dataiotech Labs
dbaguidedbaguideDBAdataxtoolsdataopsphere
Scripts Library/oracle/#76
Script #76
oracle
Securityread-onlyMin Version: 11g

Oracle Privileged Users and Default Password Audit

Finds users with DBA privileges, accounts with default passwords and non-expiring passwords. A baseline check for hardening and audits.

#users#dba-role#default-password#hardening
oracle · sql
SELECT grantee, granted_role, admin_option
FROM   dba_role_privs
WHERE  granted_role IN ('DBA','SYSDBA','EXP_FULL_DATABASE','IMP_FULL_DATABASE')
ORDER  BY grantee;

SELECT d.username, u.account_status, u.profile
FROM   dba_users_with_defpwd d
JOIN   dba_users u ON u.username = d.username
ORDER  BY d.username;

SELECT username, account_status, expiry_date, profile FROM dba_users
WHERE  account_status = 'OPEN' AND expiry_date IS NULL;
Operational Notes & Remediation Guidance

Verify in a staging environment prior to running in production. This is a read-only diagnostic query; it does not acquire exclusive locks.

Production Safety & Execution Standards
  • This script is designed for read-only diagnostics; it does not alter schema or modify data directly.
  • Prior to executing on production systems under high load, verify the target database version (Min. Version: 11g).
  • Exercise caution with mutating actions (e.g., terminating sessions or dropping indexes) referenced in the notes section.