How do you configure a MS SQL Server to prevent exposing all database names and logins to any authenticated user?

Solution 1:

Speaking from the development side, I can say that the admin should be able to lock everyone down to their own database (and probably master as well, for metadata). From the MSDN, the list of SQL Server securables includes databases and the permissions include being able to even see the database. Here is a link to the MSDN Security considerations for databases.

Solution 2:

Management Studio gets the list of databases from sys.databases. The default permissions on sys.databases is for each login to see only it's own database:

If the caller of sys.databases is not the owner of the database and the database is not master or tempdb, the minimum permissions required to see the corresponding row are ALTER ANY DATABASE or VIEW ANY DATABASE server-level permission, or CREATE DATABASE permission in the master database. The database to which the caller is connected can always be viewed in sys.databases.

If you have logins that see databases other that their own, it implies said logins have unnecessary privileges, like CREATE DATABASE.

Solution 3:

To hide databases to all LOGINS, remove/revoke "VIEW ANY DATABASE" permission from the public server role

http://sqlism.blogspot.com/2014/10/preventing-logins-and-users-to-see.html