Wait…go and actually read the tidbit of info from Brian...

Ok now that you have read that, you saw the T-SQL code to find the server-level permissions granted to any account on an instance of SQL Server 2005 or 2008. Well what if I only wanted it for one login and I wanted to use the GUI? Ah, ha!!!

So on my test system at home I have [myUser], with the current permissions showing below (retrieved using Brian’s T-SQL code).

Now I am going to grant the account VIEW SERVER STATE and VIEW ANY DATABASE. Running the T-SQL code again will show you this:

Now how can you see this using SSMS, you ask? …I’m glad you asked. Open up SSMS and go to the properties of your login you are interested in, click on “Securables” in the left pane. You should see this window:

Now click on the “Search” button. You are presented with options as to what objects you want SSMS to search for, I chose “The server…”. You can play around later to see what the options do if you like, these selections are not remembered so once you close the window they go away. After clicking OK you will see your instance name show up under Securables and the bottom pain will show all the instance level permissions. I scroll all the way to the bottom and will see the permissions I assigned to my login:

That is all for now…

A loyal guide

Fair warning that some religous terminology may be mentioned in this blog post, continue reading at your own risk.

I recently took part in the first round of the Mentoring Experiment. This is a program that Steve Jones (t|b) and Andy Warren (t|b) started (they seem to do that alot).

I acted as the mentoree and had someone mentor me. Overall it was a great experience. I want to send my thanks out to Steve and Andy for allowing me to participate. The plan of the was for me and my mentor to schedule a few phones calls each month to talk about different things. We talked about where I wanted my career to go, and where I was at currently. I got some good advice from it on how to grow my knowledge and get more involved with things. I greatly appreciate my mentor sharing that time away from his family each month during this program trial.

I would advise anyone interested in SQL Server, especially if you are just starting out with it, to watch the Mentoring website I linked to above for the second cycle to start up. It can help you get your plan written out to where you want to go with your career. Having someone that has been through it already is a great way for you to learn what things work and what does not.

The main thing I have learned is that I need to build those skillsets that best match up to what I want to do. If I don’t then I won’t go any further than where I am at right now. I have the belief that God has a plan for me and my career. What the end result will be I do not know and don’t want to know, the fun part is the journey.

So I’m still working on the script I talked about in a previous post. I wanted to try to drop using the parameter and try to work it all out in the script if it comes across more than one instance.

So I came up with this, initially:

$regInstance = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server').InstalledInstances
if ($regInstance.Count > 1)
{
   "More than one instance found on server."
   foreach ($ins in $regInstance)
   {
     $regPath = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL').$ins
     $fullpath = "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\$regpath"
   }
}
else
{
   $regPath = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL').$ins
   $fullpath = "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\$regpath"
}


So that was nice, but you probably already noticed an issue? The way it is written the $fullpath will only have the last value it hits in the foreach loop, if more than one SQL instance exist. That will not work. So where do we turn…hash tables. How you might ask? While we pause for station identification, go read this post from The Scripting Guy! Blog.

The example in that post that helped me was adding 100 intergers as key/value pairs in a hash table. I could capture both the InstalledInstances and the Instance Names values, and keep them associated with each other  in a hash table. This improves the options I have of reusing this snippet in other scripts possibly. (One example comes to mind is being able to pass the instance name in SMO scripts.)

So the 18 lines of code from above, turned into this:

#create hash table
$hashInst = @{}
#populate hash table with values
$inst = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server').InstalledInstances
foreach ($i in $inst)
{
   $hashInst.Add($i,(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL').$i)
}

A total of just 6 lines of code for readability, could go down to 3 if you put the foreach on one line.

Anyway some of the findings in that checklist have you check configuration settings that could be checked through SSMS or through registry keys. I prefer to check registry keys or use SQL SMO if I can, cause guess what…PowerShell can do it for me.

I am not going to provide the complete script right now cause it is still a work in progress. I have a parameter required to pass with the script, the instance name. I was just using that to connect with SQL SMO, but now I have just figured out how I can use that with looking at the registry.

With a SQL Server installs (SQL 2005 and higher) it adds a registry hive of “HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server”. To really get deeper than that you have to know what the path is for the instance and it varies between SQL Server versions and default/named instances. In SQL Server 2005 it is MSSQL.# (# being a number between 1 – 9). With SQL Server 2008 it changed to MSSQL10.<InstanceName> and SQL 2008 R2 it is MSSQL10_50.<Instance Name>. So if you were working with a default instance the path for SQL Server 2008 and R2 would be MSSQL10.MSSQLSERVER or MSSQL10_50.MSSQLSERVER. With SQL Server 2005 it would be your best guess cause if there are multiple instances it will depend on the order it was installed. If the default instance was first it would be MSSQL.1, then any named instance after that would have that number incremented.

Needless to say it took me a few minutes to get it down right but this is the code I came up with, and there is probably another way of doing it (or even doing it with less). I have not tested it on every version of SQL Server. If I come across any bugs I will update this post.

Note: $InstnaceName is the variable used to pull in the parameter passed when calling the script.

So I decided to go back to RDP files, using Remote Desktop Connection. I did not want to go through the process of having to create those files all over again. So guess what I wanted to do? That’s right, see if PowerShell could do it for me.

A quick search on Google I came across a post from the Windows PowerShell Blog on RDP file generation. The post is actually a review of a script someone wrote and blogged about that will create multiple RDP files with PowerShell. Which the original author of this script is lost since the link to the author of the script is dead.

Anyway, I decided to start with this script but do a few things differently. As well, the PowerShell Team mentioned one of the flaws in the guy’s script is it is dependent upon a CSV file, something developers may call “hard coded”. I wanted to make it more portable and useful for other folks to use.

My script assumes the current directory so where you run the script from is where the files will be created. I did not care about creating directories or creating RDP file with different resolution settings. If you do, you are more than welcome to adjust the script to your preferences.

The script has three (3) parameters to pass, with two being required and the third one is optional. The first position is the $server that you want to connect to in the RDP file. The second being your RDP file template (I’ll explain how I created mine). Then the third and optional parameter, is the username for that RDP file. I don’t usually put my username in the RDP file due to the environment I work in, but you may want to.

Ok, first how I created the RDP template file. I open up Remote Desktop Connection (from the run prompt: mstsc.exe). Go into the options and set everything as you like (Display, Local Resources, etc.). Then under the General tab click “Save As…”. Save the file to your desktop or where you saved the script, giving it a name of your liking. Then using Notepad open that file up and you will see something similar to this:

The highlighted line is what you want to remove and then save the file. This line will be added by the script and include your server name you pass.

So here is the script…(download here)

param(
[Parameter(Position=0,Mandatory=$True)]
[string]$server,
[Parameter(Position=1,Mandatory=$True)]
[string]$MyDefaultRDP,
[Parameter(Position=2,Mandatory=$False)]
[string]$myaccount
) 

ForEach($entry in $server)
{
#build the file
#assumes current directory
$filename = “.\” + $entry + “.rdp”

# Add hostname in RDP file
$temp = “full address:s:” + $Entry

#test for username, if empty it will not be added
if ($myaccount) {
$temp = $temp + “`nusername:s:” + $myaccount
}
#check to see if file exist
if (Test-Path $filename) {
Remove-Item $filename -force
Write-Host “Found $filename existed, so I deleted it for you”
}

$temp | Out-File $filename
Get-Content $MyDefaultRDP | Out-File $filename -Append
Write-Host “$filename created”
}

[Anyone know an easy way to format PowerShell code? This is the best I could get with Windows Live Writer Add-On.]

Ok so here are some examples of how you can use this:

If you need to use an IP address for your server instead of the hostname:

Then if you want to add your username:

If you want to use a text file to pass a list of servers and different usernames I would suggest using a CSV file. Then work with the Import-Csv cmdlet to pass in each object to the right parameter.

Something like this should work for you (assume column headers in CSV file are Server and Username):

NOTE: A small issue I have had running this script on my machine at home (Window 7 Ultimate) is the escape character “`n” (backtick + n) is supposed to add a new line before it writes the username text to the file. However it is not doing it when I run the script. If I have the $temp output to the console it shows the new line, but when it writes it to the file it does not for some reason. Which with the RDP file it does not matter as you can see in the screenshot above it still puts the username in the field. I don’t know if you will see the same problem, but wanted to let you know.

It is a Window Server 2008 box and SQL Server 2008 R2 so I know PowerShell is available to me for my perusing.

Open up PowerShell firing off a few commands as such:

[System.Reflection.Assembly]::LoadWithPartialName('Microsoft.SqlServer.Smo') | Out-Null
$s = New-Object 'Microsoft.SqlServer.Management.Smo.Server' MyInstance

So good so far. I then go to check a few things to find out what the build number is and what the directory path is for the instance.

$s.Information.version

This will give you the Major, Minor, Build, and Revision information of that instance. It returns that no issue. However the next command returns nothing:

$s.Information.RootDirectory

What this should have given me is the path to the files for that instance on the server. The \MSSQL10_50.InstanceName\MSSQL\ path. However all it did was send me back to a prompt, without any output or error message. So I decided to just look at all of the information to see if it returned anything.

$s.Information

Which that line returns an error that looked like this:

format-default : An exception occurred while executing a Transact-SQL statement or batch.
+ CategoryInfo : NotSpecified: (:) [format-default], ExecutionFailureException
+ FullyQualifiedErrorId : Microsoft.SqlServer.Management.Common.ExecutionFailureException,Microsoft...

Which did not really help me, but I had an idea it had something to do with my permissions not being setup correctly. So I took that CategoryInfo line and popped it into the mighty Oracle (aka Google). The first link that came up was a blog post from 2009 by Michiel Wories on how to get more detailed error information from PowerShell. Which stemmed from a blog post Allen White (b|t) had written on actually how to handle errors in PowerShell.
Apparently the message outputted to the console does not include all of the error. There is an “InnerException” that has all the meat of the error. To get that you can execute the command below. Now I believe you can only do this if you are working interactively with the console. If you are running a script you would need to check Allen’s post to see how you can capture the error itself when your script is executed.

$error[0] | Format-List InnerException -Force

From the output of this command I see the rest of the story:

An exception occurred while executing a Transact-SQL statement or batch. ---> The EXECUTE permission was denied on the ojbect 'xp_instance_regread', database 'mssqlsystemresource', schema 'sys'.
The EXECUTE permissions was denied...on and on.

Each object that should have been returned from executing $s.Information shows the “EXECUTE permission denied” message for that object. Which by itself is cool because you see what is happening in the background, and I now know what is being executed to return that information to me.

So now you know how to get to this information when you get an error in PowerShell that just may not give you enough info to go on. I am now off to get my permissions fixed.

Source: Flickr

If you set the service account for the SQL Server services up at installation you are ahead of the game when dealing with securing your SQL Server installation. However there are some environments where the DBA does not do the initial installation of SQL Server. That requires the DBA to go back and configure a custom account for the services after the installation.

In most instances if you use the SQL Server Configuration Manager (SSCM) to set the service account it should configure all the file, registry, and operating system permissions SQL Server needs for you. See this TechNet article on SSCM.

A question to ask is do you ever go back and periodically check to see what operating system permission the account was actually given? Do you check to make sure someone has not dorked around with the permissions and made your SQL Server instance not come back up at next reboot?

Well you can do this by opening up the group policy editor on the server and go through each permission SQL Server is supposed to have. However, you would have to go through all of the OS permissions to make sure the service account has not been granted excessive permissions to the operating system.

Well who wants to use the GUI when we can use PowerShell!!! So here is a nice little one-liner I use to verify what permissions the SQL Server service account(s) have on a server:
Get-WMIObject -Namespace root\rsop\computer -Class RSOP_UserPrivilegeRight -Recurse | Where-Object {$_.AccountList -like "*SQL*"} | Format-Table UserRight -AutoSize

This portion of the code is where you will adjust it for your environment: “{$_.AccountList -like “*SQL*”}”. As written above this will return the permissions found to have an account name/group assigned to it that contains the text “SQL” within the name. Adjust this portion to your specific requirements.

This is a screenshot of what your output should resemble. (Do you see the excessive or un-needed privilege returned in the output?):

A little bit of a caveat for you on this code though is that it will only work on domain member servers. For some reason, that I never bothered to look up, the RSOP namespace is not available or accessible on stand-alone servers.

But that is boring, lets use PowerShell!!!

The cmdlet (commandlet) of choice for this is going to be: Get-Acl

I will let you dive into this command and try to figure it out, but this is the one-liner I use most often that gives me the information I want to know about the SQL Server directory:

$a = (Get-Acl -Path 'D:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL')
$a.Access | Select-Object FileSystemRights, AccessControlType, IdentityReference, IsInherited | ft -auto

Here is a screenshot of the output:

Now that is for a folder, what if I wanted to do it for a Registry hive as well? It works the same way with the exception of two things: (1) Your “Path” is changed to the registry hive of choice (HKLM, HKCU, etc) and (2) the “Select-Object” portion. Instead of “FileSystemRights” you would change that to “RegistryRights”, like so:

$a = (Get-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server')
$a.Access | Select-Object RegistryRights, AccessControlType, IdentityReference, IsInherited | ft -auto

Here is screenshot of the output:

If you don’t already, you really should be following O’Reilly on Twitter and/or Facebook. You will get notified through one of these about daily deals for e-books at 50% off or more. I have gotten some great deals on some good book titles. The following are the ones I have gotten in the past months from O’Reilly .

• Microsoft® SQL Server® 2008 Internals

• Microsoft® SQL Server® 2008 T-SQL Fundamentals

• Windows PowerShell™ 2.0 Administrators Pocket Consultant

Apress also does deals, called “Deal of the Day”. However I have not noticed they do any advertising of this through Twitter or Facebook. Apress offers 1 book for a 24 hour period for $10. I caught a post on Twitter the other day about the title for that day and was able to snag this title from them:

• Pro SQL Server 2008 Policy-Based Management

The downside to Apress is they only offer E-books in PDF format. I don’t know if they have future plans to offer in other formats or not. O’Reilly on the other hand, offers the book in APK (Android), DAISY (Text-to-Speech for those with print disabilities), ePub (E-Reader apps for Apple devices) , Mobi (Amazon Kindle), and PDF. You see why I like them much more? I can see the advantage to the E-book and having the physical book. However I find myself now more likely to read from my iPod that I do sitting somewhere to pull out the physical book. I will re-read them on the computer as well.</P?

A talent and a gift, what is the difference? I follow the definition that a talent is something you learn and a gift is something you were born with.

I believe one of my gifts is helping people, or sometimes called the gift of service. I enjoy offering myself as a service to people whether it be helping them move some furniture or fixing that virus on their computer. Regarding technology, I like watching someone have that moment of “ah now I get it” if I am showing them how to use a program or how something works. (I got great enjoyment showing my, at the time 4 year old, how to use the mouse on our computer. Now he can play PBS and Nick JR games online by himself.)

I have a few talents, one of them being knowledge of SQL Server. I take pride in the fact that most of what I know with SQL Server I have learned on my own. I follow many folks in the SQL Server community reading blogs and books. I have also being blessed with employment that has given me the opportunity to interact with SQL Server itself. The only formal training I ever had was a beta course on upgrading my skills to SQL Server 2005. I got a little from that class but not much.

A downside to this talent…learning it on my own. It is a lonely thing to learn alone without a study partner or even my very own SQL Buddy. I work with other DBAs in my current job but get the feeling most of them are SQL Server while they are at work, but after work “what is SQL Server?”. (I don’t know this for sure of everyone but it is just not an environment that encourages advancing their knowledge to much on a particular product.)

Now if I was to say win a contest to get a free seat at the SQLskills Master Immersion Event in Dallas, TX…well I would kiss a sheep square on the mouth.

As it states on the class details page:

The more you know about how SQL Server works the easier you will be able to respond to performance, design, and corruption problems – as well as solve them!

I sit and watch webcast and read blog post from folks in the SQL Server community that are considered to be (and are) experts in their field. I read and watch them explain features about SQL Server and why “this” or “this” happens and what SQL Server is doing. I would love to have that depth of knowledge and talent to be able to share with folks. That is a level I would love to attain.

I would greatly enjoy the opportunity to master my SQLskills and immerse myself in SQL Server more by attending this course. To get the core fundamentals and foundation of SQL Server I believe would help me start anew learning SQL Server. Ensuring I have a good base/foundation of SQL Server knowledge to build upon will put me in a better position to advance to that master level. I think having this knowledge will be two fold:

1. Learning how it actually works versus how I think it works will improve my confidence level in so many ways (troubleshooting issues, speaking with people, or writing about SQL Server). It will very possibly help me get past that hump to submit an abstract for a SQL Saturday or SQL PASS user group somewhere.

2. I also firmly believe getting taught to this level will help train myself on how to learn more about SQL Server. The resources and contacts/friendships that can be made having a week long class with people allow me to expand my network in the SQL Server community. It will allow me to feed off their strengths, and along the way maybe I will end up helping them with their weaknesses. Getting those contacts and that amount of knowledge is priceless and can be the key to getting more involved in the SQL Server community.

I expect if I am able to win that free seat that there will be many, many moments of “AH! that’s how it works”. I would love to experience that.