If you are following my recent blog posts, you may have noticed that I’ve written a lot about Guest User in SQL Server. Here are all the blog posts which I have written on Policy Based Management subject.
- SQL SERVER – Disable Guest Account – Serious Security Issue
- SQL SERVER – Force Removing User from Database – Fix: Error: Could not drop login ‘test’ as the user is currently logged in
- SQL SERVER – Detecting guest User Permissions – guest User Access Status
- SQL SERVER – guest User and MSDB Database – Enable guest User on MSDB Database
One of the requests I received was whether we could create a policy that would prevent users unable guest user in user databases. Well, here is a quick tutorial to answer this. Let us see how quickly we can do it.
Requirements
- Check if the guest user is disabled in all the user-created databases.
- Exclude master, tempdb and msdb database for guest user validation.
We will create the following conditions based on the above two requirements:
- If the name of the user is ‘guest’
- If the user has connect (@hasDBAccess) permission in the database
- Check in All user databases, except: master, tempDB and msdb
Once we create two conditions, we will create a policy which will validate the conditions.
Condition 1: Is the User Guest?
Expand the Database >> Management >> Policy Management >> Conditions
Right click on the Conditions, and click on “New Condition…”. First we will create a condition where we will validate if the user name is ‘guest’, and if it’s so, then we will further validate if it has DB access.
Check the image for the necessary configuration for condition:
Facet: User
Expression:
@Name = ‘guest’
Condition 2: Does the User have DBAccess?
Expand the Database >> Management >> Policy Management >> Conditions
Right click on Conditions and click on “New Condition…”. Now we will validate if the user has DB access.
Check the image for necessary configuration for condition:
Facet: User
Expression:
@hasDBAccess = False
Condition 3: Exclude Databases
Expand the Database >> Management >> Policy Management >> Conditions
Write click on Conditions and click on “New Condition…” Now we will create condition where we will validate if database name is master, tempdb or msdb and if database name is any of them, we will not validate our first one condition with them.
Check the image for necessary configuration for condition:
Facet: Database
Expression:
@Name != ‘msdb’
AND @Name != ‘tempdb’
AND @Name != ‘master’
The next step will be creating a policy which will enforce these conditions.
Creating a Policy
Right click on Policies and click “New Policy…”
Here, we justify what condition we want to validate against what the target is.
Condition: Has User DBAccess
Target Database: Every Database except (master, tempdb and MSDB)
Target User: Every User in Target Database with name ‘guest’
Now we have options for two evaluation modes: 1) On Demand and 2) On Schedule
We will select On Demand in this example; however, you can change the mode to On Schedule through the drop down menu, and select the interval of the evaluation of the policy.
Evaluate the Policies
We have selected OnDemand as our policy evaluation mode. We will now evaluate by means of executing Evaluate policy. Click on Evaluate and it will give the following result:
The result demonstrates that one of the databases has a policy violation. Username guest is enabled in AdventureWorks database. You can disable the guest user by running the following code in AdventureWorks database.
USE AdventureWorks;</p> <p style="text-align: justify;">REVOKE CONNECT FROM guest;
Once you run above query, you can already evaluate the policy again. Notice that the policy violation is fixed now.
You can change the method of the evaluation policy to On Schedule and validate policy on interval. You can check the history of the policy and detect the violation.
Quiz
I have created three conditions to check if the guest user has database access or not. Now I want to ask you: Is it possible to do the same with 2 conditions? If yes, HOW? If no, WHY NOT?
Reference: Pinal Dave (https://blog.sqlauthority.com)
8 Comments. Leave new
Hi Pinal Sir,
I guess the only databases that should ever have the guest account enabled are databases the ‘master’,’msdb’ and ‘tempdb’ databases.These enables users access to create job’s,temporary objects,and connect to SQL server. so only the guest user have permissions by default in the ‘model’ database because ‘model’ is template for the all databases so this guest user will include all new databases.
So I think this is the best way to clear the guest user….!!!!
If i’m not wrong that above code should be like with…(!=) instead of (=), screen shot is Ok sir.
Facet: Database
Expression:
@Name != ‘msdb’
AND @Name != ‘tempdb’
AND @Name != ‘master’
Thanks.
We can merge condition 1 and 2 as one condition. As the facets of the conditions are same, we can combine using the And operator. By this we can implement the same thing in two conditions.
Hello Sir,
This is very Good post. I learnt about using policy based management after reading this post. This looks very strong feature indeed. Thanks for this gyaan.
Following is the answer of your question, according to me.
First Condition should be like this..
1) First Condition
Facet: User
Expression:
@Name = ‘guest’
AND @hasDBAccess = False
2) Second Condition
Facet: Database
Expression:
@Name != ‘msdb’
AND @Name != ‘tempdb’
AND @Name != ‘master’
Thanks,
Ashish
I am sys admin of server still Error come like’ can not create the trigger ‘syspolicy_server_trigger’,because you do not have permission’.what permission required?
This is already covered by one of the Microsoft Best Practice Policies – Guest Permissions
is there any way we can use sql server policy to prevent execution of specific stored procedure that has update or delete queries