To Drop Login and it’s Users
security-audit #login#security-audit#user
Set nocount on
DECLARE @DebugOnly bit = 0; -- switch to 0 to actually drop the login and user(s); 1 displays the generated script.
DECLARE @cmd nvarchar(MAX);
DECLARE @ServerPrincipalName sysname;
DECLARE @DatabasePrincipalName sysname;
SET @ServerPrincipalName = N'loginname'; -- the name of the LOGIN to be dropped from the SERVER.
SET @DatabasePrincipalName = N'username'; -- the name of the USER to be dropped from each DATABASE.
SET @cmd = '';
SELECT @cmd = @cmd + CASE WHEN @cmd = N'' THEN N'' ELSE N'
UNION ALL
' END + N'SELECT ''' + d.name + N'''
, sp.name COLLATE SQL_Latin1_General_CP1_CI_AS
, dp.name COLLATE SQL_Latin1_General_CP1_CI_AS
FROM ' + QUOTENAME(d.name) + N'.sys.database_principals dp
LEFT JOIN master.sys.server_principals sp ON dp.sid = sp.sid
WHERE sp.name = ''' + @ServerPrincipalName + N'''
OR dp.name = ''' + @DatabasePrincipalName + N''''
FROM sys.databases d
WHERE d.state_desc = N'ONLINE';
SET @cmd = @cmd + N';'
DECLARE @Results TABLE (
database_name SYSNAME NOT NULL
, server_principal_name SYSNAME NULL
, database_principal_name SYSNAME NULL
, PRIMARY KEY CLUSTERED (database_name)
);
INSERT INTO @Results (database_name, server_principal_name, database_principal_name)
EXEC (@cmd);
SET @cmd = N'';
SELECT @cmd = @cmd + CASE WHEN @cmd = N'' THEN N'' ELSE N'
' END + N' USE ' + QUOTENAME(r.database_name) + N';
PRINT (N''Dropping user ' + QUOTENAME(r.database_principal_name) + N' in ' + r.database_name + N''');
SET @msg = N'''';
SELECT @msg = @msg + CASE WHEN @msg = N'''' THEN N'''' ELSE CHAR(13) + CHAR(11) END + N''User [' + @DatabasePrincipalName + N'] owns '' + o.type_desc + N'' '' + QUOTENAME(s.name) + N''.'' + QUOTENAME(o.name) + N'' and cannot be dropped''
FROM sys.objects o
INNER JOIN sys.schemas s ON o.schema_id = s.schema_id
WHERE s.principal_id = (SELECT sp.principal_id FROM sys.database_principals sp WHERE sp.name = N''' + @DatabasePrincipalName + N''')
PRINT (@msg);
IF @msg <> N''''
BEGIN
SET @errCount = @errCount + 1;
END
ELSE
BEGIN
IF (
SELECT (COUNT(1))
FROM sys.schemas s
WHERE s.principal_id = (SELECT sp.principal_id FROM sys.database_principals sp WHERE sp.name = N''' + r.database_principal_name + N''')
) > 0
BEGIN
PRINT (N''User ' + r.database_principal_name + N' owns a schema and cannot be dropped'');
SET @errCount = @errCount + 1;
END
ELSE
BEGIN
DROP USER ' + QUOTENAME(r.database_principal_name) + ';
END;
END;
'
FROM @Results r;
SET @cmd = N'SET NOCOUNT ON;
DECLARE @msg nvarchar(MAX);
DECLARE @errCount int;
SET @errCount = 0;
BEGIN TRY
' + CASE WHEN @cmd = N'' THEN N' PRINT (N''User ' + @DatabasePrincipalName + N' does not exist in any database.'');' ELSE @cmd END + N'
END TRY
BEGIN CATCH
PRINT (ERROR_MESSAGE());
SET @errCount = @errCount + 1;
END CATCH
IF @errCount = 0
BEGIN
';
IF (
SELECT COUNT(1)
FROM @Results r
WHERE r.server_principal_name IS NOT NULL
) > 0
BEGIN
SELECT TOP(1) @cmd = @cmd + N' USE master;
PRINT (N''Dropping LOGIN ' + QUOTENAME(r.database_principal_name) + N''');
DROP LOGIN ' + QUOTENAME(r.server_principal_name) + N';'
FROM @Results r;
END
ELSE
BEGIN
SET @cmd = @cmd + N' PRINT (N''Login ' + @ServerPrincipalName + N' does not exist.'');';
END
SET @cmd = @cmd + N'
END
ELSE
BEGIN
PRINT (N''Errors occurred dropping users; login has NOT been dropped'');
END';
IF @DebugOnly = 1
BEGIN
PRINT @cmd
END
ELSE
BEGIN
EXEC sys.sp_executesql @cmd;
END