is there a secuirty risk to grant users view server state?

_{Wednesday, October 5, 2011 2:40 PM}

I assume it is only view the info, not able to change anything with this permission?

_{Wednesday, October 5, 2011 3:13 PM ✅Answered}

You assume correct.

If you would like to provide access to a specific DMV for example, you could encapsulate the query using a stored procedure. You would then not need to grant the Login the view server state privilege.

John Sansom | SQL Server DBA Blog | Twitter

_{Wednesday, October 5, 2011 7:27 PM ✅Answered | 1 vote}

If you have a shared environment hosting multiple databases, yes there is absolutely a risk in providing VIEW SERVER STATE to users if they aren't supposed to see information about the other databases.  For example: sys.dm_exec_cached_plans, sys.dm_exec_query_stats, sys.dm_exec_requests, sys.dm_exec_connections, all provide information about execution contexts and plans, and when used in conjunction with sys.dm_exec_sql_text() or sys.dm_exec_query_plan() give information about code and objects in databases.  This would not be acceptable in some environments.  VIEW SERVER STATE gives unrestricted access to this information using these views and functions.  They can't change anything, but they can get information that may not be something that should be seen across databases or responsibilities.  This is why shared hosting environments will not provide this kind of permission.

Jonathan Kehayias | Principal Consultant, SQLSkills.com
SQL Server MVP | Microsoft Certified Master: SQL Server 2008
Author of Troubleshooting SQL Server: A Guide for Accidental DBAs
Feel free to contact me through My Blog or Twitter. Become a SQLskills Insider!
Please click the Mark as Answer button if a post solves your problem!

_{Friday, October 7, 2011 4:33 AM}

Here is some nice discussion around the same.

http://www.sqlservercentral.com/Forums/Topic1002451-1526-1.aspx#bm1002975

Thanks

Ajay Rengunthwar