SQL Server超级用户权限自查指南,网友推荐:实用技巧必看

文章导读
1. 查询sysadmin服务器角色成员:SELECT name FROM sys.server_role_members rm JOIN sys.server_principals r ON rm.member_principal_id = r.principal_id JOIN sys.server_principals p ON rm.role_principal_id = p.princi
📋 目录
  1. A CSDN网友分享
  2. B 博客园经验帖
  3. C 知乎高赞回答
  4. D IT论坛网友技巧
  5. E 简书实用帖
  6. F StackOverflow中文翻译
A A

1. 查询sysadmin服务器角色成员:SELECT name FROM sys.server_role_members rm JOIN sys.server_principals r ON rm.member_principal_id = r.principal_id JOIN sys.server_principals p ON rm.role_principal_id = p.principal_id WHERE p.name = 'sysadmin';

CSDN网友分享

首先,用这个SQL查所有sysadmin成员:SELECT SP.name AS LoginName, SP.type_desc AS LoginType, SR.name AS RoleName FROM sys.server_role_members SRM JOIN sys.server_principals SP ON SRM.member_principal_id = SP.principal_id JOIN sys.server_principals SR ON SRM.role_principal_id = SR.principal_id WHERE SR.name = 'sysadmin' ORDER BY SP.name;

博客园经验帖

检查当前用户权限:SELECT * FROM fn_my_permissions(NULL, 'SERVER'); 如果看到sysadmin,就有超级权限了。简单直接,一查就知道。

SQL Server超级用户权限自查指南,网友推荐:实用技巧必看

知乎高赞回答

用SSMS图形界面:安全 - 服务器角色 - sysadmin,右键查看成员列表。或者命令行:EXEC sp_helpsrvrolemember 'sysadmin';

IT论坛网友技巧

查询所有高危权限:SELECT * FROM sys.server_permissions sp JOIN sys.server_principals p ON sp.grantee_principal_id = p.principal_id WHERE sp.permission_name IN ('CONTROL SERVER', 'ALTER ANY LOGIN', 'CREATE ANY DATABASE');

SQL Server超级用户权限自查指南,网友推荐:实用技巧必看

简书实用帖

防患未然,自查脚本:DECLARE @sql NVARCHAR(MAX); SELECT @sql = STRING_AGG(QUOTENAME(name), ',') FROM sys.server_principals WHERE type = 'S'; EXEC sp_executesql N'SELECT * FROM sys.server_role_members WHERE member_principal_id IN (' + @sql + ')';

SQL Server超级用户权限自查指南,网友推荐:实用技巧必看

StackOverflow中文翻译

谁能杀进程?SELECT name FROM sys.server_principals WHERE principal_id IN (SELECT member_principal_id FROM sys.server_role_members WHERE role_principal_id = SUSER_ID('sysadmin'));

FAQ
Q: 怎么快速知道自己是不是sysadmin?
A: 执行 SELECT IS_SRVROLEMEMBER('sysadmin'); 返回1就是。
Q: 普通用户能查这个吗?
A: 不行,得有VIEW DEFINITION权限或sysadmin。
Q: 怎么移除不必要的sysadmin?
A: EXEC sp_dropsrvrolemember @loginame = '用户名', @rolename = 'sysadmin';
Q: Windows认证用户怎么查?
A: 一样用sys.server_principals,type_desc看LOGIN类型。