Pages

Wednesday, August 10, 2016

Get all Database level permissions for a User on all Databases in MS SQL Server using T-SQL

The variable @UserName should be changed before running the query

IF OBJECT_ID('tempdb.dbo.#UserPermissions', 'U') IS NOT NULL DROP TABLE #UserPermissions; 

Declare rscursor cursor read_only
FOR
SELECT DatabaseName = name FROM [master].[sys].[databases];
Declare @DatabaseName nvarchar(500);
Declare @sql nvarchar(max)
Create table #UserPermissions(
DatabaseName nvarchar(max),
LoginName nvarchar(max),
LoginType nvarchar(max),
DatabaseUserName nvarchar(max),
[DatabaseRole] nvarchar(max),
PermissionType nvarchar(max),
PermissionState nvarchar(max),
ObjectType nvarchar(max),
ObjectName nvarchar(max),
ColumnName nvarchar(max))

OPEN rscursor
Fetch next from rscursor into @DatabaseName
Declare @UserName nvarchar(500) =  'domain\gina.alexa'; ----Change UserName here

While @@fetch_status=0
Begin
Set @sql=
'SELECT
@DatabaseName as ''DatabaseName'', 
    [LoginName] = ''All Users'',
    [LoginType] = ''All Users'', 
    [DatabaseUserName] = ''All Users'',       
    [Role] = p.[name] COLLATE Latin1_General_CI_AI,      
    [PermissionType] = pe.[permission_name],       
    [PermissionState] = pe.[state_desc],       
    [ObjectType] = ob.type_desc,  
    [ObjectName] = ob.[name],
    [ColumnName] = c.[name]
FROM ' + @DatabaseName +'.sys.database_principals p
LEFT JOIN ' + @DatabaseName +'.sys.database_permissions pe ON pe.[grantee_principal_id] = p.[principal_id]
LEFT JOIN ' + @DatabaseName +'.sys.columns c on c.[object_id] = pe.major_id AND c.[column_id] = pe.[minor_id]                   
INNER JOIN ' + @DatabaseName +'.sys.objects ob ON ob.[object_id] = pe.[major_id]
WHERE p.[type] = ''R''
AND p.[name] = ''public''
AND ob.is_ms_shipped = 0

------
UNION ALL
SELECT 
@DatabaseName as ''DatabaseName'', 
[LoginName] = l.[name] COLLATE Latin1_General_CI_AI,
    [LoginType] = p.[type_desc] COLLATE Latin1_General_CI_AI,  
    [DatabaseUserName] = p.[name] COLLATE Latin1_General_CI_AI,       
    [Role] = null,      
    [PermissionType] = pe.[permission_name],       
    [PermissionState] = pe.[state_desc],       
    [ObjectType] = pe.[class_desc],
    [ObjectName] = ob.[name], ----OBJECT_NAME(pe.major_id),
    [ColumnName] = c.[name]
FROM ' + @DatabaseName +'.sys.database_principals p 
LEFT JOIN ' + @DatabaseName +'.sys.server_principals l on p.[sid] = l.[sid]
LEFT JOIN ' + @DatabaseName +'.sys.database_permissions pe ON pe.[grantee_principal_id] = p.[principal_id]
LEFT JOIN ' + @DatabaseName +'.sys.columns c ON c.[object_id] = pe.major_id AND c.[column_id] = pe.[minor_id]
LEFT JOIN ' + @DatabaseName +'.sys.objects ob ON pe.[major_id] = ob.[object_id]
WHERE p.[name]= @UserName
---
UNION ALL
SELECT  
@DatabaseName as ''DatabaseName'', 
[LoginName] = l.[name] COLLATE Latin1_General_CI_AI,
    [LoginType] = mp.[type_desc],  
    [DatabaseUserName] = mp.[name],   
    [Role] = rp.[name],      
    [PermissionType] = pe.[permission_name],       
    [PermissionState] = pe.[state_desc],       
    [ObjectType] = ob.type_desc,
    [ObjectName] = ob.[name], ---OBJECT_NAME(perm.major_id),
    [ColumnName] = c.[name]
FROM ' + @DatabaseName +'.sys.database_role_members m
INNER JOIN ' + @DatabaseName +'.sys.database_principals rp ON rp.[principal_id] = m.[role_principal_id]
INNER JOIN ' + @DatabaseName +'.sys.database_principals mp ON mp.[principal_id] = m.[member_principal_id]
LEFT JOIN ' + @DatabaseName +'.sys.server_principals l on mp.[sid] = l.[sid]
LEFT JOIN ' + @DatabaseName +'.sys.database_permissions pe ON pe.[grantee_principal_id] = rp.[principal_id]
LEFT JOIN ' + @DatabaseName +'.sys.columns c on c.[object_id] = pe.major_id AND c.[column_id] = pe.[minor_id]
LEFT JOIN ' + @DatabaseName +'.sys.objects ob ON pe.[major_id] = ob.[object_id]
WHERE mp.[name]= @UserName'

Insert into #UserPermissions(
DatabaseName,
LoginName,
LoginType,
DatabaseUserName,
[DatabaseRole],
PermissionType,
PermissionState,
ObjectType,
ObjectName,
ColumnName) 
Execute sp_executesql @SQL, N'@DatabaseName nvarchar(max), @UserName nvarchar(500)', @DatabaseName = @DatabaseName, @UserName = @UserName;

FETCH NEXT FROM rscursor INTO @DatabaseName
End

CLOSE rscursor
DEALLOCATE rscursor
GO

Select * from #UserPermissions
Order by LoginName, DatabaseName;

No comments:

Post a Comment