Skip to main content
How can we help?
< All Topics
Print

Database access dashboard

Information on database users and groups are collected, including scripts to quickly generate the security objects again. This can be very handy in a disaster scenario where a database is restored on a new server, but the server level security objects are missing. They will be easily available from Performance Store. The scripts are automatically creating both SQL Logins (including password), AD logins and groups as well as custom objects created on the server e.g. custom roles etc.

The Database access dashboard gives information about access and permissions for users and groups:

The dashboard shows if users or groups exists in the database but does not exist on the server (can happen if restoring a database from a different SQL Server). If this is the case, an alert is thrown.

It is possible to see exactly which users have access and their permissions. It shows access for users if users are not having direct logins on the database, but having access through group memberships (also nested groups).

Explanation of the “indirect_user” column:

  • 0: The database user has a corresponding server login.
  • 1: The database user does not have a direct corresponding server login, but is a member of an AD group that exists as a server login and is mapped in the database.
  • NULL: The database user does not have a direct corresponding server login, but is a member of an AD group that exists as a server login and is not mapped in the database.

When inditect_user is NULL, it presents a security risk, as a user gets access to a database from an AD group that is mapped in a different database.

Read more about access information in: Who has access?

Corresponding view in the Performance Store database:
dbo.v_database_access

Other relevant views in the Performance Store database:
dbo.v_database_security (shows access and permission information without nested AD group information)
dbo.v_ad_group_members (shows information about AD users and their group memberships without nested AD group information)
dbo.v_ad_group_members_recursive (shows information about AD users and their group memberships with nested AD group information)
dbo.v_server_access
dbo.v_authorizations
dbo.v_securables

Table of Contents