> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cockroachlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# DROP USER

The `DROP USER` [statement](/docs/stable/sql-statements.md) removes one or more SQL users. You can use the keywords `ROLE` and `USER` interchangeably. `DROP USER` is an alias for [`DROP ROLE`](/docs/stable/drop-role).

> [!NOTE]
>
> The `DROP USER` statement performs a schema change. For more information about how online schema changes work in CockroachDB, see [Online Schema Changes](/docs/stable/online-schema-changes.md).

## Considerations

* The `admin` user/role cannot be dropped, and `root` must always be a member of `admin`.
* A user/role cannot be dropped if it has privileges. Use [`REVOKE`](/docs/stable/revoke) to remove privileges.
* Users/roles that [own objects](/docs/stable/security-reference/authorization.md#object-ownership) (such as databases, tables, schemas, and types) cannot be dropped until the [ownership is transferred to another user/role](/docs/stable/alter-database.md).
* If a user/role is logged in while a [different session](/docs/stable/show-sessions.md) drops that user, CockroachDB checks that the user exists before allowing it to inherit privileges from [the `public` role](/docs/stable/security-reference/authorization). In addition, any active [web](/docs/stable/ui-overview.md#authentication) [sessions](/docs/stable/cockroach-auth-session.md) are revoked when a user is dropped.
* To bulk-drop [auto-provisioned](/docs/stable/ldap-authentication.md#option-1-automatic-user-provisioning-recommended) users (for example, dormant users provisioned through LDAP, OIDC, or JWT authentication), use [`DROP PROVISIONED ROLES`](/docs/stable/drop-provisioned-roles) instead.

## Required privileges

Non-admin users cannot drop admin users. To drop non-admin users, the user must be a member of the `admin` role or have the [`CREATEROLE`](/docs/stable/create-user#create-a-user-that-can-create-other-users-and-manage-authentication-methods-for-the-new-users) parameter set.

## Synopsis

See [`DROP ROLE`: Synopsis](/docs/stable/drop-role#synopsis).

## Parameters

| Parameter | Description |
| - | - |
| `user_name` | The name of the user to remove. To remove multiple users, use a comma-separate list of usernames. You can use [`SHOW USERS`](/docs/stable/show-users) to find usernames. |

## Example

### Remove privileges

All of a user's privileges must be revoked before the user can be dropped.

In this example, first check a user's privileges. Then, revoke the user's privileges before removing the user.

```sql theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
CREATE DATABASE test;
CREATE TABLE customers (k int, v int);
CREATE USER max;
GRANT ALL ON TABLE customers TO max;
```

```sql theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
SHOW GRANTS ON customers FOR max;
```

```
  database_name | schema_name | table_name | grantee | privilege_type | is_grantable
----------------+-------------+------------+---------+----------------+---------------
  test          | public      | customers  | max     | ALL            |      f
(1 row)
```

```sql theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
REVOKE CREATE,INSERT,UPDATE ON customers FROM max;
```

### Remove default privileges

In addition to removing a user's privileges, a user's [default privileges](/docs/stable/security-reference/authorization.md#default-privileges) must be removed prior to dropping the user. If you attempt to drop a user with modified default privileges, you will encounter an error like the following:

```sql theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
DROP USER max;
```

```
ERROR: cannot drop role/user max: grants still exist on test.public.customers
SQLSTATE: 2BP01
```

To see what privileges the user still has remaining on the table, issue the following statement:

```sql theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
SHOW GRANTS ON TABLE test.customers FOR max;
```

```
  database_name | schema_name | table_name | grantee | privilege_type | is_grantable
----------------+-------------+------------+---------+----------------+---------------
  test          | public      | customers  | max     | BACKUP         |      f
  test          | public      | customers  | max     | CHANGEFEED     |      f
  test          | public      | customers  | max     | DELETE         |      f
  test          | public      | customers  | max     | DROP           |      f
  test          | public      | customers  | max     | SELECT         |      f
  test          | public      | customers  | max     | ZONECONFIG     |      f
(6 rows)
```

To drop the user you must revoke all of the user's remaining privileges:

```sql theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
REVOKE ALL ON TABLE public.customers FROM max;
```

Now dropping the user should succeed:

```sql theme={"theme":{"light":"catppuccin-mocha","dark":"catppuccin-mocha"}}
DROP USER max;
```

## See also

* [`CREATE USER`](/docs/stable/create-user)
* [`ALTER USER`](/docs/stable/alter-user)
* [`DROP PROVISIONED ROLES`](/docs/stable/drop-provisioned-roles)
* [`SHOW USERS`](/docs/stable/show-users)
* [`GRANT`](/docs/stable/grant)
* [`SHOW GRANTS`](/docs/stable/show-grants)
* [Create Security Certificates](/docs/stable/cockroach-cert.md)
* [SQL Statements](/docs/stable/sql-statements.md)