dataiotech Labs
dbaguidedbaguideDBAdataxtoolsdataopsphere
Scripts Library/sqlserver/#57
Script #57
sqlserver
Securityread-onlyMin Version: 2008

List Sysadmin and Risky Logins in SQL Server

Finds logins in the sysadmin role, SQL logins without password policy, and accounts with blank passwords. A baseline check for security audits.

#logins#sysadmin#hardening
sqlserver · sql
SELECT p.name AS login_name, p.type_desc, p.is_disabled,
       CASE WHEN r.member_principal_id IS NOT NULL THEN 1 ELSE 0 END AS is_sysadmin
FROM sys.server_principals p
LEFT JOIN sys.server_role_members r
       ON r.member_principal_id = p.principal_id
      AND r.role_principal_id = SUSER_ID('sysadmin')
WHERE p.type IN ('S','U','G') AND p.name NOT LIKE '##%'
ORDER BY is_sysadmin DESC, p.name;

SELECT name, is_policy_checked, is_expiration_checked
FROM sys.sql_logins
WHERE is_policy_checked = 0 OR PWDCOMPARE('', password_hash) = 1;
Operational Notes & Remediation Guidance

Verify in a staging environment prior to running in production. This is a read-only diagnostic query; it does not acquire exclusive locks.

Production Safety & Execution Standards
  • This script is designed for read-only diagnostics; it does not alter schema or modify data directly.
  • Prior to executing on production systems under high load, verify the target database version (Min. Version: 2008).
  • Exercise caution with mutating actions (e.g., terminating sessions or dropping indexes) referenced in the notes section.