SQL server 用户权限审核

Question

以下是对可能的 SQL 服务器 dba 的要求

想出一些流程来审核谁可以访问什么。可能包括：

1) 服务器登录

2) 本地管理员

3) SQL 服务器级别的角色，尤其是系统管理员

4) 数据库 dbo、读取器、写入器

5) 主、msdb 访问

6) 来自用户帐户的链接服务器使用情况

7) 对公众的明确资助 等等

有人可以告诉我如何实现上述目标

谢谢， 斯里

Answer 1

您需要使用系统表/视图。其中一个主表（实际上是一个视图）是[master].[sys].[server_principals]，用户可以在其中找到。

您还会发现[master].[sys].[server_permissions] 很有用，因为它具有权限，而[master].[sys].[server_role_members] 可以在其中找到角色。你会在这里找到数据库[master].[sys].[sysdatabases]

记下principalid，因为它与用户相关。

此外，在每个数据库中，您都可以找到 [Table].[sys].[sysusers] 和 [Table].[sys].[syslogins] 等视图

您必须自己完成工作才能获得应用程序所需的内容。您会在网上和书籍中找到有关上述表格的大量信息。

Answer 2

我尝试了自己的问题，并在下面解决了我的目的

set nocount on
declare @permission table (
Database_Name sysname,
User_Role_Name sysname,
Account_Type nvarchar(60),
Action_Type nvarchar(128),
Permission nvarchar(60),
ObjectName sysname null,
Object_Type nvarchar(60)
)
declare @dbs table (dbname sysname)
declare @Next sysname
insert into @dbs
select name from sys.databases order by name
select top 1 @Next = dbname from @dbs
while (@@rowcount<>0)
begin
insert into @permission
exec('use [' + @Next + ']
declare @objects table (obj_id int, obj_type char(2))
insert into @objects
select id, xtype from master.sys.sysobjects
insert into @objects
select object_id, type from sys.objects

SELECT ''' + @Next + ''', a.name as ''User or Role Name'', a.type_desc as ''Account Type'',
d.permission_name as ''Type of Permission'', d.state_desc as ''State of Permission'',
OBJECT_SCHEMA_NAME(d.major_id) + ''.'' + object_name(d.major_id) as ''Object Name'',
case e.obj_type
when ''AF'' then ''Aggregate function (CLR)''
when ''C'' then ''CHECK constraint''
when ''D'' then ''DEFAULT (constraint or stand-alone)''
when ''F'' then ''FOREIGN KEY constraint''
when ''PK'' then ''PRIMARY KEY constraint''
when ''P'' then ''SQL stored procedure''
when ''PC'' then ''Assembly (CLR) stored procedure''
when ''FN'' then ''SQL scalar function''
when ''FS'' then ''Assembly (CLR) scalar function''
when ''FT'' then ''Assembly (CLR) table-valued function''
when ''R'' then ''Rule (old-style, stand-alone)''
when ''RF'' then ''Replication-filter-procedure''
when ''S'' then ''System base table''
when ''SN'' then ''Synonym''
when ''SQ'' then ''Service queue''
when ''TA'' then ''Assembly (CLR) DML trigger''
when ''TR'' then ''SQL DML trigger''
when ''IF'' then ''SQL inline table-valued function''
when ''TF'' then ''SQL table-valued-function''
when ''U'' then ''Table (user-defined)''
when ''UQ'' then ''UNIQUE constraint''
when ''V'' then ''View''
when ''X'' then ''Extended stored procedure''
when ''IT'' then ''Internal table''
end as ''Object Type''
FROM [' + @Next + '].sys.database_principals a 
left join [' + @Next + '].sys.database_permissions d on a.principal_id = d.grantee_principal_id
left join @objects e on d.major_id = e.obj_id
order by a.name, d.class_desc')
delete @dbs where dbname = @Next
select top 1 @Next = dbname from @dbs
end
set nocount off
select * from @permission