Skip to content

Commit 99a0085

Browse files
ktaranovktaranov
committed
Update Security Audit Report script
1 parent a3abab7 commit 99a0085

File tree

1 file changed

+153
-121
lines changed

1 file changed

+153
-121
lines changed

‎Security_Audit_Report.sql‎

Lines changed: 153 additions & 121 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
11
/*
2-
Author: buckley
3-
Original link: https://stackoverflow.com/a/7059579/2298061
2+
Author: Jeremy
3+
Original link: https://stackoverflow.com/a/30040784/2298061
44
55
Security Audit Report
6-
1) List all access provisioned to a sql user or windows user/group directly
7-
2) List all access provisioned to a sql user or windows user/group through a database or application role
6+
1) List all access provisioned to a SQL user or Windows user/group directly
7+
2) List all access provisioned to a SQL user or Windows user/group through a database or application role
88
3) List all access provisioned to the public role
99
1010
Columns Returned:
11-
UserName : SQL or Windows/Active Directory user cccount. This could also be an Active Directory group.
12-
UserType : Value will be either 'SQL User' or 'Windows User'. This reflects the type of user defined for the
13-
SQL Server user account.
11+
UserType : Value will be either 'SQL User', 'Windows User', or 'Windows Group'.
12+
This reflects the type of user/group defined for the SQL Server account.
1413
DatabaseUserName: Name of the associated user as defined in the database user account. The database user may not be the
1514
same as the server user.
15+
LoginName : SQL or Windows/Active Directory user account. This could also be an Active Directory group.
1616
Role : The role name. This will be null if the associated permissions to the object are defined at directly
1717
on the user account, otherwise this will be the name of the role that the user is a member of.
1818
PermissionType : Type of permissions the user/role has on an object. Examples could include CONNECT, EXECUTE, SELECT
@@ -22,126 +22,158 @@ PermissionType : Type of permissions the user/role has on an object. Examples c
2222
PermissionState : Reflects the state of the permission type, examples could include GRANT, DENY, etc.
2323
This value may not be populated for all roles. Some built in roles have implicit permission
2424
definitions.
25-
ObjectType : Type of object the user/role is assigned permissions on. Examples could include USER_TABLE,
26-
SQL_SCALAR_FUNCTION, SQL_INLINE_TABLE_VALUED_FUNCTION, SQL_STORED_PROCEDURE, VIEW, etc.
25+
ObjectType : Type of object the user/role is assigned permissions on. Examples could include USER_TABLE,
26+
SQL_SCALAR_FUNCTION, SQL_INLINE_TABLE_VALUED_FUNCTION, SQL_STORED_PROCEDURE, VIEW, etc.
2727
This value may not be populated for all roles. Some built in roles have implicit permission
28-
definitions.
29-
ObjectName : Name of the object that the user/role is assigned permissions on.
28+
definitions.
29+
Schema : Name of the schema the object is in.
30+
ObjectName : Name of the object that the user/role is assigned permissions on.
3031
This value may not be populated for all roles. Some built in roles have implicit permission
3132
definitions.
3233
ColumnName : Name of the column of the object that the user/role is assigned permissions on. This value
33-
is only populated if the object is a table, view or a table value function.
34+
is only populated if the object is a table, view or a table value function.
3435
*/
3536

36-
--List all access provisioned to a sql user or windows user/group directly
37-
SELECT
38-
[UserName] = CASE princ.[type]
39-
WHEN 'S' THEN princ.[name]
40-
WHEN 'U' THEN ulogin.[name] COLLATE Latin1_General_CI_AI
41-
END,
42-
[UserType] = CASE princ.[type]
43-
WHEN 'S' THEN 'SQL User'
44-
WHEN 'U' THEN 'Windows User'
45-
END,
46-
[DatabaseUserName] = princ.[name],
47-
[Role] = null,
48-
[PermissionType] = perm.[permission_name],
49-
[PermissionState] = perm.[state_desc],
50-
[ObjectType] = obj.type_desc,--perm.[class_desc],
51-
[ObjectName] = OBJECT_NAME(perm.major_id),
52-
[ColumnName] = col.[name]
53-
FROM
54-
--database user
55-
sys.database_principals AS princ
56-
LEFT JOIN
57-
--Login accounts
58-
sys.login_token AS ulogin on princ.[sid] = ulogin.[sid]
59-
LEFT JOIN
60-
--Permissions
61-
sys.database_permissions AS perm ON perm.[grantee_principal_id] = princ.[principal_id]
62-
LEFT JOIN
63-
--Table columns
64-
sys.columns col ON col.[object_id] = perm.major_id
65-
AND col.[column_id] = perm.[minor_id]
66-
LEFT JOIN
67-
sys.objects obj ON perm.[major_id] = obj.[object_id]
68-
WHERE
69-
princ.[type] in ('S','U')
37+
--1) List all access provisioned to a SQL user or Windows user/group directly
38+
SELECT
39+
[UserType] = CASE princ.[type]
40+
WHEN 'S' THEN 'SQL User'
41+
WHEN 'U' THEN 'Windows User'
42+
WHEN 'G' THEN 'Windows Group'
43+
END,
44+
[DatabaseUserName] = princ.[name],
45+
[LoginName] = ulogin.[name],
46+
[Role] = NULL,
47+
[PermissionType] = perm.[permission_name],
48+
[PermissionState] = perm.[state_desc],
49+
[ObjectType] = CASE perm.[class]
50+
WHEN 1 THEN obj.[type_desc] -- Schema-contained objects
51+
ELSE perm.[class_desc] -- Higher-level objects
52+
END,
53+
[Schema] = objschem.[name],
54+
[ObjectName] = CASE perm.[class]
55+
WHEN 3 THEN permschem.[name] -- Schemas
56+
WHEN 4 THEN imp.[name] -- Impersonations
57+
ELSE OBJECT_NAME(perm.[major_id]) -- General objects
58+
END,
59+
[ColumnName] = col.[name]
60+
FROM
61+
--Database user
62+
sys.database_principals AS princ
63+
--Login accounts
64+
LEFT JOIN sys.server_principals AS ulogin ON ulogin.[sid] = princ.[sid]
65+
--Permissions
66+
LEFT JOIN sys.database_permissions AS perm ON perm.[grantee_principal_id] = princ.[principal_id]
67+
LEFT JOIN sys.schemas AS permschem ON permschem.[schema_id] = perm.[major_id]
68+
LEFT JOIN sys.objects AS obj ON obj.[object_id] = perm.[major_id]
69+
LEFT JOIN sys.schemas AS objschem ON objschem.[schema_id] = obj.[schema_id]
70+
--Table columns
71+
LEFT JOIN sys.columns AS col ON col.[object_id] = perm.[major_id]
72+
AND col.[column_id] = perm.[minor_id]
73+
--Impersonations
74+
LEFT JOIN sys.database_principals AS imp ON imp.[principal_id] = perm.[major_id]
75+
WHERE
76+
princ.[type] IN ('S','U','G')
77+
-- No need for these system accounts
78+
AND princ.[name] NOT IN ('sys', 'INFORMATION_SCHEMA')
79+
7080
UNION
71-
--List all access provisioned to a sql user or windows user/group through a database or application role
72-
SELECT
73-
[UserName] = CASE memberprinc.[type]
74-
WHEN 'S' THEN memberprinc.[name]
75-
WHEN 'U' THEN ulogin.[name] COLLATE Latin1_General_CI_AI
76-
END,
77-
[UserType] = CASE memberprinc.[type]
78-
WHEN 'S' THEN 'SQL User'
79-
WHEN 'U' THEN 'Windows User'
80-
END,
81-
[DatabaseUserName] = memberprinc.[name],
82-
[Role] = roleprinc.[name],
83-
[PermissionType] = perm.[permission_name],
84-
[PermissionState] = perm.[state_desc],
85-
[ObjectType] = obj.type_desc,--perm.[class_desc],
86-
[ObjectName] = OBJECT_NAME(perm.major_id),
87-
[ColumnName] = col.[name]
88-
FROM
89-
--Role/member associations
90-
sys.database_role_members members
91-
JOIN
92-
--Roles
93-
sys.database_principals roleprinc ON roleprinc.[principal_id] = members.[role_principal_id]
94-
JOIN
95-
--Role members (database users)
96-
sys.database_principals memberprinc ON memberprinc.[principal_id] = members.[member_principal_id]
97-
LEFT JOIN
98-
--Login accounts
99-
sys.login_token ulogin on memberprinc.[sid] = ulogin.[sid]
100-
LEFT JOIN
101-
--Permissions
102-
sys.database_permissions perm ON perm.[grantee_principal_id] = roleprinc.[principal_id]
103-
LEFT JOIN
104-
--Table columns
105-
sys.columns col on col.[object_id] = perm.major_id
106-
AND col.[column_id] = perm.[minor_id]
107-
LEFT JOIN
108-
sys.objects obj ON perm.[major_id] = obj.[object_id]
81+
82+
--2) List all access provisioned to a SQL user or Windows user/group through a database or application role
83+
SELECT
84+
[UserType] = CASE membprinc.[type]
85+
WHEN 'S' THEN 'SQL User'
86+
WHEN 'U' THEN 'Windows User'
87+
WHEN 'G' THEN 'Windows Group'
88+
END,
89+
[DatabaseUserName] = membprinc.[name],
90+
[LoginName] = ulogin.[name],
91+
[Role] = roleprinc.[name],
92+
[PermissionType] = perm.[permission_name],
93+
[PermissionState] = perm.[state_desc],
94+
[ObjectType] = CASE perm.[class]
95+
WHEN 1 THEN obj.[type_desc] -- Schema-contained objects
96+
ELSE perm.[class_desc] -- Higher-level objects
97+
END,
98+
[Schema] = objschem.[name],
99+
[ObjectName] = CASE perm.[class]
100+
WHEN 3 THEN permschem.[name] -- Schemas
101+
WHEN 4 THEN imp.[name] -- Impersonations
102+
ELSE OBJECT_NAME(perm.[major_id]) -- General objects
103+
END,
104+
[ColumnName] = col.[name]
105+
FROM
106+
--Role/member associations
107+
sys.database_role_members AS members
108+
--Roles
109+
JOIN sys.database_principals AS roleprinc ON roleprinc.[principal_id] = members.[role_principal_id]
110+
--Role members (database users)
111+
JOIN sys.database_principals AS membprinc ON membprinc.[principal_id] = members.[member_principal_id]
112+
--Login accounts
113+
LEFT JOIN sys.server_principals AS ulogin ON ulogin.[sid] = membprinc.[sid]
114+
--Permissions
115+
LEFT JOIN sys.database_permissions AS perm ON perm.[grantee_principal_id] = roleprinc.[principal_id]
116+
LEFT JOIN sys.schemas AS permschem ON permschem.[schema_id] = perm.[major_id]
117+
LEFT JOIN sys.objects AS obj ON obj.[object_id] = perm.[major_id]
118+
LEFT JOIN sys.schemas AS objschem ON objschem.[schema_id] = obj.[schema_id]
119+
--Table columns
120+
LEFT JOIN sys.columns AS col ON col.[object_id] = perm.[major_id]
121+
AND col.[column_id] = perm.[minor_id]
122+
--Impersonations
123+
LEFT JOIN sys.database_principals AS imp ON imp.[principal_id] = perm.[major_id]
124+
WHERE
125+
membprinc.[type] IN ('S','U','G')
126+
-- No need for these system accounts
127+
AND membprinc.[name] NOT IN ('sys', 'INFORMATION_SCHEMA')
128+
109129
UNION
110-
--List all access provisioned to the public role, which everyone gets by default
111-
SELECT
112-
[UserName] = '{All Users}',
113-
[UserType] = '{All Users}',
114-
[DatabaseUserName] = '{All Users}',
115-
[Role] = roleprinc.[name],
116-
[PermissionType] = perm.[permission_name],
117-
[PermissionState] = perm.[state_desc],
118-
[ObjectType] = obj.type_desc,--perm.[class_desc],
119-
[ObjectName] = OBJECT_NAME(perm.major_id),
120-
[ColumnName] = col.[name]
121-
FROM
122-
--Roles
123-
sys.database_principals roleprinc
124-
LEFT JOIN
125-
--Role permissions
126-
sys.database_permissions perm ON perm.[grantee_principal_id] = roleprinc.[principal_id]
127-
LEFT JOIN
128-
--Table columns
129-
sys.columns col on col.[object_id] = perm.major_id
130-
AND col.[column_id] = perm.[minor_id]
131-
JOIN
132-
--All objects
133-
sys.objects obj ON obj.[object_id] = perm.[major_id]
134-
WHERE
135-
--Only roles
136-
roleprinc.[type] = 'R' AND
137-
--Only public role
138-
roleprinc.[name] = 'public' AND
139-
--Only objects of ours, not the MS objects
140-
obj.is_ms_shipped = 0
130+
131+
--3) List all access provisioned to the public role, which everyone gets by default
132+
SELECT
133+
[UserType] = '{All Users}',
134+
[DatabaseUserName] = '{All Users}',
135+
[LoginName] = '{All Users}',
136+
[Role] = roleprinc.[name],
137+
[PermissionType] = perm.[permission_name],
138+
[PermissionState] = perm.[state_desc],
139+
[ObjectType] = CASE perm.[class]
140+
WHEN 1 THEN obj.[type_desc] -- Schema-contained objects
141+
ELSE perm.[class_desc] -- Higher-level objects
142+
END,
143+
[Schema] = objschem.[name],
144+
[ObjectName] = CASE perm.[class]
145+
WHEN 3 THEN permschem.[name] -- Schemas
146+
WHEN 4 THEN imp.[name] -- Impersonations
147+
ELSE OBJECT_NAME(perm.[major_id]) -- General objects
148+
END,
149+
[ColumnName] = col.[name]
150+
FROM
151+
--Roles
152+
sys.database_principals AS roleprinc
153+
--Role permissions
154+
LEFT JOIN sys.database_permissions AS perm ON perm.[grantee_principal_id] = roleprinc.[principal_id]
155+
LEFT JOIN sys.schemas AS permschem ON permschem.[schema_id] = perm.[major_id]
156+
--All objects
157+
JOIN sys.objects AS obj ON obj.[object_id] = perm.[major_id]
158+
LEFT JOIN sys.schemas AS objschem ON objschem.[schema_id] = obj.[schema_id]
159+
--Table columns
160+
LEFT JOIN sys.columns AS col ON col.[object_id] = perm.[major_id]
161+
AND col.[column_id] = perm.[minor_id]
162+
--Impersonations
163+
LEFT JOIN sys.database_principals AS imp ON imp.[principal_id] = perm.[major_id]
164+
WHERE
165+
roleprinc.[type] = 'R'
166+
AND roleprinc.[name] = 'public'
167+
AND obj.[is_ms_shipped] = 0
168+
141169
ORDER BY
142-
princ.[name],
143-
OBJECT_NAME(perm.major_id),
144-
col.[name],
145-
perm.[permission_name],
146-
perm.[state_desc],
147-
obj.type_desc;
170+
[UserType],
171+
[DatabaseUserName],
172+
[LoginName],
173+
[Role],
174+
[Schema],
175+
[ObjectName],
176+
[ColumnName],
177+
[PermissionType],
178+
[PermissionState],
179+
[ObjectType];

0 commit comments

Comments
 (0)