Account Management Statements Revoking a role revokes the role itself, not the privileges that it represents. Suppose that an account is granted a role that includes a given privilege, and is also granted the privilege explicitly or another role that includes the privilege. In this case, the account still possesses that privilege if the first role is revoked. For example, if an account is granted two roles that each include  SELECT , the account still can select after either role is revoked. REVOKE ALL ON *.*  (at the global level) revokes all granted static global privileges and all granted dynamic privileges. User accounts and roles from which privileges and roles are to be revoked must exist, but the privileges and roles to be revoked need not be currently granted to them. A revoked privilege that is granted but not known to the server is revoked with a warning. This situtation can occur for dynamic privileges. For example, a dynamic privilege can be granted while the component that registers it is installed, but if that component is subsequently uninstalled, the privilege becomes unregistered, although accounts that possess the privilege still possess it and it can be revoked from them. REVOKE  removes privileges, but does not remove rows from the  mysql.user  system table. To remove a user account entirely, use  DROP USER . See Section 13.7.1.5, “DROP USER Statement” . If the grant tables hold privilege rows that contain mixed-case database or table names and the lower_case_table_names  system variable is set to a nonzero value,  REVOKE  cannot be used to revoke these privileges. It is necessary in such cases to manipulate the grant tables directly. ( GRANT  does not create such rows when  lower_case_table_names  is set, but such rows might have been created prior to setting the variable. The  lower_case_table_names  setting can only be configured when initializing the server.) When successfully executed from the  mysql  program,  REVOKE  responds with  Query OK, 0 rows affected . To determine what privileges remain after the operation, use  SHOW GRANTS . See Section 13.7.7.21, “SHOW GRANTS Statement” . For each  user  named immediately after the  TO  keyword, this statement defines which roles become active when the user connects to the server and authenticates, or when the user executes the  SET ROLE DEFAULT  statement during a session. SET DEFAULT ROLE  is alternative syntax for  ALTER USER ... DEFAULT ROLE  (see Section 13.7.1.1, “ALTER USER Statement” ). However,  ALTER USER  can set the default for only a single user, whereas SET DEFAULT ROLE  can set the default for multiple users. On the other hand, you can specify CURRENT_USER  as the user name for the  ALTER USER  statement, whereas you cannot for  SET DEFAULT ROLE . SET DEFAULT ROLE  requires these privileges: •Setting the default roles for another user requires the global  CREATE USER  privilege, or the  UPDATE privilege for the  mysql.default_roles  system table. •Setting the default roles for yourself requires no special privileges, as long as the roles you want as the default have been granted to you. Each role name uses the format described in Section 6.2.5, “Specifying Role Names” . For example: SET DEFAULT ROLE {NONE | ALL |  role  [,  role  ] ...} TO  user  [,  user  ] ... 13.7.1.9 SET DEFAULT ROLE Statement 2878