THE SQL Server Blog Spot on the Web

Welcome to SQLblog.com - The SQL Server blog spot on the web Sign in | Join | Help
in Search

Aaron Bertrand

Aaron is a senior consultant for SQL Sentry, Inc., makers of performance monitoring and event management software for SQL Server, Analysis Services, and Windows. He has been blogging here at sqlblog.com since 2006, focusing on manageability, performance, and new features; has been a Microsoft MVP since 1997; tweets as @AaronBertrand; and speaks frequently at user group meetings and SQL Saturday events.

If you disable the guest user, please read this!

As a matter of security, it is typically recommended to disable the guest user account across your user databases. For system databases, of course you have a tough time disabling guest access for tempdb and master, which are peripherally required for a lot of different types of activity. You have probably felt quite confident in disabling guest access to msdb as well, but this might be more trouble than it's worth, for the same reason: guest access to msdb is required for some SQL Server functionality to work. This applies to SQL Server 2005, 2008, 2008 R2, Denali and, almost certainly, beyond.

Yesterday, Microsoft published a KB article to underscore this point, and to complement the advice found in Books Online. It describes the types of symptoms you might see (or that your users might be experiencing, but not complaining loudly enough about - yet) if you disable guest access to msdb:

KB #2539091 : You should not disable the guest user in the msdb database in SQL Server

Here is a somewhat relevant article in Books Online (and I recommend browsing all of the checklists). Note that the "Limiting Access to Data" checklist does not cover this topic as specifically as the KB article might otherwise imply:

Checklist: Limiting Access to Data

There may be far more overwhelming factors to consider when implementing security in your environment, and you might already have a tight enough reign on access that this isn't a concern. But if disabling the guest account is part of your policy, make sure you are aware of the consequences.

 

Published Friday, April 29, 2011 3:42 PM by AaronBertrand

Comment Notification

If you would like to receive an email when updates are made to this post, please register here

Subscribe to this post's comments using RSS

Comments

 

Livetvijken said:

I still don't really get how disabling guest users in a DB might increase your security? And is this also the case in .i.e. MySQL databases?

I'm not really a pro on this...

April 30, 2011 5:18 AM
 

AaronBertrand said:

I would take a look at this article, it covers a few bases:

http://www.mssqltips.com/tip.asp?tip=1172

April 30, 2011 7:30 PM
 

Livetvkijken said:

Hey AaronBertrand thanks, I will ;)

May 1, 2011 6:13 AM

Leave a Comment

(required) 
(optional)
(required) 
Submit

About AaronBertrand

...about me...

This Blog

Syndication

Powered by Community Server (Commercial Edition), by Telligent Systems
  Privacy Statement