List all access permission or provisioned to a SQL user or Windows user/group directly

SELECT
        [UserType] = CASE princ.[type]
                         WHEN ‘S’ THEN ‘SQL User’
                         WHEN ‘U’ THEN ‘Windows User’
                         WHEN ‘G’ THEN ‘Windows Group’
                     END,
        [DatabaseUserName] = princ.[name],
        [LoginName]        = ulogin.[name],
        [Role]             = NULL,
        [PermissionType]   = perm.[permission_name],
        [PermissionState]  = perm.[state_desc],
        [ObjectType] = CASE perm.[class]
                           WHEN 1 THEN obj.[type_desc]       
                           ELSE perm.[class_desc]            
                       END,
        [Schema] = objschem.[name],
        [ObjectName] = CASE perm.[class]
                           WHEN 3 THEN permschem.[name]       
                           WHEN 4 THEN imp.[name]            
                           ELSE OBJECT_NAME(perm.[major_id])  
                       END,
        [ColumnName] = col.[name]
    FROM
        –Database user
        sys.database_principals     AS princ
        –Login accounts
        LEFT JOIN sys.server_principals  AS ulogin  ON 
ulogin.[sid] = princ.[sid]
        –Permissions
        LEFT JOIN sys.database_permissions AS perm  ON 
perm.[grantee_principal_id] = princ.[principal_id]
     LEFT JOIN sys.schemas  AS permschem ON permschem.[schema_id] = perm.[major_id]
    LEFT JOIN sys.objects  AS obj ON obj.[object_id] = perm.[major_id]
        LEFT JOIN sys.schemas  AS objschem  ON objschem.[schema_id] = obj.[schema_id]
        –Table columns
        LEFT JOIN sys.columns  AS col  ON col.[object_id] = perm.[major_id]
          AND col.[column_id] = perm.[minor_id]
        –Impersonations
        LEFT JOIN sys.database_principals  AS imp ON imp.[principal_id] = perm.[major_id]
    WHERE
        princ.[type] IN (‘S’,’U’,’G’)
        — No need for these system accounts
        AND princ.[name] NOT IN (‘sys’, ‘INFORMATION_SCHEMA’)

Leave a Reply

Your email address will not be published. Required fields are marked *