Question

I have a SQL Server 2005 database that is suffering from lock starvation because of some poorly behaving applications running cursors through sp_prepexec. I imagine that one of the applications running a cursor has ‘forgotten’ to close it. I would like to deny access to sp_prepexec for specific users to prevent the lock starvation from occurring in the production database.

When I’m attempting the following syntax:

use master deny execute on sp_prepexec to applicationUser

I have to use master because when I don’t: Permissions on server scoped catalog views or system stored procedures or extended stored procedures can be granted only when the current database is master.

But the problem is that applicationUser is not a user in the master database. So I get the following error: Cannot find the user ‘applicationUser’, because it does not exist or you do not have permission.

If I add that user to master it doesn’t seem to prevent applicationUser from running sp_prepexec in the production database.

Can somebody point me in the right direction with this?

Answer 1

Could you deny the permissions to a role, rather than a specific user?

USE master GO DENY EXECUTE ON production.sp_prepexec TO public GO