I think one disadvantage is that, when the guest user is added to the database, anyone having a valid login can access the given databases. This might be a security threat in some environments.

hello brother ... what is said is perfect any login can access the database when guest user is enabled on it, but we cannot query any single object in the database, then how it can be a security threat that is what i am thinking.

Hi Calyan,

Welcome to BeyondRelational and very interesting question.

Let us start with simple example. One server has two database. Database A and Database B. User A has access to only Database A and User B has access to only Database B. When User A is logged in he can do all the necessary based on permission in Database A but is logged in Database B as Guest. In default condition, he can not do anything as SQL Server does not have any permission on guest login (which can be found under ServerInstance >> Databases>> System Databases >> master>> Security >> Users >> Guest).

However, the feature is that if you modify the guest login and give any permission to that login (e.g. create, drop or anything which are applicable), automatically all the Guest logins (in our earlier case User A) will get those permissions.

I think this sometime can create compromising situation and all the other admins can overlook it (if one person has modified permission). For the same reason, you need to disable it. I think this is what exactly Jacob is suggesting in earlier thread.

Many thanks,

really thanks for reply....... i am very much happy that becoz i am getting replies from SQL GURUS whom i like most.

Jacob and Pinal has clearly explained this.

Any database user requires map to a login. But the guest user, does not require mapping to any login. Hence it suggested to disable the login other than master and  tempdb databases.

BOL SQL Server 2008: "By default, the database includes a guest user when a database is created. Permissions granted to the guest user are inherited by users who do not have a user account in the database."