Remove-DbaLogin View Source Chrissy LeMaire (@cl), netnerds.net Windows, Linux, macOS Synopsis Removes SQL Server logins from target instances
Description Removes one or more SQL Server logins from specified instances using the SMO Drop() method. This function handles the complete removal process including dependency checks and provides proper error handling when logins cannot be dropped due to existing sessions or database ownership. Use the -Force parameter to automatically terminate active sessions associated with the login before removal, which is useful when cleaning up test environments or decommissioning user accounts.
Remove-DbaServerRole View Source Claudio Silva (@ClaudioESSilva), claudioessilva.com Windows, Linux, macOS Synopsis Removes custom server-level roles from SQL Server instances.
Description Removes custom server-level roles that are no longer needed from SQL Server instances. This function helps clean up security configurations by permanently dropping user-defined server roles while preserving built-in system roles. Use this when decommissioning applications, consolidating permissions, or cleaning up after security audits. The operation requires confirmation due to its permanent nature and potential security impact.
Remove-DbaServerRoleMember View Source Mikey Bronowski (@MikeyBronowski), bronowski.it Windows, Linux, macOS Synopsis Revokes server-level role membership from SQL Server logins and roles.
Description Revokes membership from server-level roles by removing logins or nested roles from target roles like sysadmin, dbcreator, or custom server roles. This is essential for security management when you need to reduce user privileges or clean up role assignments after organizational changes. The function works with both fixed server roles (sysadmin, securityadmin, etc.
Rename-DbaLogin View Source Mitchell Hamann (@SirCaptainMitch) Windows, Linux, macOS Synopsis Renames SQL Server logins and optionally their associated database users
Description Renames SQL Server logins at the instance level, solving the common problem of needing to update login names after migrations, domain changes, or when improving naming conventions.
When migrating logins between environments or standardizing naming conventions, manually updating login names and all their database user mappings is time-consuming and error-prone.
Set-DbaLogin View Source Sander Stad (@sqlstad), sqlstad.nl Windows, Linux, macOS Synopsis Modifies SQL Server login properties including passwords, permissions, roles, and account status
Description Manages SQL Server login accounts by modifying passwords, account status, security settings, and server role memberships in a single operation. Handles common DBA tasks like unlocking accounts, resetting passwords with force-change requirements, and applying password policies for security compliance. Includes a special unlock feature that preserves existing passwords by temporarily disabling policy checks, eliminating the need to reset passwords when unlocking accounts.
Sync-DbaLoginPermission View Source Chrissy LeMaire (@cl), netnerds.net Windows, Linux, macOS Synopsis Synchronizes login permissions and role memberships between SQL Server instances.
Description Syncs comprehensive login security settings from a source to destination SQL Server instance, ensuring logins have consistent permissions across environments. This function only modifies permissions for existing logins - it will not create or drop logins themselves.
The sync process handles server roles (sysadmin, bulkadmin, etc.), server-level permissions (Connect SQL, View any database, etc.
Test-DbaLoginPassword View Source Peter Samuelsson Windows, Linux, macOS Synopsis Identifies SQL Server logins with weak passwords including empty, username-matching, or dictionary-based passwords
Description Tests SQL Server authentication logins for common weak password patterns using the PWDCOMPARE() function to validate password hashes stored in sys.sql_logins. This security audit function helps identify authentication vulnerabilities by checking for empty passwords, passwords that match the username, and passwords from a custom dictionary you provide.
Stephen Bennett, sqlnotesfromtheunderground.wordpress.com | Chrissy LeMaire (@cl)
Test-DbaWindowsLogin View Source Stephen Bennett, sqlnotesfromtheunderground.wordpress.com , Chrissy LeMaire (@cl) Windows, Linux, macOS Synopsis Validates Windows logins and groups in SQL Server against Active Directory to identify orphaned, disabled, or problematic accounts
Description Queries SQL Server for all Windows-based logins and groups, then validates each against Active Directory to identify security issues and cleanup opportunities. The function checks whether AD accounts still exist, are enabled, and match their SQL Server SID to detect orphaned logins from domain migrations or account deletions.
Watch-DbaDbLogin View Source Chrissy LeMaire (@cl), netnerds.net Windows, Linux, macOS Synopsis Monitors active connections across SQL Server instances and logs client details to a central tracking table
Description Watch-DbaDbLogin queries sys.dm_exec_sessions and sys.dm_exec_requests DMVs to capture real-time connection activity across multiple SQL Server instances. It records login names, client hostnames, application names, database usage, and timestamps into a central monitoring table. This solves the common problem of inadequate connection documentation when planning server migrations or application updates.
dbatools