Print Button - ActiveX Installation

Hello,
How can I deploy the ActiveX to the workstations?
The users don't have administrative privileges, I want to install the active
X control before they click the print button.
Is there a way to download the files of instalation and run some setup?
ThanksRS doesn't supply any mechanism for doing this. What you could do is look
for the rsclientprint.cab file and extract its information. Then copy it to
the users "WINDOWS\Downloaded Program Files" folder. This should allow the
users the ability to use the control without downloading it. Of course you
would need to do all the maintenance for updating the control if it every
changes.
--
-Daniel
This posting is provided "AS IS" with no warranties, and confers no rights.
"Armand Charles" <armand.charles@.tty.com.br> wrote in message
news:eCG$imXAGHA.2320@.TK2MSFTNGP11.phx.gbl...
> Hello,
> How can I deploy the ActiveX to the workstations?
> The users don't have administrative privileges, I want to install the
> active X control before they click the print button.
> Is there a way to download the files of instalation and run some setup?
> Thanks
>|||Hi Daniel
I can't copy the extract files of rsclientprint.cab to "WINDOWS\Downloaded
Program Files", it doesn't work. This folder looks as read only.
Thank you for your response,
Armand
"Daniel Reib [MSFT]" <danreib@.online.microsoft.com> escreveu na mensagem
news:uGHFVdaAGHA.1312@.TK2MSFTNGP09.phx.gbl...
> RS doesn't supply any mechanism for doing this. What you could do is look
> for the rsclientprint.cab file and extract its information. Then copy it
> to the users "WINDOWS\Downloaded Program Files" folder. This should allow
> the users the ability to use the control without downloading it. Of
> course you would need to do all the maintenance for updating the control
> if it every changes.
> --
> -Daniel
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
> "Armand Charles" <armand.charles@.tty.com.br> wrote in message
> news:eCG$imXAGHA.2320@.TK2MSFTNGP11.phx.gbl...
>> Hello,
>> How can I deploy the ActiveX to the workstations?
>> The users don't have administrative privileges, I want to install the
>> active X control before they click the print button.
>> Is there a way to download the files of instalation and run some setup?
>> Thanks
>|||You can do it, you just need to do it via the command line.
--
-Daniel
This posting is provided "AS IS" with no warranties, and confers no rights.
"Armand Charles" <armand.charles@.tty.com.br> wrote in message
news:%23RDSW1MBGHA.2320@.TK2MSFTNGP11.phx.gbl...
> Hi Daniel
> I can't copy the extract files of rsclientprint.cab to "WINDOWS\Downloaded
> Program Files", it doesn't work. This folder looks as read only.
> Thank you for your response,
> Armand
> "Daniel Reib [MSFT]" <danreib@.online.microsoft.com> escreveu na mensagem
> news:uGHFVdaAGHA.1312@.TK2MSFTNGP09.phx.gbl...
>> RS doesn't supply any mechanism for doing this. What you could do is
>> look for the rsclientprint.cab file and extract its information. Then
>> copy it to the users "WINDOWS\Downloaded Program Files" folder. This
>> should allow the users the ability to use the control without downloading
>> it. Of course you would need to do all the maintenance for updating the
>> control if it every changes.
>> --
>> -Daniel
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights.
>>
>> "Armand Charles" <armand.charles@.tty.com.br> wrote in message
>> news:eCG$imXAGHA.2320@.TK2MSFTNGP11.phx.gbl...
>> Hello,
>> How can I deploy the ActiveX to the workstations?
>> The users don't have administrative privileges, I want to install the
>> active X control before they click the print button.
>> Is there a way to download the files of instalation and run some setup?
>> Thanks
>>
>|||Would you please tell me what have I missed? I already copied the files to
"WINDOWS\Downloaded Program Files" folder. It still asks me to intall
Reporting Services when I click the PRINT button.
Thanks,
Anna
"Daniel Reib [MSFT]" wrote:
> You can do it, you just need to do it via the command line.
> --
> -Daniel
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
> "Armand Charles" <armand.charles@.tty.com.br> wrote in message
> news:%23RDSW1MBGHA.2320@.TK2MSFTNGP11.phx.gbl...
> > Hi Daniel
> >
> > I can't copy the extract files of rsclientprint.cab to "WINDOWS\Downloaded
> > Program Files", it doesn't work. This folder looks as read only.
> >
> > Thank you for your response,
> >
> > Armand
> >
> > "Daniel Reib [MSFT]" <danreib@.online.microsoft.com> escreveu na mensagem
> > news:uGHFVdaAGHA.1312@.TK2MSFTNGP09.phx.gbl...
> >> RS doesn't supply any mechanism for doing this. What you could do is
> >> look for the rsclientprint.cab file and extract its information. Then
> >> copy it to the users "WINDOWS\Downloaded Program Files" folder. This
> >> should allow the users the ability to use the control without downloading
> >> it. Of course you would need to do all the maintenance for updating the
> >> control if it every changes.
> >>
> >> --
> >> -Daniel
> >> This posting is provided "AS IS" with no warranties, and confers no
> >> rights.
> >>
> >>
> >> "Armand Charles" <armand.charles@.tty.com.br> wrote in message
> >> news:eCG$imXAGHA.2320@.TK2MSFTNGP11.phx.gbl...
> >> Hello,
> >>
> >> How can I deploy the ActiveX to the workstations?
> >> The users don't have administrative privileges, I want to install the
> >> active X control before they click the print button.
> >> Is there a way to download the files of instalation and run some setup?
> >>
> >> Thanks
> >>
> >>
> >>
> >
> >
>
>|||I got the same problem too. I was using WinInstall and found that it got lots of registry entries. Do anyone know how to deploy it.
From http://www.developmentnow.com/g/115_2005_12_0_0_679249/Print-Button--ActiveX-Installation.ht
Posted via DevelopmentNow.com Group
http://www.developmentnow.com

Print Button

Print button is disabled for some users. Don't know why it is doing so? Works fine for most of the users in the same group.

Any help is much appreciated.

SQL SERVER Reporting Services 2000

Win XP

check whether any printer drivers are installed in the machine.

if no printers are installed, then print button gets disabled

suresh babu k

|||

Thank you much! I will check that.

|||Actually printer is installed. But still print button is greyed out.|||

Also check the RSPRINTCLIENT control in the C:\WINDOWS\Downloaded Program Files folder. I they ran on the beta then this dll could be very old. It doesn't seem to get updated when the server does. You can remove it and RS will download a new one.

Although I don't think this will cause the print button to be dimmed out. But if you have a printer installed and its a valid driver, you should get the button at least.

|||R U using rdl or rdlc files..... ?|||

We are using rdl files.

Thanks

|||

The print button is disabled if the users in question cannot download and install the RS Printing ActiveX control.

We have several users who run as non-admin accounts. You have to log onto their machines as an admin and then print the report once. After that the ActiveX control is installed and it works for them.

|||Is there anyway of removing the Print functionality of Report Manager i.e. disabling printing directly from Report Manager?
This in RS 2005
|||

The solution is documented here:

http://msdn2.microsoft.com/en-us/library/ms155874.aspx

-Lukasz

Print Button

Print button is disabled for some users. Don't know why it is doing so? Works fine for most of the users in the same group.

Any help is much appreciated.

SQL SERVER Reporting Services 2000

Win XP

check whether any printer drivers are installed in the machine.

if no printers are installed, then print button gets disabled

suresh babu k

|||

Thank you much! I will check that.

|||Actually printer is installed. But still print button is greyed out.|||

Also check the RSPRINTCLIENT control in the C:\WINDOWS\Downloaded Program Files folder. I they ran on the beta then this dll could be very old. It doesn't seem to get updated when the server does. You can remove it and RS will download a new one.

Although I don't think this will cause the print button to be dimmed out. But if you have a printer installed and its a valid driver, you should get the button at least.

|||R U using rdl or rdlc files..... ?|||

We are using rdl files.

Thanks

|||

The print button is disabled if the users in question cannot download and install the RS Printing ActiveX control.

We have several users who run as non-admin accounts. You have to log onto their machines as an admin and then print the report once. After that the ActiveX control is installed and it works for them.

|||Is there anyway of removing the Print functionality of Report Manager i.e. disabling printing directly from Report Manager?
This in RS 2005
|||

The solution is documented here:

http://msdn2.microsoft.com/en-us/library/ms155874.aspx

-Lukasz

sql

print active x question

WE have locked down our security so that no active x controls can run for our
end users. Is there a way to integrate the installing of the print active x
control into the startup script? Or does it have to be installed using direct
from the report manager?
We have looked at the cab file but cant find the installation path for this
control once it is run.
Help would be greatly appreciated.I guess it depends on how you locked down IE. If they can not run activeX
controls period then there is not much you can do, if they just can't
download them then you can manually install them as I describe below.
The client print control is just a COM object. You could extract the
contents and run regsvr32 on the rsclientprint.dll. There are a couple of
issues you need to be aware of though:
1) make sure all the additional files are located in the same folder as the
rsclientprint.dll
2) If we ever update the control you will need to make sure to update the
control in your script or the control may not work correctly.
--
-Daniel
This posting is provided "AS IS" with no warranties, and confers no rights.
"Shaun Longhurst" <ShaunLonghurst@.discussions.microsoft.com> wrote in
message news:53561090-A1BE-483B-8BC1-0649BB00A1A3@.microsoft.com...
> WE have locked down our security so that no active x controls can run for
> our
> end users. Is there a way to integrate the installing of the print active
> x
> control into the startup script? Or does it have to be installed using
> direct
> from the report manager?
> We have looked at the cab file but cant find the installation path for
> this
> control once it is run.
> Help would be greatly appreciated.
>|||That worked great
Thanks alot
"Daniel Reib (MSFT)" wrote:
> I guess it depends on how you locked down IE. If they can not run activeX
> controls period then there is not much you can do, if they just can't
> download them then you can manually install them as I describe below.
> The client print control is just a COM object. You could extract the
> contents and run regsvr32 on the rsclientprint.dll. There are a couple of
> issues you need to be aware of though:
> 1) make sure all the additional files are located in the same folder as the
> rsclientprint.dll
> 2) If we ever update the control you will need to make sure to update the
> control in your script or the control may not work correctly.
> --
> -Daniel
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
> "Shaun Longhurst" <ShaunLonghurst@.discussions.microsoft.com> wrote in
> message news:53561090-A1BE-483B-8BC1-0649BB00A1A3@.microsoft.com...
> > WE have locked down our security so that no active x controls can run for
> > our
> > end users. Is there a way to integrate the installing of the print active
> > x
> > control into the startup script? Or does it have to be installed using
> > direct
> > from the report manager?
> >
> > We have looked at the cab file but cant find the installation path for
> > this
> > control once it is run.
> >
> > Help would be greatly appreciated.
> >
> >
>
>|||Ok, it works, but how do you install so that when you go into Internet
Explorer and view objects you actually see the RSClientPrint Class and can
remove it? Seems there must be way. Tx.
"Daniel Reib (MSFT)" wrote:
> I guess it depends on how you locked down IE. If they can not run activeX
> controls period then there is not much you can do, if they just can't
> download them then you can manually install them as I describe below.
> The client print control is just a COM object. You could extract the
> contents and run regsvr32 on the rsclientprint.dll. There are a couple of
> issues you need to be aware of though:
> 1) make sure all the additional files are located in the same folder as the
> rsclientprint.dll
> 2) If we ever update the control you will need to make sure to update the
> control in your script or the control may not work correctly.
> --
> -Daniel
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
> "Shaun Longhurst" <ShaunLonghurst@.discussions.microsoft.com> wrote in
> message news:53561090-A1BE-483B-8BC1-0649BB00A1A3@.microsoft.com...
> > WE have locked down our security so that no active x controls can run for
> > our
> > end users. Is there a way to integrate the installing of the print active
> > x
> > control into the startup script? Or does it have to be installed using
> > direct
> > from the report manager?
> >
> > We have looked at the cab file but cant find the installation path for
> > this
> > control once it is run.
> >
> > Help would be greatly appreciated.
> >
> >
>
>|||To have IE show it in its list of objects it needs to be installed by IE.
You could probably copy the files to the Downloaded Program Files directory
and register them there, but I am not positive that would make them show up.
--
-Daniel
This posting is provided "AS IS" with no warranties, and confers no rights.
"paulcerv" <paulcerv@.discussions.microsoft.com> wrote in message
news:7D699AA2-76BC-41B8-92A0-AD01EB8453D5@.microsoft.com...
> Ok, it works, but how do you install so that when you go into Internet
> Explorer and view objects you actually see the RSClientPrint Class and can
> remove it? Seems there must be way. Tx.
> "Daniel Reib (MSFT)" wrote:
>> I guess it depends on how you locked down IE. If they can not run
>> activeX
>> controls period then there is not much you can do, if they just can't
>> download them then you can manually install them as I describe below.
>> The client print control is just a COM object. You could extract the
>> contents and run regsvr32 on the rsclientprint.dll. There are a couple
>> of
>> issues you need to be aware of though:
>> 1) make sure all the additional files are located in the same folder as
>> the
>> rsclientprint.dll
>> 2) If we ever update the control you will need to make sure to update the
>> control in your script or the control may not work correctly.
>> --
>> -Daniel
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights.
>>
>> "Shaun Longhurst" <ShaunLonghurst@.discussions.microsoft.com> wrote in
>> message news:53561090-A1BE-483B-8BC1-0649BB00A1A3@.microsoft.com...
>> > WE have locked down our security so that no active x controls can run
>> > for
>> > our
>> > end users. Is there a way to integrate the installing of the print
>> > active
>> > x
>> > control into the startup script? Or does it have to be installed using
>> > direct
>> > from the report manager?
>> >
>> > We have looked at the cab file but cant find the installation path for
>> > this
>> > control once it is run.
>> >
>> > Help would be greatly appreciated.
>> >
>> >
>>|||We have a similar issue, where users are locked down and unable to download
ActiveX controls. I have searched in vain trying to find a work around
installation. I have tried to copy the files in the .cab to the
"C:\WINDOWS\Downloaded Program Files" and register the dll using regsvr32.
However, I am still recieving an error (8007F304), when trying to print.
I have been unable to find any description of the error on the web. When I
debug, I see the error is caused by a call to the print method of the
rsclientprint object...
--
Vermont - AOT
Sys Dev/DBA|||I found the problem, I was using the wrong version. Thanks to all those that
could have helped...
--
Vermont - AOT
Sys Dev/DBA
"Rob_C" wrote:
> We have a similar issue, where users are locked down and unable to download
> ActiveX controls. I have searched in vain trying to find a work around
> installation. I have tried to copy the files in the .cab to the
> "C:\WINDOWS\Downloaded Program Files" and register the dll using regsvr32.
> However, I am still recieving an error (8007F304), when trying to print.
> I have been unable to find any description of the error on the web. When I
> debug, I see the error is caused by a call to the print method of the
> rsclientprint object...
> --
> Vermont - AOT
> Sys Dev/DBA
>

Primary Key Analysis Tool

I have a client database where the users are experiencing very unpredictable behavior and I found after investigating that the majority of the tables don't have primary keys. :o

They were imported from an Access database and I think the table creator or the Access wizard itself added auto-number fields, so I know most of the tables have at least one column that could become the primary key.

Is there a free tool available that will allow me to analyze these tables to identify and list the tables that need primary keys and also help identify candidate columns for the primary key?

It would be helpful if I could automate some of the script generation to install the primary keys so I don't have to do them all manually.you should be able to work out a query using the information schema views.|||Is it a full moon toay?

Script out the database and look it over

Or do as Sean said and left join tables key_column_usage|||Is it a full moon toay?

Script out the database and look it over

Or do as Sean said and left join tables key_column_usage
No, sorry the moon was full on the 26th.

The reason I asked about a tool to help with this is I don't have time or patience to script and analyze about 500 tables. The key_column_usage view isn't helpful since none of the user tables have keys - there are only two entries for the master table keys.|||This script is beta, but it works pretty well. Supply a tablename and it will find all the natural keys in the data.|||I didn't open the blind dudes script, but I guess it's looking for cardiality of the data.

The more unique it is would be the key

But you could write your own

So lets' you find a column that all has unique values, I would use that as a key

But what if you have columns with 2 or 3 values?

Or mostly unique?

Was that app written to suppose to enforce RI

A lot of 3rd party apps I see do that

scrubs|||This script is beta, but it works pretty well. Supply a tablename and it will find all the natural keys in the data.
Exactly what I needed. :beer:

Preventing windows users accessing a database

Hi All
I want to prevent windows users from accessing my database on SQL server
express 2005
I don't want users to be able to login with SSME on Windows authentication,
only by SQl Server Authentication and only on the sa and another specific
login with the password I have set
For the life of me I can't seem to find how to do this
Can anybody advise me
Regards
SteveSteve (ga630sf@.newsgroups.nospam) writes:
> I want to prevent windows users from accessing my database on SQL server
> express 2005
> I don't want users to be able to login with SSME on Windows
> authentication, only by SQl Server Authentication and only on the sa and
> another specific login with the password I have set
> For the life of me I can't seem to find how to do this
First of all, if you granted access to any Windows login or groups,
remove these. Second, also revoke access to BUILTIN\Administrators,
which gives permission to all Windows logins that have admin rights
on the machine.
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx|||Steve
I think the following has been introduced in SP2 and I did not test on
Express Edition ,sorry
/*Create a very simple login trigger */
create trigger AuditLogin_Demo
/* server means instance level*/
on all server
with execute as self
/* We specify the logon event at this stage
Issue a rollback*/
for logon
as begin
if exists (select * from sys.server_principals
where type_desc ='Windows_Login'
and name=original_login() )
begin
ROLLBACK;
end
end
go
For more details please
"Steve" <ga630sf@.newsgroups.nospam> wrote in message
news:edw2AkkzHHA.4004@.TK2MSFTNGP05.phx.gbl...
> Hi All
> I want to prevent windows users from accessing my database on SQL server
> express 2005
> I don't want users to be able to login with SSME on Windows
> authentication, only by SQl Server Authentication and only on the sa and
> another specific login with the password I have set
> For the life of me I can't seem to find how to do this
> Can anybody advise me
>
> Regards
> Steve
>|||Erland
Thanks worked a treat
Regards
steve
"Erland Sommarskog" <esquel@.sommarskog.se> wrote in message
news:Xns99786FED46931Yazorman@.127.0.0.1...
> Steve (ga630sf@.newsgroups.nospam) writes:
> First of all, if you granted access to any Windows login or groups,
> remove these. Second, also revoke access to BUILTIN\Administrators,
> which gives permission to all Windows logins that have admin rights
> on the machine.
>
> --
> Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
> Books Online for SQL Server 2005 at
> http://www.microsoft.com/technet/pr...oads/books.mspx
> Books Online for SQL Server 2000 at
> http://www.microsoft.com/sql/prodin...ions/books.mspx

Preventing expansion of a cross-tab column

Is it possible to prevent certain users from expanding a column (or
row) in a cross-tab/matrix report? That is, a lower level of
granularity in a report column is too detailed for a certain job role,
and you don't want that person to be able to expand that column out,
but you don't want to write multiple reports to accomplish this task.
Thanks.On May 10, 12:25 pm, kmac2...@.gmail.com wrote:
> Is it possible to prevent certain users from expanding a column (or
> row) in a cross-tab/matrix report? That is, a lower level of
> granularity in a report column is too detailed for a certain job role,
> and you don't want that person to be able to expand that column out,
> but you don't want to write multiple reports to accomplish this task.
> Thanks.
I would suggest setting a hidden parameter for the current user (=User!
UserID.ToString) in the report, then pass this hidden parameter to the
stored procedure/query that is sourcing the report and based on the
user's job role, do not return certain drill-down (etc) data. Hope
this helps.
Regards,
Enrique Martinez
Sr. Software Consultant|||The suggestion helped a bit...I was able to use the user role to set
certain information null, so when the group is expanded in the matrix,
it doesn't do anything but add another header row. However, the +/-
sign is still there, and I'd like to hide it in these situations. I
found the place to work with this information in the Edit Group
properties of the matrix column, but the ToggleItem can't be an
expression. While I could set it to another textbox than the default
and hide -that- textbox (which would hide the +/-) it would remove the
context of the +/- in situations where I need it. I might be missing
something, but I can't figure how to make this work out. Any ideas?

Preventing Enterprise Manager access from Windows users

Hello,
Scenario: SQL 2000 or 2005 server in an ADS domain. ADS groups are created
as SQL logins, and those logins are created as database users with datareade
r
and/or datawriter roles to a specific database. An intranet web site is
created to allow the ADS users in those ADS groups access to the data.
Problem: How do I prevent the ADS users in those ADS groups from running
Enterprise Manager (or creating their own ODBC connections, etc.) and messin
g
with my database? Or, put another way, how do I prevent the users from using
their own interface to the database?
Thanks much,
-TonyA common practice for something like this would be too...
1. Create Stored Procedures that the application uses to manipulate data.
2. Assign those groups Execute Permissions on the Stored Procedures.
3. Deny Data Reader and Data Writer to those groups.
If you are using ADHOC in your program this is going to be a little tougher.
What do you think?
/*
Warren Brunk - MCITP - SQL 2005, MCDBA
www.techintsolutions.com
*/
"Tony" <Tony@.discussions.microsoft.com> wrote in message
news:ADF6BDE5-11D7-496E-994D-F9B56EF645E3@.microsoft.com...
> Hello,
> Scenario: SQL 2000 or 2005 server in an ADS domain. ADS groups are created
> as SQL logins, and those logins are created as database users with
> datareader
> and/or datawriter roles to a specific database. An intranet web site is
> created to allow the ADS users in those ADS groups access to the data.
> Problem: How do I prevent the ADS users in those ADS groups from running
> Enterprise Manager (or creating their own ODBC connections, etc.) and
> messing
> with my database? Or, put another way, how do I prevent the users from
> using
> their own interface to the database?
> Thanks much,
> -Tony
>|||Warren,
Thanks for the info. That does sound like a good solution. I'm assuming this
would allow users to run Enterprise Manager and see my databases and objects
listed, but not interact with them.
BTW, these applications are web apps using .net. So, perhaps another
alternative would be for me to autherize and authenticate users to the web
site using IIS and ADS groups, then use a SQL login and password (encrypted
in the web.config file) to handle db access. Adding your suggestion to this,
I could restrict the SQL login to execute only the needed sprocs.
Seems like this would prevent any access to my database by those ADS users
via Enterprise Manager or whatever. If the SQL login should be hacked, at
least it would only allow execute on the sprocs and nothing else.
Thanks,
-Tony
"Warren Brunk" wrote:

> A common practice for something like this would be too...
> 1. Create Stored Procedures that the application uses to manipulate data.
> 2. Assign those groups Execute Permissions on the Stored Procedures.
> 3. Deny Data Reader and Data Writer to those groups.
> If you are using ADHOC in your program this is going to be a little toughe
r.
> What do you think?
> --
> /*
> Warren Brunk - MCITP - SQL 2005, MCDBA
> www.techintsolutions.com
> */
>
> "Tony" <Tony@.discussions.microsoft.com> wrote in message
> news:ADF6BDE5-11D7-496E-994D-F9B56EF645E3@.microsoft.com...
>
>|||Hello Tony
Please drop me a note if the following description sounds interesting to
you.
Best regards
Adrian
Here we go:
Corrupt users and compromised user-accounts, cf Phishing, account for the
majority of attacks in the commercial world. We present a two-stage
anti-corruption system (ACS) for database servers that, in the first stage,
makes it very hard to gain access to a database with an unauthorised client
application or from an unauthorised client PC and, in the second stage,
provides
early precise hints on users performing suspicious activities. Our first
implementation of the ACS is for the MS SQL Server 2000. It uses only
documented
functions and relies completely on mechanisms and data already provided by
the
database server. Its smooth and efficient operation for several months in a
middle-sized decentralised company proves it a valuable addition to the pool
of
security measures.
"Tony" <Tony@.discussions.microsoft.com> wrote in message
news:5D786B85-382F-49DD-8CE8-3B8A77DB8EF4@.microsoft.com...[vbcol=seagreen]
> Warren,
> Thanks for the info. That does sound like a good solution. I'm assuming
> this
> would allow users to run Enterprise Manager and see my databases and
> objects
> listed, but not interact with them.
> BTW, these applications are web apps using .net. So, perhaps another
> alternative would be for me to autherize and authenticate users to the web
> site using IIS and ADS groups, then use a SQL login and password
> (encrypted
> in the web.config file) to handle db access. Adding your suggestion to
> this,
> I could restrict the SQL login to execute only the needed sprocs.
> Seems like this would prevent any access to my database by those ADS users
> via Enterprise Manager or whatever. If the SQL login should be hacked, at
> least it would only allow execute on the sprocs and nothing else.
> Thanks,
> -Tony
>
> "Warren Brunk" wrote:
>

Prevent users to create temp (#) tables on SQL server

Hello All,
I have to remove temp tables (# or ##) create permissions for the logins
which do not have associated users in tempdb (using guest account). I have
tried to deny "Create Table" explicitly for the public account but no luck.
I
have also tried to create that user in tempdb and then denied "create table"
on tempdb to this user but no luck again.
While investigating more, when I queried on tempdb..sysobjects, I found that
these temp tables are created with UID = 1 (dbo), not able to understand why
the temp tables are being created as dbo and not with that user account. Any
idea how I can prevent any user/role to create temp tables?
Thanks in advance
- AnilHello Anil,
Event Data function might help you. Check the following links for further
details.
http://msdn2.microsoft.com/en-us/library/ms187909.aspx
http://blogs.msdn.com/mrorke/archiv.../25/456354.aspx
Cheers!
MB
"anilksharma99" <anilksharma99@.discussions.microsoft.com> wrote in message
news:E2BCCD74-D8A7-4ACC-993C-7F50C7AB947D@.microsoft.com...
> Hello All,
> I have to remove temp tables (# or ##) create permissions for the logins
> which do not have associated users in tempdb (using guest account). I have
> tried to deny "Create Table" explicitly for the public account but no
> luck. I
> have also tried to create that user in tempdb and then denied "create
> table"
> on tempdb to this user but no luck again.
> While investigating more, when I queried on tempdb..sysobjects, I found
> that
> these temp tables are created with UID = 1 (dbo), not able to understand
> why
> the temp tables are being created as dbo and not with that user account.
> Any
> idea how I can prevent any user/role to create temp tables?
> Thanks in advance
> - Anil|||Thanks MB for your response. I went through below links but they are
applicable to SS 2005, we are using SS 2000 (SP4) in our production
environment currently.
Thanks
Anil
"MB" wrote:

> Hello Anil,
> Event Data function might help you. Check the following links for further
> details.
> http://msdn2.microsoft.com/en-us/library/ms187909.aspx
> http://blogs.msdn.com/mrorke/archiv.../25/456354.aspx
> Cheers!
> MB
> "anilksharma99" <anilksharma99@.discussions.microsoft.com> wrote in message
> news:E2BCCD74-D8A7-4ACC-993C-7F50C7AB947D@.microsoft.com...
>
>|||anilksharma99 (anilksharma99@.discussions.microsoft.com) writes:
> Thanks MB for your response. I went through below links but they are
> applicable to SS 2005, we are using SS 2000 (SP4) in our production
> environment currently.
Why do you want to revoke the rights to create temp tables? I am fairly
certain that if you were able to do this, that more than application would
break down.
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx

Prevent users from seeing Table structures or underlying data

I encrypt my procedures using with encryption clause, but I do not how to decrypt again.

Is there a command or utility for encrypt and decrypt in Sql 2000? How about Sql 2005?

Thanks

Haydee

Decryption is weak and can be cracked by searching on google for the specific algorithms, there was a thread sometime ago, which might be useful to you:

http://groups.google.de/group/comp.databases.ms-sqlserver/browse_frm/thread/34b309b76ba574b4

HTH, Jens Suessmeyer.

http://www.sqlserver2005.de

|||

Jens is right, the procedure encryption is actually referred to as obfuscation in Books Online. Also, there is no SQL Server command for decrypting it back.

Thanks
Laurentiu

|||

Thanks for your comments

and is there a tool in Sql Server 2005 in order to protect the code? What can I do? I need to install a project in the customer, and I would like to protect it.

Thanks again for your help.

Haydee

|||You could use third party components to accomplish this, there sure can be found some by searching in google for them.

HTH, Jens Suessmeyer.

http://www.sqlserver2005.de
|||

HI,

I am using MSDE 2000 and I will be deploying it with my software application. I have invested a good bit into my database schema and I don't want it to be viewed by others.

I can not see why some user can not take the .mdf (multiple mdf's actually) and sp_AttachDB or attach them to their instanced SQL server using EM. I of course do not want this.

Maybe someone can clear up the limitations and types of SQL security that can assure no one can simply attach the MDF to see the structure, let alone the data.

As far as I can see there is Network security as to authentication for a live/instanced SQL server and this has no ability to prevent an MDF from being re-attached and viewed/queried.

I also see EncryptByPassPhrase which I can use prior to executing a query (if I understand this process which is data remains in encrypted state until its about to be used, then decrypted in memory (I presume ? otherwise someone could grab a snapshot of the mdf while it's in decrypted state ? {or SQL server has a temp region when using encryption where it places the decrypted data I take it}) and then I have to encrypt it again after processing.

Neither of these look like they can obfuscate or lock the db schema information, such as table names, structures, fields, field types/attributes etc.

Sooooooo.....

How can I prevent a user from seeing the underlying table structures and does anyone know if column encryption will cost me 10 years off my life time wise on large data sets ?

Thanks

|||

See this recent thread for a discussion of this topic:

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=371562&SiteID=1

Thanks
Laurentiu

|||

The only feature for protecting code in SQL Server is the WITH ENCRYPTION clause that we discussed so far. It is weak not necessarily because the encryption is weak (it uses RC4), but because the encryption key can be easily found. An attacker will focus on finding the encryption key rather than breaking the encryption algorithm in such a solution. This is a general problem and for any solution you consider, you should look at how easy it is for someone to find the encryption key.

This is basically a DRM solution, and I have talked about the difficulty of creating an unbreakable DRM solution on other threads, more recently in:

http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=371562&SiteID=1

Thanks
Laurentiu

prevent users from modifying tables or data but allow creating and modifying store procedu

Hello
Is there a way in Sql Server to prevent a user from modifying tables or data
but allow creating and modifying store procedures?
thanks!!
Hmmm, that would be a strange one. I guess you would want them to be able
to create a procedure, but they wouldn't be able to execute it (even if only
to test it), because they could easily put ALTER TABLE or UPDATE in there?
You can prevent writing of data by:
USE <database>
GO
EXEC sp_addrolemember 'db_denydatawriter', '<user name>'
GO
As for allowing CREATE PROCEDURE but not ALTER TABLE, hmm, not sure about
that one. With SQL Server 2005, you could roll back unauthorized table mods
using DDL triggers...
http://www.aspfaq.com/
(Reverse address to reply.)
"Zeng" <zzy@.nonospam.com> wrote in message
news:uKtrn3tjEHA.1644@.tk2msftngp13.phx.gbl...
> Hello
> Is there a way in Sql Server to prevent a user from modifying tables or
data
> but allow creating and modifying store procedures?
> thanks!!
>
|||right click database, properties, permissions tab.
there are check boxes you can use to deny users to create table but allow
them to create sp.
steve
"Zeng" <zzy@.nonospam.com> wrote in message
news:uKtrn3tjEHA.1644@.tk2msftngp13.phx.gbl...
> Hello
> Is there a way in Sql Server to prevent a user from modifying tables or
data
> but allow creating and modifying store procedures?
> thanks!!
>

prevent users from modifying tables or data but allow creating and modifying store procedu

Hello
Is there a way in Sql Server to prevent a user from modifying tables or data
but allow creating and modifying store procedures?
thanks!!Hmmm, that would be a strange one. I guess you would want them to be able
to create a procedure, but they wouldn't be able to execute it (even if only
to test it), because they could easily put ALTER TABLE or UPDATE in there?
You can prevent writing of data by:
USE <database>
GO
EXEC sp_addrolemember 'db_denydatawriter', '<user name>'
GO
As for allowing CREATE PROCEDURE but not ALTER TABLE, hmm, not sure about
that one. With SQL Server 2005, you could roll back unauthorized table mods
using DDL triggers...
--
http://www.aspfaq.com/
(Reverse address to reply.)
"Zeng" <zzy@.nonospam.com> wrote in message
news:uKtrn3tjEHA.1644@.tk2msftngp13.phx.gbl...
> Hello
> Is there a way in Sql Server to prevent a user from modifying tables or
data
> but allow creating and modifying store procedures?
> thanks!!
>|||right click database, properties, permissions tab.
there are check boxes you can use to deny users to create table but allow
them to create sp.
steve
"Zeng" <zzy@.nonospam.com> wrote in message
news:uKtrn3tjEHA.1644@.tk2msftngp13.phx.gbl...
> Hello
> Is there a way in Sql Server to prevent a user from modifying tables or
data
> but allow creating and modifying store procedures?
> thanks!!
>

prevent users from modifying tables or data but allow creating and modifying store pro

Hello
Is there a way in Sql Server to prevent a user from modifying tables or data
but allow creating and modifying store procedures?
thanks!!Hmmm, that would be a strange one. I guess you would want them to be able
to create a procedure, but they wouldn't be able to execute it (even if only
to test it), because they could easily put ALTER TABLE or UPDATE in there?
You can prevent writing of data by:
USE <database>
GO
EXEC sp_addrolemember 'db_denydatawriter', '<user name>'
GO
As for allowing CREATE PROCEDURE but not ALTER TABLE, hmm, not sure about
that one. With SQL Server 2005, you could roll back unauthorized table mods
using DDL triggers...
http://www.aspfaq.com/
(Reverse address to reply.)
"Zeng" <zzy@.nonospam.com> wrote in message
news:uKtrn3tjEHA.1644@.tk2msftngp13.phx.gbl...
> Hello
> Is there a way in Sql Server to prevent a user from modifying tables or
data
> but allow creating and modifying store procedures?
> thanks!!
>|||right click database, properties, permissions tab.
there are check boxes you can use to deny users to create table but allow
them to create sp.
steve
"Zeng" <zzy@.nonospam.com> wrote in message
news:uKtrn3tjEHA.1644@.tk2msftngp13.phx.gbl...
> Hello
> Is there a way in Sql Server to prevent a user from modifying tables or
data
> but allow creating and modifying store procedures?
> thanks!!
>

Prevent users from browsing the reporting server site?

Dear MSDN!
Are there some way to prevent users from browsing the reporting server site?
The reason for this is that we want to access the reports on the reporting
services from our own website with POST parameters to the reports.
Thanks in advance!You should be able to control access via IIS and Active Directory.
"MrGrundh" <MrGrundh@.nospam.nospam> wrote in message
news:320B63A2-7C12-4CC4-9C73-124BB72C9A60@.microsoft.com...
> Dear MSDN!
> Are there some way to prevent users from browsing the reporting server
> site?
> The reason for this is that we want to access the reports on the reporting
> services from our own website with POST parameters to the reports.
> Thanks in advance!|||Could you be more specific?
"Rodney Mullins" wrote:
> You should be able to control access via IIS and Active Directory.
> "MrGrundh" <MrGrundh@.nospam.nospam> wrote in message
> news:320B63A2-7C12-4CC4-9C73-124BB72C9A60@.microsoft.com...
> > Dear MSDN!
> >
> > Are there some way to prevent users from browsing the reporting server
> > site?
> >
> > The reason for this is that we want to access the reports on the reporting
> > services from our own website with POST parameters to the reports.
> >
> > Thanks in advance!
>
>|||It is a bad idea to start messing around with IIS. Any access control should
be done with RS roles.
I haven't done this but it is worth a try. Create a new role. Allow it to
view reports only (i.e. don't give it View Folders rights). Try assigning a
user to that role and see if it does as you want.
Bruce Loehle-Conger
MVP SQL Server Reporting Services
"MrGrundh" <MrGrundh@.nospam.nospam> wrote in message
news:C3ACED47-CED1-4BF6-83B9-5AA81BD914F7@.microsoft.com...
> Could you be more specific?
> "Rodney Mullins" wrote:
>> You should be able to control access via IIS and Active Directory.
>> "MrGrundh" <MrGrundh@.nospam.nospam> wrote in message
>> news:320B63A2-7C12-4CC4-9C73-124BB72C9A60@.microsoft.com...
>> > Dear MSDN!
>> >
>> > Are there some way to prevent users from browsing the reporting server
>> > site?
>> >
>> > The reason for this is that we want to access the reports on the
>> > reporting
>> > services from our own website with POST parameters to the reports.
>> >
>> > Thanks in advance!
>>|||Hi Bruce!
Your suggestion did not work. A user can still use the URL to the report and
browse it.
http://myServer/reportserver?/SalesReports/CORES.Report.Sales2_1
"Bruce L-C [MVP]" wrote:
> It is a bad idea to start messing around with IIS. Any access control should
> be done with RS roles.
> I haven't done this but it is worth a try. Create a new role. Allow it to
> view reports only (i.e. don't give it View Folders rights). Try assigning a
> user to that role and see if it does as you want.
>
> --
> Bruce Loehle-Conger
> MVP SQL Server Reporting Services
> "MrGrundh" <MrGrundh@.nospam.nospam> wrote in message
> news:C3ACED47-CED1-4BF6-83B9-5AA81BD914F7@.microsoft.com...
> > Could you be more specific?
> >
> > "Rodney Mullins" wrote:
> >
> >> You should be able to control access via IIS and Active Directory.
> >>
> >> "MrGrundh" <MrGrundh@.nospam.nospam> wrote in message
> >> news:320B63A2-7C12-4CC4-9C73-124BB72C9A60@.microsoft.com...
> >> > Dear MSDN!
> >> >
> >> > Are there some way to prevent users from browsing the reporting server
> >> > site?
> >> >
> >> > The reason for this is that we want to access the reports on the
> >> > reporting
> >> > services from our own website with POST parameters to the reports.
> >> >
> >> > Thanks in advance!
> >>
> >>
> >>
>
>|||Ahh, I thought you didn't want them to see the list of reports.
There is no way around the URL working for the user to view a specific
report. Or at least not without a whole lot of work. If you implement forms
authentication and then in your app you use a virtual user to view the
report then you could prevent this.
Note that if the goal is that only certain users should see a particular
report that is easy or if a user should only see certain data, that is also
easy.
In the latter case use the global variable User!UserID and have your data us
that user id to only present data that user should see.
Bruce Loehle-Conger
MVP SQL Server Reporting Services
"MrGrundh" <MrGrundh@.nospam.nospam> wrote in message
news:4F088003-0FC8-429D-AF5B-2E70A0E80BAD@.microsoft.com...
> Hi Bruce!
> Your suggestion did not work. A user can still use the URL to the report
> and
> browse it.
> http://myServer/reportserver?/SalesReports/CORES.Report.Sales2_1
>
> "Bruce L-C [MVP]" wrote:
>> It is a bad idea to start messing around with IIS. Any access control
>> should
>> be done with RS roles.
>> I haven't done this but it is worth a try. Create a new role. Allow it to
>> view reports only (i.e. don't give it View Folders rights). Try assigning
>> a
>> user to that role and see if it does as you want.
>>
>> --
>> Bruce Loehle-Conger
>> MVP SQL Server Reporting Services
>> "MrGrundh" <MrGrundh@.nospam.nospam> wrote in message
>> news:C3ACED47-CED1-4BF6-83B9-5AA81BD914F7@.microsoft.com...
>> > Could you be more specific?
>> >
>> > "Rodney Mullins" wrote:
>> >
>> >> You should be able to control access via IIS and Active Directory.
>> >>
>> >> "MrGrundh" <MrGrundh@.nospam.nospam> wrote in message
>> >> news:320B63A2-7C12-4CC4-9C73-124BB72C9A60@.microsoft.com...
>> >> > Dear MSDN!
>> >> >
>> >> > Are there some way to prevent users from browsing the reporting
>> >> > server
>> >> > site?
>> >> >
>> >> > The reason for this is that we want to access the reports on the
>> >> > reporting
>> >> > services from our own website with POST parameters to the reports.
>> >> >
>> >> > Thanks in advance!
>> >>
>> >>
>> >>
>>|||It is not possible to use a "virtual user" when accessing reporting server
because we use POST method with parameters.
"Bruce L-C [MVP]" wrote:
> Ahh, I thought you didn't want them to see the list of reports.
> There is no way around the URL working for the user to view a specific
> report. Or at least not without a whole lot of work. If you implement forms
> authentication and then in your app you use a virtual user to view the
> report then you could prevent this.
> Note that if the goal is that only certain users should see a particular
> report that is easy or if a user should only see certain data, that is also
> easy.
> In the latter case use the global variable User!UserID and have your data us
> that user id to only present data that user should see.
>
> --
> Bruce Loehle-Conger
> MVP SQL Server Reporting Services
> "MrGrundh" <MrGrundh@.nospam.nospam> wrote in message
> news:4F088003-0FC8-429D-AF5B-2E70A0E80BAD@.microsoft.com...
> > Hi Bruce!
> >
> > Your suggestion did not work. A user can still use the URL to the report
> > and
> > browse it.
> >
> > http://myServer/reportserver?/SalesReports/CORES.Report.Sales2_1
> >
> >
> > "Bruce L-C [MVP]" wrote:
> >
> >> It is a bad idea to start messing around with IIS. Any access control
> >> should
> >> be done with RS roles.
> >>
> >> I haven't done this but it is worth a try. Create a new role. Allow it to
> >> view reports only (i.e. don't give it View Folders rights). Try assigning
> >> a
> >> user to that role and see if it does as you want.
> >>
> >>
> >> --
> >> Bruce Loehle-Conger
> >> MVP SQL Server Reporting Services
> >>
> >> "MrGrundh" <MrGrundh@.nospam.nospam> wrote in message
> >> news:C3ACED47-CED1-4BF6-83B9-5AA81BD914F7@.microsoft.com...
> >> > Could you be more specific?
> >> >
> >> > "Rodney Mullins" wrote:
> >> >
> >> >> You should be able to control access via IIS and Active Directory.
> >> >>
> >> >> "MrGrundh" <MrGrundh@.nospam.nospam> wrote in message
> >> >> news:320B63A2-7C12-4CC4-9C73-124BB72C9A60@.microsoft.com...
> >> >> > Dear MSDN!
> >> >> >
> >> >> > Are there some way to prevent users from browsing the reporting
> >> >> > server
> >> >> > site?
> >> >> >
> >> >> > The reason for this is that we want to access the reports on the
> >> >> > reporting
> >> >> > services from our own website with POST parameters to the reports.
> >> >> >
> >> >> > Thanks in advance!
> >> >>
> >> >>
> >> >>
> >>
> >>
> >>
>
>