Script to Retrieve Security Information SQL Server 2005 and above

In my working environment I’ve asked to write a script to find security information which should return Server Logins, Database Logins and object level permissions. I’ve written that and I’m sharing this to you since this could be helpful to you.

Works With

  • SQL Server 2005
  • SQL Server 2008 and
  • SQL Server 2008 R2

Script to find server level logins and role assigned

SELECT a.name as LoginName,a.type_desc AS LoginType, a.default_database_name AS DefaultDBName,
CASE WHEN b.sysadmin = 1 THEN 'sysadmin'
          WHEN b.securityadmin=1 THEN 'securityadmin'
          WHEN b.serveradmin=1 THEN 'serveradmin'
          WHEN b.setupadmin=1 THEN 'setupadmin'
          WHEN b.processadmin=1 THEN 'processadmin'
          WHEN b.diskadmin=1 THEN 'diskadmin'
          WHEN b.dbcreator=1 THEN 'dbcreator'
          WHEN b.bulkadmin=1 THEN 'bulkadmin'
          ELSE 'Public' END AS 'ServerRole'
FROM sys.server_principals a  JOIN master..syslogins b ON a.sid=b.sid WHERE a.type  <> 'R' AND a.name NOT LIKE '##%'

Script to find database users and roles assigned

DECLARE @DBuser_sql VARCHAR(4000)
DECLARE @DBuser_table TABLE (DBName VARCHAR(200), UserName VARCHAR(250), LoginType VARCHAR(500), AssociatedRole VARCHAR(200))
SET @DBuser_sql='SELECT ''?'' AS DBName,a.name AS Name,a.type_desc AS LoginType,USER_NAME(b.role_principal_id) AS AssociatedRole FROM ?.sys.database_principals a
LEFT OUTER JOIN ?.sys.database_role_members b ON a.principal_id=b.member_principal_id
WHERE a.sid NOT IN (0x01,0x00) AND a.sid IS NOT NULL AND a.type NOT IN (''C'') AND a.is_fixed_role <> 1 AND a.name NOT LIKE ''##%'' AND ''?'' NOT IN (''master'',''msdb'',''model'',''tempdb'') ORDER BY Name'
INSERT @DBuser_table
EXEC sp_MSforeachdb @command1=@dbuser_sql
SELECT * FROM @DBuser_table ORDER BY DBName

Script to find Object level permission for user databases

DECLARE @Obj_sql VARCHAR(2000)
DECLARE @Obj_table TABLE (DBName VARCHAR(200), UserName VARCHAR(250), ObjectName VARCHAR(500), Permission VARCHAR(200))
SET @Obj_sql='select ''?'' as DBName,U.name as username, O.name as object,  permission_name as permission from ?.sys.database_permissions
join ?.sys.sysusers U on grantee_principal_id = uid join ?.sys.sysobjects O on major_id = id WHERE ''?'' NOT IN (''master'',''msdb'',''model'',''tempdb'') order by U.name '
INSERT @Obj_table
EXEC sp_msforeachdb @command1=@Obj_sql
SELECT * FROM @Obj_table

Leave a Reply

12 thoughts on “Script to Retrieve Security Information SQL Server 2005 and above”

  1. Is it possible to know who are all accessed the DB, what were the queries they have ran? It should give the results from the DB creation time?

    1. @Pavan — This is frequently asked question. There is no column in SQL which will tell you when database is last accessed, you can either run a profiler or take the db to offline or readonly mode then the required team or user will get in touch with you. Yes you can get the queries using dmvs however this will give you the queries ran from the last SQL Server restart it will give you all the queries from db created date.

  2. Very useful sript. I am using this (and one for SQL 2000) to collect all login/user information from many production server into centralized server.

    Only one correction I have to make is,
    replace

    USER_NAME(b.role_principal_id) AS AssociatedRole

    with

    (select x.Name from ?.sys.database_principals x where x.Principal_id=b.role_principal_id) AS AS AssociatedRole

    Reason for this is, when you run sp_MSforeachdb, it run under master database and USER_NAME function will always return value from master database only. (or you can add USE ? at the top of the script.

  3. Thanks for the script. I had database with space between the names.

    I modified to use square brackets:

    FROM [?].sys.database_principals a
    LEFT OUTER JOIN [?].sys.database_role_members

    and

    from [?].sys.database_permissions join [?].sys.sysusers U
    on grantee_principal_id = uid join [?].sys.sysobjects

Leave a Reply

Your email address will not be published. Required fields are marked *

*