![]() |
|
|
By: Greg Robidoux | Read Comments | Print Greg is the President of Edgewood Solutions and a co-founder of MSSQLTips.com. Related Tips: More |
|
The login information is stored in the sysxlogins table in the master database. This table contains a column that holds the SID (Security Identifier) which is tied to a specific login. A corresponding table sysusers is stored in each user database and uses the SID to determine if a login has database access. So even though you may already have the same logins on your new server the SID may not match. What makes this even more confusing is that you can see the actual names of the logins and users, so you would think they would automatically match up, but the SID is what is actually tying the security together not the name.
One simple solution would be to restore the database drop all of the users and recreate the users. This may be simple if you have a few users, but what if there are hundreds. Also, if the user owns objects you will not be able to drop the user.
Solution
SQL Server offers several different commands to allow you to relink the logins and the users. Following is a list of the different commands and how they can be used. Remember there are two different types of SQL Server logins standard and Windows authenticated, so there are different approaches for each.
| Users After you restore the database you can see what users exist in the database. These users then need to be matched up with the corresponding logins on the server. | |
| Standard Logins If a standard login already exists you can use this command sp_change_users_login to relink the login and the user. sp_change_users_login This stored procedure has three options Auto_Fix, Report and Update_One. Below is a brief description.
Removing Users sp_revokedbaccess 'NorthDomain\Mike' Windows Logins DECLARE @sysxlogins_sid VARBINARY(85) SELECT @sysxlogins_sid = sid FROM master.dbo.sysxlogins WHERE name = 'NorthDomain\Joe' UPDATE sysusers SET sid = @sysxlogins_sid WHERE name = 'Joe'
| |
| Logins On the other end there are logins. | |
| Login Existing Access To find out what access a login has on your server you can run this command sp_helplogins. sp_helplogins 'NorthDomain\Mike' This will display a list of databases the login has access to as well as other info about the login such as the SID: Create New Login If you are creating a standard SQL Server login you would use this command sp_addlogin to create the login. sp_addlogin If you are creating a Windows authentication login use this command sp_grantlogin. sp_grantlogin 'NorthDomain\Mary' After you create the login you may need to link the appropriate database user to this new login using the steps above. Set Default Database sp_defaultdb 'NorthDomain\Mary', 'master'
| |
| Recreating Logins In some cases you may need to duplicate the entire login list from one server to another. This can be achieved manually by running the above commands, by using DTS or you can use the stored procedure that was developed by Microsoft (see link below). When you create the logins manually or use DTS the original SID is not kept and a new SID is created as the login is being created, therefore you will need to link the logins and users for your database. See Microsoft Knowledge Base article 246133 How to: Transfer logins and passwords between instances of SQL Server for more information. | |
Next Steps
| Share: | Share | Tweet |
|
![]() |
|
|
Free SQL Server Learning |
|
privacy | disclaimer | copyright | advertise | about authors | contribute | feedback | giveaways | user groups Some names and products listed are the registered trademarks of their respective owners. Edgewood Solutions LLC | MSSharePointTips.com | MSSQLTips.com |