the command? My problem is that I have a user who is assigned to the public role, and should only be able to read the tables. But if I look at the table permissions this user has update granted to him as well. I am able to deny update to the tables by typing them out using the command: DENY UPDATE ON TO

What I would like to have is something that would allow me to deny update on all tables, but I don't know if this is possible using the above approach, or if this is scriptable. Any suggestions are appreciated.

Kurt Kapferer

Answer 1

0

You could add the user to the db_denydatawriter dB role.

answered Nov 03 '09 at 05:46 PM

Blackhawk-17
10.5k ● 23 ● 29 ● 34

(comments are locked)

Answer 2

0

Try a schema level permission.

If all the tables are in the dbo schema, then

DENY UPDATE on SCHEMA::dbo TO user

even if you have multiple schemas, it's surely a lot less than the number of tables?

answered Nov 03 '09 at 06:23 PM

Kev Riley ♦♦
46.1k ● 38 ● 43 ● 69

(comments are locked)

Answer 3

0

I agree with the other guys, but - just to show that you should never have to type a load of stuff manually, here is some SQL that writes some SQL.

DECLARE @sql varchar(MAX)
SET @sql = ''
SELECT @sql = @sql + 'DENY UPDATE on OBJECT::[' + SCHEMA_NAME(schema_id) + '].[' + name + '] TO user
GO
' from sys.objects where type = 'u'
EXEC (@sql)

answered Nov 03 '09 at 08:26 PM

Matt Whitfield ♦♦
29.2k ● 56 ● 63 ● 87

I think your select statement is missing its from clause and where clause. Probably something like:

from sys.objects where type = 'U'

That, or I am misunderstanding something.

Nov 04 '09 at 02:58 PM TimothyAWiseman

Ha - I answered that one from my phone and completely forgot that bit... good spot! :)

Nov 04 '09 at 05:05 PM Matt Whitfield ♦♦

(comments are locked)

Deny update on all tables for user

Follow this question

Related Questions