Solved

sql queries for logins and password policy

Posted on 2014-09-22
2
661 Views
Last Modified: 2014-10-07
We need to audit a number of sql server installations, ranging from 2000 - 2008.

I need a query (if different for each release of SQL one per release) to list:

1) details of the password policy per sql login (i.e.password expirty, complexity, lockout values etc)

2) details of all sql server authentication logins and their server level permissions (i.e. sysadmin, securityadmin)

3) guest account status per database (i.e. enabled, not enabled).
0
Comment
Question by:pma111
  • 2
2 Comments
 
LVL 22

Accepted Solution

by:
Steve Wales earned 500 total points
Comment Utility
The below applies for 2005+

Password Policy per SQL Login is only a flag for on or off.  If the Password Policy flag is checked, then the Windows Password Policy from the operating system are enforced.

Check the CREATE LOGIN documentation for the details on what happens when CHECK_POLICY and CHECK_EXPIRATION are set.

You can see the settings per SQL user by checking columns is_policy_checked and is_expiration_checked in sys.sql_logins

Doco for sys.sql_logins from Books Online: http://msdn.microsoft.com/en-us/library/ms174355.aspx

For complexity, lockout values etc, I believe you need to go to the OS for that (and I'm not even 100% certain it will lock out the account in SQL Server

For SQL Server Authentication Logins:

select * from sys.server_principals where type in ('U','G') - will show you the logins and groups that can access a SQL Server via Windows Authentication.

Books Online for server_principals: http://msdn.microsoft.com/en-us/library/ms188786.aspx

If you want to see which login has access to which server roles, use sys.server_role_members - something like this:

select b.name + ' has ' + c.name
from sys.server_role_members a
join sys.server_principals b on a.member_principal_id = b.principal_id
join sys.server_principals c on a.role_principal_id = c.principal_id

Open in new window


Books Online for Server_role_members: http://msdn.microsoft.com/en-us/library/ms190331.aspx

For guest you could query the is_disabled column of sys.server_principals where name = 'guest'.


I don't have a SQL Server 2000 system readily available to me to test on, but I'll see what I can did up.
0
 
LVL 22

Expert Comment

by:Steve Wales
Comment Utility
For SQL Server 2000, this document looks highly relevant:

http://msdn.microsoft.com/en-us/library/fooa616fce9-b4c1-49da-87a7-9d6f74911d8f.aspx

Try syslogins for information on your logins - here's the BOL page for that: http://msdn.microsoft.com/en-us/library/ms178593.aspx

It has columns indicating if each user is a member of one of the fixed server roles and the column hasaccess should be enough to tell disabled / enabled.

The other columns isntname, isntgroup and isntuser should be able to separate SQL Server user, Windows User and Windows Group apart from each other.
0

Featured Post

Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

Join & Write a Comment

Ever needed a SQL 2008 Database replicated/mirrored/log shipped on another server but you can't take the downtime inflicted by initial snapshot or disconnect while T-logs are restored or mirror applied? You can use SQL Server Initialize from Backup…
Never store passwords in plain text or just their hash: it seems a no-brainier, but there are still plenty of people doing that. I present the why and how on this subject, offering my own real life solution that you can implement right away, bringin…
This video shows, step by step, how to configure Oracle Heterogeneous Services via the Generic Gateway Agent in order to make a connection from an Oracle session and access a remote SQL Server database table.
Via a live example, show how to backup a database, simulate a failure backup the tail of the database transaction log and perform the restore.

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now