SQL Server中的備份用戶/登錄

Question

我的客戶正在開發一個安全項目，其中DBA tean以外的任何用戶具有數據庫或服務器級別/ dbo所有者權限的sysadmin並刪除所有SQL Server中的提升權限。在這樣做之前，我們想要備份安全性，以防萬一發生中斷。任何人都可以幫助腳本？我有sp_rev_login備份登錄，但想用一個非常簡單直接的解決方案。任何想法都歡迎。謝謝

Answer 1

從Technet腳本中心截取的，這個腳本給我們的用戶，角色，對象權限以及

**--Server level Logins and roles** 
SELECT sp.name AS LoginName,sp.type_desc AS LoginType, sp.default_database_name AS DefaultDBName,slog.sysadmin AS SysAdmin,slog.securityadmin AS SecurityAdmin,slog.serveradmin AS ServerAdmin, slog.setupadmin AS SetupAdmin, slog.processadmin AS ProcessAdmin, slog.diskadmin AS DiskAdmin, slog.dbcreator AS DBCreator,slog.bulkadmin AS BulkAdmin 
FROM sys.server_principals sp JOIN master..syslogins slog 
ON sp.sid=slog.sid 
WHERE sp.type <> 'R' AND sp.name NOT LIKE '##%' 

--Databases users and roles 
DECLARE @SQLStatement VARCHAR(4000) 
DECLARE @T_DBuser TABLE (DBName SYSNAME, UserName SYSNAME, AssociatedDBRole NVARCHAR(256)) 
SET @SQLStatement=' 
SELECT ''?'' AS DBName,dp.name AS UserName,USER_NAME(drm.role_principal_id) AS AssociatedDBRole 
FROM ?.sys.database_principals dp 
LEFT OUTER JOIN ?.sys.database_role_members drm 
ON dp.principal_id=drm.member_principal_id 
WHERE dp.sid NOT IN (0x01) AND dp.sid IS NOT NULL AND dp.type NOT IN (''C'') AND dp.is_fixed_role <> 1 AND dp.name NOT LIKE ''##%'' AND ''?'' NOT IN (''master'',''msdb'',''model'',''tempdb'') ORDER BY DBName' 
INSERT @T_DBuser 
EXEC sp_MSforeachdb @SQLStatement 
SELECT * FROM @T_DBuser ORDER BY DBName 

--Get objects permission of specified user database 
USE <Database Name> 
GO 
DECLARE @Obj VARCHAR(4000) 
DECLARE @T_Obj TABLE (UserName SYSNAME, ObjectName SYSNAME, Permission NVARCHAR(128)) 
SET @Obj=' 
SELECT Us.name AS username, Obj.name AS object, dp.permission_name AS permission 
FROM sys.database_permissions dp 
JOIN sys.sysusers Us 
ON dp.grantee_principal_id = Us.uid 
JOIN sys.sysobjects Obj 
ON dp.major_id = Obj.id ' 
INSERT @T_Obj 
EXEC sp_MSforeachdb @Obj 

SELECT * FROM @T_Obj 

樣本輸出：

DBName UserName AssociatedDBRole 
PerformanceV3 public NULL 
PerformanceV3 dbo db_owner 
PerformanceV3 guest NULL 

Answer 2

使用生成的腳本任務，並選擇用戶。將腳本另存爲文件作爲備份。

查找具有不應該的SA的登錄。

SELECT 'ALTER SERVER ROLE [sysadmin] DROP MEMBER [' + syslogins.name + '] GO;' 
FROM sys.syslogins 
WHERE syslogins.name NOT IN (<dba GROUP/logins>) 

這應該足以生成remove SA。如果不想複製/粘貼，可以將輸出粘貼到臨時表並在其上運行光標以執行刪除。