Remove-DbaPrivilege

Synopsis

Revokes Windows privileges from SQL Server service accounts or from a specific account.

Description

Removes Windows privileges like Lock Pages in Memory (LPIM), Instant File Initialization (IFI), Logon as Batch, Logon as Service, Generate Security Audits and Create Global Objects from the local security policy. This is the counterpart of Set-DbaPrivilege: it undoes a grant without exporting the policy with secedit, editing the account out of the line by hand and importing it again.

Without -User, the command discovers the SQL Server engine services on the target computer and revokes the privileges from their service accounts and from their per-service SIDs (NT SERVICE<ServiceName>). Both are checked for every privilege, because Set-DbaPrivilege grants IFI, LPIM and SecAudit to the per-service SID today but granted them to the service account in earlier versions.

The built-in accounts LocalSystem, LocalService and NetworkService are skipped during the discovery, because their privileges are shared with every other service that runs under them. To revoke a privilege from one of them anyway, name it with -User.

Requires Local Admin rights on destination computer(s).

Syntax

Remove-DbaPrivilege
    [[-ComputerName] <DbaInstanceParameter[]>]
    [[-Credential] <PSCredential>]
    [-Type] <String[]>
    [[-User] <String>]
    [-EnableException]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Examples

Example 1: Revokes the privileges 'SeLockMemoryPrivilege' and 'SeManageVolumePrivilege' from the SQL Server service...

PS C:\> Remove-DbaPrivilege -ComputerName sqlserver2014a -Type LPIM,IFI

Revokes the privileges ‘SeLockMemoryPrivilege’ and ‘SeManageVolumePrivilege’ from the SQL Server service accounts and their per-service SIDs on computer sqlserver2014a.

Example 2: Revokes the privilege 'SeManageVolumePrivilege' from the account CONTOSO\OldSvc on computer sql1

PS C:\> Remove-DbaPrivilege -ComputerName sql1 -Type IFI -User "CONTOSO\OldSvc"

Example 3: Shows which accounts would lose the privilege 'SeCreateGlobalPrivilege' on computers sql1, sql2 and sql3...

PS C:\> 'sql1','sql2','sql3' | Remove-DbaPrivilege -Type CreateGlobalObjects -User "CONTOSO\BackupAgent" -WhatIf

Shows which accounts would lose the privilege ‘SeCreateGlobalPrivilege’ on computers sql1, sql2 and sql3 without changing anything.

Required Parameters

-Type

Specifies which Windows privileges to revoke. Accepts one or more values: ‘IFI’ (Instant File Initialization), ‘LPIM’ (Lock Pages in Memory), ‘BatchLogon’ (Log on as a batch job), ‘SecAudit’
(Generate security audits), ‘ServiceLogon’ (Log on as a service), and ‘CreateGlobalObjects’ (Create global objects).
Revoking ServiceLogon from the account a service runs under keeps that service from starting, so use it only for accounts that no longer run a service.

Optional Parameters

-ComputerName

The target computer or computers.

-Credential

Credential object used to connect to the computer as a different user.

-User

Specifies the account to revoke the privileges from instead of the discovered SQL Server service accounts.
Accepts domain accounts (DOMAIN\User), local accounts (COMPUTER\User, .\User or User), per-service SIDs (NT SERVICE\MSSQLSERVER) or a SID (S-1-5-…). A SID is useful for an account that was deleted
and cannot be resolved by name any more.

-EnableException

By default, when something goes wrong we try to catch it, interpret it and give you a friendly warning message.
This avoids overwhelming you with “sea of red” exceptions, but is inconvenient because it basically disables advanced scripting.
Using this switch turns this “nice by default” feature off and enables you to catch exceptions with your own try/catch.

-WhatIf

If this switch is enabled, no actions are performed but informational messages will be displayed that explain what would happen if the command were to run.

-Confirm

If this switch is enabled, you will be prompted for confirmation before executing any operations that change state.

Outputs

PSCustomObject

Returns one object for every privilege that was revoked from an account. A privilege the account did not hold returns no object; the command warns about it instead.

Properties:

• ComputerName: The computer the privilege was revoked on
• User: The account the privilege was revoked from
• Type: The privilege as named by -Type (IFI, LPIM, BatchLogon, SecAudit, ServiceLogon or CreateGlobalObjects)
• Privilege: The name of the Windows privilege or right (for example SeManageVolumePrivilege)
• Status: Always “Removed”