SQL Permissions – {koprowskit.eu} My MVP blog

The second part of my previous post is still about SQL Permission – free tool from Idera. In previous I wrote about installation post. In this post I’ll showhow look script from one of my database: by default: instance, all databases, all bermissions, all logins, all users. It’s small database (SQL Server 2012 (Denali) CTP3 Express Edition) but the result of script is very large: over seventy pages in MS Word document. Yay! I loose weight (freed some space by deleting sixty pages) of this file by deleting all part of the code begins with:

USE [msdb]

GO

Grant EXECUTE ON [dbo].[xxx] TO [yyy]

GO

Hope it will help to reading quick and understanding this script. Full version of the script You can download from my SlideShare profile (HERE). OK, let’s go to the script, how it looks?

Part.1 | Creating special permissions with login MS_PolicyEventProcessingLogin, creating and executing query

/*********** Permissions Script for WRON023\KEYKO Login

##MS_PolicyEventProcessingLogin## Generated 2011-10-16 16:22:45 ***************/

–Scripting Server Login (password is null) and Default Database

/* For security reasons the login is created disabled and with a random password. */

IF NOT EXISTS (SELECT * FROM sys.server_principals

WHERE name = N’##MS_PolicyEventProcessingLogin##’)

BEGIN

CREATE LOGIN [##MS_PolicyEventProcessingLogin##]

WITH PASSWORD=N’îK”îÎN_gÂ_!é@ôz«7_§Oæö½_VË¬U#4′,

DEFAULT_DATABASE=[master],

DEFAULT_LANGUAGE=[us_english],

CHECK_EXPIRATION=OFF, CHECK_POLICY=ON

ALTER LOGIN [##MS_PolicyEventProcessingLogin##] DISABLE

END

–Scripting Server Roles

USE [master]

–Grant Database Access

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’##MS_PolicyEventProcessingLogin##’)

CREATE USER [##MS_PolicyEventProcessingLogin##]

FOR LOGIN [##MS_PolicyEventProcessingLogin##]

WITH DEFAULT_SCHEMA=[dbo]

–Scripting Object and Statement Permissions

USE [master]

Grant CONNECT ON Database::[master] TO [##MS_PolicyEventProcessingLogin##]

USE [msdb]

–Grant Database Access

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’##MS_PolicyEventProcessingLogin##’)

CREATE USER [##MS_PolicyEventProcessingLogin##]

FOR LOGIN [##MS_PolicyEventProcessingLogin##]

WITH DEFAULT_SCHEMA=[dbo]

–Create Database Role

USE [msdb]

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’PolicyAdministratorRole’ AND type = ‘R’)

CREATE ROLE [PolicyAdministratorRole] AUTHORIZATION [dbo]

–Scripting Database Role Members

USE [msdb]

exec sp_addrolemember N’PolicyAdministratorRole’, N’##MS_PolicyEventProcessingLogin##’

–Create Database Role

USE [msdb]

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’SQLAgentOperatorRole’ AND type = ‘R’)

CREATE ROLE [SQLAgentOperatorRole] AUTHORIZATION [dbo]

USE [msdb]

Grant EXECUTE ON [dbo].[sp_enum_login_for_proxy] TO [SQLAgentOperatorRole]

exec sp_addrolemember N’SQLAgentOperatorRole’, N’##MS_PolicyEventProcessingLogin##’

–Create Database Role

USE [msdb]

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’SQLAgentReaderRole’ AND type = ‘R’)

CREATE ROLE [SQLAgentReaderRole] AUTHORIZATION [dbo]

exec sp_addrolemember N’SQLAgentReaderRole’, N’##MS_PolicyEventProcessingLogin##’

–Create Database Role

USE [msdb]

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’SQLAgentUserRole’ AND type = ‘R’)

CREATE ROLE [SQLAgentUserRole] AUTHORIZATION [dbo]

exec sp_addrolemember N’SQLAgentUserRole’, N’##MS_PolicyEventProcessingLogin##’

Part.2 | Creating special permissions with login MS_PolicyTsqlExecutionLogin: creating and executing query

/*********** Permissions Script for WRON023\KEYKO

–Scripting Server Login (password is null) and Default Database

/* For security reasons the login is created disabled and with a random password. */

IF NOT EXISTS (SELECT * FROM sys.server_principals

WHERE name = N’##MS_PolicyTsqlExecutionLogin##’)

BEGIN

CREATE LOGIN [##MS_PolicyTsqlExecutionLogin##]

WITH PASSWORD=N’_á*³*óÎõÁ·¹%"_G) ¹`&]ç(æØ]þX*0_’,

DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english],

CHECK_EXPIRATION=OFF, CHECK_POLICY=ON

ALTER LOGIN [##MS_PolicyTsqlExecutionLogin##] DISABLE

END

–Scripting Server Roles

USE [msdb]

–Grant Database Access

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’##MS_PolicyTsqlExecutionLogin##’)

CREATE USER [##MS_PolicyTsqlExecutionLogin##]

FOR LOGIN [##MS_PolicyTsqlExecutionLogin##]

WITH DEFAULT_SCHEMA=[dbo]

–Create Database Role

USE [msdb]

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’PolicyAdministratorRole’ AND type = ‘R’)

CREATE ROLE [PolicyAdministratorRole] AUTHORIZATION [dbo]

–Scripting Database Role Members

USE [msdb]

exec sp_addrolemember N’PolicyAdministratorRole’, N’##MS_PolicyTsqlExecutionLogin##’

–Create Database Role

USE [msdb]

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’SQLAgentOperatorRole’ AND type = ‘R’)

CREATE ROLE [SQLAgentOperatorRole] AUTHORIZATION [dbo]

exec sp_addrolemember N’SQLAgentOperatorRole’, N’##MS_PolicyTsqlExecutionLogin##’

–Create Database Role

USE [msdb]

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’SQLAgentReaderRole’ AND type = ‘R’)

CREATE ROLE [SQLAgentReaderRole] AUTHORIZATION [dbo]

exec sp_addrolemember N’SQLAgentReaderRole’, N’##MS_PolicyTsqlExecutionLogin##’

–Create Database Role

USE [msdb]

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’SQLAgentUserRole’ AND type = ‘R’)

CREATE ROLE [SQLAgentUserRole] AUTHORIZATION [dbo]

exec sp_addrolemember N’SQLAgentUserRole’, N’##MS_PolicyTsqlExecutionLogin##’

–Scripting Object and Statement Permissions

USE [msdb]

Grant CONNECT ON Database::[msdb] TO [##MS_PolicyTsqlExecutionLogin##]

Part.3 | Creating special permissions with builtin logins Users / SYSTEM / NT AUTHORITY / NT SERVICE / sa / SQLSRVReportingServices / SQLSRVAdmin / “current user”: creating and executing query

/*********** Permissions Script for WRON023\KEYKO

–Scripting Server Login (password is null) and Default Database

IF NOT EXISTS (SELECT * FROM sys.server_principals WHERE name = N’BUILTIN\Users’)

BEGIN

CREATE LOGIN [BUILTIN\Users] FROM WINDOWS WITH DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english]

END

–Scripting Server Roles

/*********** Permissions Script for WRON023\KEYKO

–Scripting Server Login (password is null) and Default Database

IF NOT EXISTS (SELECT * FROM sys.server_principals WHERE name = N’NT AUTHORITY\SYSTEM’)

BEGIN

CREATE LOGIN [NT AUTHORITY\SYSTEM] FROM WINDOWS WITH DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english]

END

–Scripting Server Roles

exec sp_addsrvrolemember N’NT AUTHORITY\SYSTEM’, N’sysadmin’

/*********** Permissions Script for WRON023\KEYKO

–Scripting Server Login (password is null) and Default Database

IF NOT EXISTS (SELECT * FROM sys.server_principals WHERE name = N’NT SERVICE\MSSQL$KEYKO’)

BEGIN

CREATE LOGIN [NT SERVICE\MSSQL$KEYKO] FROM WINDOWS WITH DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english]

END

–Scripting Server Roles

exec sp_addsrvrolemember N’NT SERVICE\MSSQL$KEYKO’, N’sysadmin’

/*********** Permissions Script for WRON023\KEYKO

–Scripting Server Login (password is null) and Default Database

/* For security reasons the login is created disabled and with a random password. */

IF NOT EXISTS (SELECT * FROM sys.server_principals WHERE name = N’sa’)

BEGIN

CREATE LOGIN [sa] WITH PASSWORD=N’¶áqùmG·kj_ÂÈò)[¤ã2

ÉY_vY

%¹’, DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english], CHECK_EXPIRATION=OFF, CHECK_POLICY=ON

EXEC sys.sp_addsrvrolemember @loginame = N’sa’, @rolename = N’sysadmin’

ALTER LOGIN [sa] DISABLE

END

–Scripting Server Roles

exec sp_addsrvrolemember N’sa’, N’sysadmin’

/*********** Permissions Script for WRON023\KEYKO

–Scripting Server Login (password is null) and Default Database

IF NOT EXISTS (SELECT * FROM sys.server_principals WHERE name = N’WRON023\KoprowskiT’)

BEGIN

CREATE LOGIN [WRON023\KoprowskiT] FROM WINDOWS WITH DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english]

END

–Scripting Server Roles

exec sp_addsrvrolemember N’WRON023\KoprowskiT’, N’sysadmin’

/*********** Permissions Script for WRON023\KEYKO

–Scripting Server Login (password is null) and Default Database

IF NOT EXISTS (SELECT * FROM sys.server_principals WHERE name = N’WRON023\SQLSRVAdmin’)

BEGIN

CREATE LOGIN [WRON023\SQLSRVAdmin] FROM WINDOWS WITH DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english]

END

–Scripting Server Roles

exec sp_addsrvrolemember N’WRON023\SQLSRVAdmin’, N’sysadmin’

/*********** Permissions Script for WRON023\KEYKO

–Scripting Server Login (password is null) and Default Database

IF NOT EXISTS (SELECT * FROM sys.server_principals WHERE name = N’WRON023\SQLSRVReporting’)

BEGIN

CREATE LOGIN [WRON023\SQLSRVReporting] FROM WINDOWS WITH DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english]

END

–Scripting Server Roles

USE [master]

–Grant Database Access

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’WRON023\SQLSRVReporting’)

CREATE USER [WRON023\SQLSRVReporting]

FOR LOGIN [WRON023\SQLSRVReporting]

WITH DEFAULT_SCHEMA=[WRON023\SQLSRVReporting]

–Create Database Role

USE [master]

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’RSExecRole’ AND type = ‘R’)

CREATE ROLE [RSExecRole] AUTHORIZATION [dbo]

–Scripting Database Role Members

USE [master]

exec sp_addrolemember N’RSExecRole’, N’WRON023\SQLSRVReporting’

–Scripting Object and Statement Permissions

USE [master]

Grant CONNECT ON Database::[master] TO [WRON023\SQLSRVReporting]

USE [msdb]

–Grant Database Access

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’WRON023\SQLSRVReporting’)

CREATE USER [WRON023\SQLSRVReporting]

FOR LOGIN [WRON023\SQLSRVReporting]

WITH DEFAULT_SCHEMA=[WRON023\SQLSRVReporting]

–Create Database Role

USE [msdb]

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’RSExecRole’ AND type = ‘R’)

CREATE ROLE [RSExecRole] AUTHORIZATION [dbo]

–Scripting Database Role Members

USE [msdb]

exec sp_addrolemember N’RSExecRole’, N’WRON023\SQLSRVReporting’

–Create Database Role

USE [msdb]

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’SQLAgentOperatorRole’ AND type = ‘R’)

CREATE ROLE [SQLAgentOperatorRole] AUTHORIZATION [dbo]

exec sp_addrolemember N’SQLAgentOperatorRole’, N’WRON023\SQLSRVReporting’

–Create Database Role

USE [msdb]

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’SQLAgentReaderRole’ AND type = ‘R’)

CREATE ROLE [SQLAgentReaderRole] AUTHORIZATION [dbo]

exec sp_addrolemember N’SQLAgentReaderRole’, N’WRON023\SQLSRVReporting’

–Create Database Role

USE [msdb]

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’SQLAgentUserRole’ AND type = ‘R’)

CREATE ROLE [SQLAgentUserRole] AUTHORIZATION [dbo]

exec sp_addrolemember N’SQLAgentUserRole’, N’WRON023\SQLSRVReporting’

–Scripting Object and Statement Permissions

USE [msdb]

Grant CONNECT ON Database::[msdb] TO [WRON023\SQLSRVReporting]

USE [ReportServer$KEYKO]

–Grant Database Access

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’WRON023\SQLSRVReporting’)

CREATE USER [WRON023\SQLSRVReporting]

FOR LOGIN [WRON023\SQLSRVReporting]

WITH DEFAULT_SCHEMA=[WRON023\SQLSRVReporting]

–Scripting Database Role Members

USE [ReportServer$KEYKO]

exec sp_addrolemember N’db_owner’, N’WRON023\SQLSRVReporting’

–Create Database Role

USE [ReportServer$KEYKO]

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’RSExecRole’ AND type = ‘R’)

CREATE ROLE [RSExecRole] AUTHORIZATION [dbo]

exec sp_addrolemember N’RSExecRole’, N’WRON023\SQLSRVReporting’

–Scripting Object and Statement Permissions

USE [ReportServer$KEYKO]

Grant CONNECT ON Database::[ReportServer$KEYKO] TO [WRON023\SQLSRVReporting]

USE [ReportServer$KEYKOTempDB]

–Grant Database Access

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’WRON023\SQLSRVReporting’)

CREATE USER [WRON023\SQLSRVReporting]

FOR LOGIN [WRON023\SQLSRVReporting]

WITH DEFAULT_SCHEMA=[WRON023\SQLSRVReporting]

–Scripting Database Role Members

USE [ReportServer$KEYKOTempDB]

exec sp_addrolemember N’db_owner’, N’WRON023\SQLSRVReporting’

–Create Database Role

USE [ReportServer$KEYKOTempDB]

IF NOT EXISTS (SELECT * FROM sys.database_principals

WHERE name = N’RSExecRole’ AND type = ‘R’)

CREATE ROLE [RSExecRole] AUTHORIZATION [dbo]

exec sp_addrolemember N’RSExecRole’, N’WRON023\SQLSRVReporting’

–Scripting Object and Statement Permissions

USE [ReportServer$KEYKOTempDB]

Grant CONNECT ON Database::[ReportServer$KEYKOTempDB] TO [WRON023\SQLSRVReporting]

/*** WARNING: SQLpermssions is freeware – use it at your own risk. ***/

/*** There are potential security issues with copying logins and permissions ***/

/*** from one SQL Server to another. By using SQLpermissions, you acknowledge ***/

/*** and knowingly accept these risks. It is recommended that users take steps ***/

/*** to thoroughly evaluate the necessity of replicating logins and permissions ***/

/*** before using this tool. Idera shall not be liable for any damages you may ***/

/*** sustain by using this tool, whether direct, indirect, special, incidental ***/

/*** or consequential, even if it has been advised of the possibility of such damages.***/

The third (and fourth) episodes in my non-frequently series: Sunday Market is about Idera too. Yes I know, not only Idera giving You free tools, I’ll try show other tools in future episodes. But this tim I’m writing about nice tool for checking permissions for our SQL Server.

If You need (like some of my client or collegues) move logins and permissions between servers, providing simple audity (like view logins and permissions) or scripting (Yes it’s for You ScriptingGuys), You can use free SQL Premission 2.0 tool. In this case I’ll show in few pictures and some functions of free Idera product SQL Permission s2.0. For free download You must:
>> go to Idera SQL Permissions 2.0 site HERE
>> fill registration data
>> checking Your mail box for download link

Very easy, isn’t? Just exactly same process like in first two episodes. When You get software, just install it:

PHASE ONE: