Skip to content

Commit d09870e

Browse files
v-shilsv-shils
authored
Merge pull request #34487 from rwestMSFT/rw-0620-deny
Refresh DENY article
2 parents 9b882a6 + 8656f4e commit d09870e

File tree

1 file changed

+70
-60
lines changed

1 file changed

+70
-60
lines changed

‎docs/t-sql/statements/deny-system-object-permissions-transact-sql.md

Lines changed: 70 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,10 @@
11
---
22
title: "DENY System Object Permissions (Transact-SQL)"
3-
description: DENY System Object Permissions (Transact-SQL)
3+
description: Denies permissions on system objects such as stored procedures, extended stored procedures, functions, and views.
44
author: VanMSFT
55
ms.author: vanto
6-
ms.date: "06/10/2016"
6+
ms.reviewer: randolphwest
7+
ms.date: 06/20/2025
78
ms.service: sql
89
ms.subservice: t-sql
910
ms.topic: reference
@@ -18,68 +19,77 @@ dev_langs:
1819
- "TSQL"
1920
monikerRange: "=azuresqldb-current || >=sql-server-2016 || >=sql-server-linux-2017 || =azuresqldb-mi-current || =fabric"
2021
---
21-
# DENY System Object Permissions (Transact-SQL)
22+
# DENY system object permissions (Transact-SQL)
23+
2224
[!INCLUDE [SQL Server Azure SQL Database Azure SQL Managed Instance FabricSQLDB](../../includes/applies-to-version/sql-asdb-asdbmi-fabricsqldb.md)]
2325

24-
Denies permissions on system objects such as stored procedures, extended stored procedures, functions, and views.
25-
26-
:::image type="icon" source="../../includes/media/topic-link-icon.svg" border="false"::: [Transact-SQL syntax conventions](../../t-sql/language-elements/transact-sql-syntax-conventions-transact-sql.md)
27-
28-
## Syntax
29-
26+
Denies permissions on system objects such as stored procedures, extended stored procedures, functions, and views.
27+
28+
:::image type="icon" source="../../includes/media/topic-link-icon.svg" border="false"::: [Transact-SQL syntax conventions](../../t-sql/language-elements/transact-sql-syntax-conventions-transact-sql.md)
29+
30+
## Syntax
31+
3032
```syntaxsql
31-
DENY { SELECT | EXECUTE } ON [ sys.]system_object TO principal
32-
```
33-
33+
DENY { SELECT | EXECUTE } ON [ sys. ] system_object TO principal
34+
```
35+
3436
## Arguments
35-
[ **sys.**]
36-
The **sys** qualifier is required only when you are referring to catalog views and dynamic management views.
37-
38-
*system_object*
39-
Specifies the object on which permission is being denied.
40-
41-
*principal*
42-
Specifies the principal from which the permission is being revoked.
43-
44-
## Remarks
45-
This statement can be used to deny permissions on certain stored procedures, extended stored procedures, table-valued functions, scalar functions, views, catalog views, compatibility views, INFORMATION_SCHEMA views, dynamic management views, and system tables that are installed by [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)]. Each of these system objects exists as a unique record in the resource database (**mssqlsystemresource**). The resource database is read-only. A link to the object is exposed as a record in the **sys** schema of every database.
46-
47-
Default name resolution resolves unqualified procedure names to the resource database. Therefore, the **sys** qualifier is only required when you are specifying catalog views and dynamic management views.
48-
37+
38+
#### [ sys. ]
39+
40+
The `sys` qualifier is required only when you're referring to catalog views and dynamic management views.
41+
42+
#### *system_object*
43+
44+
Specifies the object on which permission is being denied.
45+
46+
#### *principal*
47+
48+
Specifies the principal from which the permission is being revoked.
49+
50+
## Remarks
51+
52+
This statement can be used to deny permissions on certain stored procedures, extended stored procedures, table-valued functions, scalar functions, views, catalog views, compatibility views, `INFORMATION_SCHEMA` views, dynamic management views, and system tables that are installed by [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)]. Each of these system objects exists as a unique record in the resource database (`mssqlsystemresource`). The resource database is read-only. A link to the object is exposed as a record in the `sys` schema of every database.
53+
54+
Default name resolution resolves unqualified procedure names to the resource database. Therefore, the `sys` qualifier is only required when you're specifying catalog views and dynamic management views.
55+
4956
> [!CAUTION]
50-
> Denying permissions on system objects will cause applications that depend on them to fail. [!INCLUDE[ssManStudioFull](../../includes/ssmanstudiofull-md.md)] uses catalog views and may not function as expected if you change the default permissions on catalog views.
51-
52-
Denying permissions on triggers and on columns of system objects is not supported.
53-
54-
Permissions on system objects will be preserved during upgrades of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)].
55-
56-
System objects are visible in the [sys.system_objects](../../relational-databases/system-catalog-views/sys-system-objects-transact-sql.md) catalog view. The permissions on system objects are visible in the [sys.database_permissions](../../relational-databases/system-catalog-views/sys-database-permissions-transact-sql.md) catalog view in the **master** database.
57-
58-
The following query returns information about permissions of system objects:
59-
57+
> Denying permissions on system objects causes applications that depend on them to fail. [!INCLUDE [ssManStudioFull](../../includes/ssmanstudiofull-md.md)] uses catalog views and might not function as expected, if you change the default permissions on catalog views.
58+
59+
Denying permissions on triggers and on columns of system objects isn't supported.
60+
61+
Permissions on system objects are preserved during [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] upgrades.
62+
63+
System objects are visible in the [sys.system_objects](../../relational-databases/system-catalog-views/sys-system-objects-transact-sql.md) catalog view. The permissions on system objects are visible in the [sys.database_permissions](../../relational-databases/system-catalog-views/sys-database-permissions-transact-sql.md) catalog view in the `master` database.
64+
65+
The following query returns information about permissions of system objects:
66+
6067
```sql
61-
SELECT * FROM master.sys.database_permissions AS dp
62-
JOIN sys.system_objects AS so
63-
ON dp.major_id = so.object_id
64-
WHERE dp.class = 1 AND so.parent_object_id = 0 ;
65-
GO
66-
```
67-
68-
## Permissions
69-
Requires CONTROL SERVER permission.
70-
71-
## Examples
72-
The following example denies `EXECUTE` permission on `xp_cmdshell` to `public`.
73-
68+
SELECT *
69+
FROM master.sys.database_permissions AS dp
70+
INNER JOIN sys.system_objects AS so
71+
ON dp.major_id = so.object_id
72+
WHERE dp.class = 1
73+
AND so.parent_object_id = 0;
74+
GO
75+
```
76+
77+
## Permissions
78+
79+
Requires `CONTROL SERVER` permission.
80+
81+
## Examples
82+
83+
The following example denies `EXECUTE` permission on `xp_cmdshell` to **public**.
84+
7485
```sql
75-
DENY EXECUTE ON sys.xp_cmdshell TO public;
76-
GO
77-
```
78-
79-
## See Also
80-
[Transact-SQL syntax conventions](../../t-sql/language-elements/transact-sql-syntax-conventions-transact-sql.md)
81-
[sys.database_permissions (Transact-SQL)](../../relational-databases/system-catalog-views/sys-database-permissions-transact-sql.md)
82-
[GRANT System Object Permissions (Transact-SQL)](../../t-sql/statements/grant-system-object-permissions-transact-sql.md)
83-
[REVOKE System Object Permissions (Transact-SQL)](../../t-sql/statements/revoke-system-object-permissions-transact-sql.md)
84-
85-
86+
DENY EXECUTE ON sys.xp_cmdshell TO PUBLIC;
87+
GO
88+
```
89+
90+
## Related content
91+
92+
- [Transact-SQL syntax conventions (Transact-SQL)](../language-elements/transact-sql-syntax-conventions-transact-sql.md)
93+
- [sys.database_permissions](../../relational-databases/system-catalog-views/sys-database-permissions-transact-sql.md)
94+
- [GRANT system object permissions (Transact-SQL)](grant-system-object-permissions-transact-sql.md)
95+
- [REVOKE System Object Permissions (Transact-SQL)](revoke-system-object-permissions-transact-sql.md)

0 commit comments

Comments
 (0)