Learn more about SQL Server tools



solving sql server problems for millions of dbas and developers since 2006
join MSSQLTips for free SQL Server tips














































How to hide SQL Server user databases in SQL Server Management Studio

MSSQLTips author Manvendra Singh By:   |   Read Comments (12)   |   Related Tips: More > SQL Server Management Studio
Problem

I have a SQL Server instance that has hundreds of databases.  Navigating the database tree in SSMS is a pain and I was wondering if there was a way to limit the list of databases that I see in SSMS?

Solution

SQL Server consolidation is becoming more popular these days to reduce costs and therefore more and more databases are being put on one instance. It is very common to host multiple databases on a consolidated instance from multiple applications and departments and sometimes application owners want to hide their databases to other users of the instance. They do not want to make their database visible to others. This tip will give you an understanding on how databases can be hidden.

Setup

Suppose there are two databases A and B from two different applications and they are hosted on the same SQL Server instance. The users of database A are not allowed to see database B and vice versa. Here we will create two different logins user_A and user_B and give them appropriate rights to their own databases.

CREATE DATABASE A
GO
CREATE DATABASE B
GO
CREATE LOGIN user_A with password='U$er_A@1234'
Go
CREATE LOGIN user_B with password='U$er_B@1234'
Go
USE A
GO
CREATE USER user_A for login user_A;
GO
EXEC sp_addrolemember 'db_owner', 'user_A'
GO
USE B
GO
CREATE USER user_B for login user_B
GO
EXEC sp_addrolemember 'db_owner', 'user_B'

NOTE:-DO NOT MAKE CHANGES IN PRODUCTION WITHOUT PROPER TESTINGS IN LOWER-LIFE CYCLE ENVIRNOMENTS

Hiding all user databases for all logins

Suppose you want to hide all databases for all logins. Generally we hide our databases for security purposes. We can run the below statements to hide all databases for all logins. The databases will then only be visible to sysadmin logins or owners of the database.

USE MASTER
GO
DENY VIEW ANY DATABASE TO PUBLIC
GO

Once you run the above statement, you will not be able to see any databases in SQL Server Management Studio unless you are a sysadmin or your login is the owner of a database(s).

Here you can see in the below screen shot, I have connected using logins user_A and user_B and none of the user databases are showing after running the Deny View access to public.

Conneting to users for which DENY view is enabled

Only sysadmins and database owners can see databases 

To allow the logins to see their databases, I will make both logins the owners for their respective databases. User_A will be owner of database A and user_B will be the owner of database B. Run the below statements to change the database owners.

USE A
GO
SP_changedbowner [USER_A]
GO
USE B
GO
SP_changedbowner [USER_B]

We can check the database owners by running sp_helpdb. As you can see in the below screenshot that the database owners have been changed for both databases.

Change DB Owner of databases

Now we can connect to the SQL Server instance again using both logins and see the changes compared to before.  Here we can see that only one database is visible for both logins. Database A is visible to user_A and database B is visible to user_B. This is because both logins are now the database owners of these databases.

Output of hiding database after changing database owner

Does making a user a db_owner work

Now we will create a new login user_C and assign db_owner access to both databases and check whether these databases are visible to this new login.

CREATE LOGIN user_C with password='U$er_c@13'
GO
USE A
GO
CREATE USER user_C for login user_C;
GO
EXEC sp_addrolemember 'db_owner', 'user_C'
GO
USE B
GO
CREATE USER user_c for login user_C
GO
EXEC sp_addrolemember 'db_owner', 'user_C'

As we can see below, neither of these databases are visible for login user_C.  So from this we can see that you have to be the database owner to be able to see the databases in SQL Server Management Studio if the DENY VIEW ANY DATABASE is enabled for public.

View for a newly created login with db_owner on both databases

Steps to hide databases for a specific login

Suppose we don't want to do this across the board, but only do this for a specific login.  We can run the below statement instead of DENY VIEW ANY DATABASE TO PUBLIC. After running the below statement, this login won't be able to see databases except for any database that this login is the database owner, but all other logins can see the database as long as you did not also deny view to Public.

USE MASTER
GO
GRANT VIEW ANY DATABASE TO PUBLIC; -- turn this back on if it was off
GO
DENY VIEW ANY DATABASE TO USER_A;
GO

Steps to view all databases

By default, the VIEW ANY DATABASE permission is granted to the public role. Therefore, by default, every user that connects to an instance of SQL Server can see all databases in the instance. To grant the VIEW ANY DATABASE permission to a specific login or to all logins run the following query:

--To grant the VIEW ANY DATABASE permission to a specific login.
USE MASTER
GO
GRANT VIEW ANY DATABASE TO [login_name]; 
GO
--To grant the VIEW ANY DATABASE permission to public.
USE MASTER
GO
GRANT VIEW ANY DATABASE TO PUBLIC; 
Go

Note that if you use the DENY VIEW to PUBLIC this overrides the setting for an individual login, so if you DENY VIEW to PUBLIC and GRANT VIEW to a specific login this login will still not be able to see the databases. 

If you are using DENY VIEW to PUBLIC and you want a login to still be able to see all databases without making that login a sysadmin you can do the following.  Make the login a user in the master database and make that user a db_owner of the master database.  This is not a very good option from a security perspective, but this does work.  This way a login can see all databases without having to be a sysadmin.

Conclusion

As you can see from the above, there are limited options to hiding databases.  Once you hide all databases the only logins that can see the databases are the logins that are the owners of the database or if the login is a sysadmin.  Also, each database can only have one owner, so you can't assign multiple owners to the same database.

Next Steps
  • Follow this process to hide your databases in SQL Server Management Studio.
  • Read more SSMS tips


Last Update: 8/14/2013


About the author
MSSQLTips author Manvendra Singh
Manvendra Signh has over 5 years of experience with SQL Server and has focused on Database Mirroring, Replication, Log Shipping, etc.

View all my tips
Related Resources


print tip Print  
Become a paid author




Recommended For You








Learn more about SQL Server tools
Comments and Feedback:
Wednesday, August 14, 2013 - 1:24:27 AM - Varun Gulati Read The Tip

Good one for securing database names from user with no access to DB


Wednesday, August 14, 2013 - 8:40:41 AM - Greg Robidoux Read The Tip

Manvendra, congrats on your 25th published tip.  Keep up the good work.

Greg


Wednesday, August 14, 2013 - 9:45:17 AM - Jeremy Kadlec Read The Tip

Manvendra,

Congrats on your 25th tip!

Thank you,
Jeremy Kadlec
Community Co-Leader


Wednesday, August 14, 2013 - 3:14:17 PM - Sumon Basu Read The Tip

Hi Manavendra,

From your post we can see except db_owner none will be able to see the databases, until they have the sysadmin access priviledges. My question is whether Use <DatabaseName> will work with any query, if the user has the db_datareader access permission granted, I am asking this as I still not tested the same.

Regards,

Sumon


Saturday, August 17, 2013 - 1:19:39 AM - Manvendra Read The Tip

Greg/Jeremy- Thank you very much!!!

 

Basu- Yes you can use "ÜSE DATABASE".


Wednesday, August 28, 2013 - 5:01:39 AM - dipak Read The Tip

This is a good post and useful to know.

One question related to your Conclusion above:

I have multiple users accessing their own databases, e.g. x users connecting to database A, y users connecting to database B.

Surely there must be a way to grant privileges for more than one user to view a particular database in SSMS?!

i.e. I want to "deny view any database to public", then enable MULTIPLE users to view their database in SSMS. but then avoid granting sysadmin or database owner to users (for obvious reasons!)


Wednesday, August 28, 2013 - 9:33:09 AM - Jeff Moden Read The Tip

Very nice tip.  I've not had the need to do such a thing as what you have in this article but I enjoyed the article and the very appropriate use/placement of graphics and code.  Well done, Mr. Singh.


Wednesday, August 28, 2013 - 11:12:19 AM - Kevin Read The Tip

I was reading the article "How to hide SQL Server user databases in SQL Server Management Studio" with great interest. However, while the command will prevent SQLCMD and OSQL access, and limited SSMS viewing, it does not prevent an account from actually viewing data. Executing "USE databasename SELECT * FROM tablename" will still allow that public account to view the contents of the table. 


Wednesday, September 11, 2013 - 2:34:56 PM - Gabriel Mafra Read The Tip

Hello! great post, i just have one question:

 

I have a SQL 2012 Cluster enviroment and i set the permisssions to see databases exactly as you described, everything was perfect.

My nightmare started when another user required access to see database "A", how can i do that? the dbo schema of the database can be owned by only one user, so to give him the permissions he wanted i had to undo everything and all users were able see all databases.

Would you have any advice for my scenario??

 

Thanks in advance!


Wednesday, September 18, 2013 - 6:10:19 AM - Azim Read The Tip

A note regarding the last para.

 

Denying a user not see all database in instance at the cost of master db ownership is not a wise idea. Logins that only see user databases with public role is not that much dangerous instead of giving a chance to a login to jeopardize an instance master db and bring everything down.

-Azim


Saturday, September 21, 2013 - 9:51:45 AM - Nagaraju Read The Tip

Thanks, Very useful


Wednesday, September 25, 2013 - 5:18:06 PM - Raj Read The Tip

Thanks. This was a very useful information.

 

My question is same as asked by Dipak.

I wonder too if there  is way we can show database in SSMS while not making the user a db_owner or sysadmin and yet not giving view permissions on all databases.

I have this requirement and any tips would be helpful.

 



Post a Comment or Question

Keep it clean and stay on the subject or we may delete your comment.
Your email address is not published. Required fields are marked with an asterisk (*)

*Name   *Email Notify for updates

Signup for our newsletter


Comments
*Enter Code refresh code


 
Sponsor Information







Copyright (c) 2006-2014 Edgewood Solutions, LLC All rights reserved
privacy | disclaimer | copyright | advertise | about
authors | contribute | feedback | giveaways | user groups | community | events | first timer?
Some names and products listed are the registered trademarks of their respective owners.