Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

DPA granted CONNECT to GUEST

Hello all,

I have to go through a process of hardening my SQL Server database servers, and one thing that has been detected is that in the SQL Server database repository for DPA, the "guest" account has been granted "CONNECT". Obviously this has been set by the DPA installation process, as this is a non-default setting, but I cannot seem to find anything documented regarding this. Can anyone point me to documentation stating that this is a requirement, or why this is being done?

Much appreciated,

Glen

Find more posts tagged with

Accepted answers

All comments

darichar

I have checked several installations in our DPA labs and the guest account does not have any privileges/permissions on the repository database. You should be safe to remove that permission.

gharrison

Thanks for looking into this!

Be careful though, it’s not obvious that CONNECT has been granted. Here’s a query to check:

SELECT DB_NAME() AS DatabaseName, 'guest' AS Database_User,

FROM sys.database_permissions

WHERE = DATABASE_PRINCIPAL_ID('guest')

AND LIKE 'GRANT%'

AND = 'CONNECT'

AND DB_NAME() NOT IN ('master','tempdb','msdb');

Run this against the DPA Repository database, and if guest has been granted connect you’ll see something like this:

If it hasn’t, you won’t get any records returned.

Otherwise you can look at the properties of the database, and select permissions:

It’s just that this was a brand new DPA install, so the only way this should have happened, is if the install set this, which makes me think that it must have been done for a reason.

Thanks,

Glen

attachments.zip

darichar

The script I am seeing had a few missing columns in the WHERE clause. After looking at sys.database_permissions here is the script I ran on a newly created DPA repository database. I did not get any rows returned. I then ran the same query on several other repository databases and did not get anything either.

SELECT DB_NAME() AS DatabaseName, 'guest' AS Database_User

FROM sys.database_permissions

WHERE grantee_principal_id = DATABASE_PRINCIPAL_ID('guest')

AND state_desc LIKE 'GRANT%'

AND permission_name = 'CONNECT'

AND DB_NAME() NOT IN ('master','tempdb','msdb');

gharrison

Thank you so much!

I have a suspicion how this happened … another application needed SYSADMIN to do it’s install onto this shared database server. I bet it applied this change to all existing database.

Argh!!!

Thanks again,

Glen