Copy-DbaLogin - Add safety check to prevent self-lockout when dropping Windows groups #9948
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…g Windows groups This change addresses issue #8572 where using Copy-DbaLogin with -Force could lock administrators out of SQL Server instances when their access comes solely from AD groups. The safety check: - Only applies to Windows groups (not individual logins) - Only activates when current user has no direct login (access via group only) - Only checks high-privilege groups (sysadmin, securityadmin, or ALTER ANY LOGIN) - Uses xp_logininfo to enumerate group members (requires less privilege) - Provides clear warning messages with actionable guidance - Errs on the side of caution if group membership cannot be verified (do Copy-DbaLogin) Co-authored-by: Chrissy LeMaire <[email protected]>
Member
Author
|
@niphlod whatcha think? safety vs performance. claude tried to balance. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR addresses issue #8572 where using
Copy-DbaLoginwith-Forcecould lock administrators out of SQL Server instances when their access comes solely from AD groups.Changes
xp_logininfoto verify group membership (minimal privilege requirements)Safety Check Logic
The protection activates only when:
Testing
Fixes #8572
Generated with Claude Code