user does not have permission to run DBCC PAGE

Question

Hi,

We have configured Always on configuration. Primary-A and secondary-B.
When we are connecting SAP Application using Listener, Their is no error is showing.

If we fail over to secondary. Now B is primary. The SAP Application through listener we can see below below error.

user does not have permission to run DBCC PAGE.[WP32] [sap_get_last_dbcc_checkdb:build_n_exec]

User is P38. Same kind of permissions are present for user P38 in both replicas. (I transferred same logins to secondary and manually also i checked in both replicas. Everything is matching.)

Kindly help me how to resolve the error?

Thanks,
Pols

Answer 1

Hi @Pol ,

We requires membership in the sysadmin fixed server role or the db_owner fixed database role to run DBCC CheckDB. It's an open secret that there's an undocumented DBCC command called DBCC PAGE that you can use to look at the contents of database pages. There is no MS document talking about this. So suggest you using the same permissions as running DBCC CheckDB.

> User is P38. Same kind of permissions are present for user P38 in both replicas.

Did the user P38 mapping the same logins in serve A and server B? Did the logins has same SID? Refer to the blog SQL Server Logins, Users and Security Identifiers (SIDs) to get more information.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 2

I would suggest talking to SAP support about the required db permissions for their application.

Answer 3

Since DBCC PAGE is not a documented command, there is no documentation to check what permissions that are needed to run DBCC PAGE. I see that for the new DMV, sys.dm_db_page_into, which is a more civilised way to run DBCC PAGE, only requires VIEW DATABASE STATE. This is a database permission, and thus if you grant in the database, it will be available in all replicas.

However, I would suspect that DBCC PAGE requires a server-level permission, probably membership in the sysadmin role. And server-level permission lives in the master database, and does thus not follow with the replica, but you need to set it up on every node.