< Back
Test-DbaWindowsLogin
Post
NAME Test-DbaWindowsLogin
SYNOPSIS
Test-DbaWindowsLogin finds any logins on SQL instance that are AD logins with either disabled AD user accounts or
ones that no longer exist
SYNTAX
Test-DbaWindowsLogin [-SqlInstance] <Sqlcollaborative.Dbatools.Parameter.DbaInstanceParameter[]> [[-SqlCredential]
<Pscredential>] [[-Login] <System.Object[]>] [[-ExcludeLogin] <System.Object[]>] [[-FilterBy] <String>]
[[-IgnoreDomains] <System.String[]>] [-EnableException <Switch>] [<CommonParameters>]
DESCRIPTION
The purpose of this function is to find SQL Server logins that are used by active directory users that are either
disabled or removed from the domain. It allows you to keep your logins accurate and up to date by removing
accounts that are no longer needed.
PARAMETERS
-EnableException [<Switch>]
By default, when something goes wrong we try to catch it, interpret it and give you a friendly warning message.
This avoids overwhelming you with "sea of red" exceptions, but is inconvenient because it basically disables
advanced scripting.
Using this switch turns this "nice by default" feature off and enables you to catch exceptions with your own
try/catch.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-ExcludeLogin [<System.Object[]>]
Specifies a list of logins to exclude from the results. Options for this list are auto-populated from the
server.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-FilterBy [<String>]
Specifies the object types to return. By default, both Logins and Groups are returned. Valid options for this
parameter are 'GroupsOnly' and 'LoginsOnly'.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-IgnoreDomains [<System.String[]>]
Specifies a list of Active Directory domains to ignore. By default, all domains in the forest as well as all
trusted domains are traversed.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-Login [<System.Object[]>]
Specifies a list of logins to include in the results. Options for this list are auto-populated from the server.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-SqlCredential [<Pscredential>]
Login to the target instance using alternative credentials. Accepts PowerShell credentials (Get-Credential).
Windows Authentication, SQL Server Authentication, Active Directory - Password, and Active Directory -
Integrated are all supported.
For MFA support, please use Connect-DbaInstance.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-SqlInstance [<Sqlcollaborative.Dbatools.Parameter.DbaInstanceParameter[]>]
The SQL Server instance you're checking logins on. You must have sysadmin access and server version must be
SQL Server version 2000 or higher.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
OUTPUTS
NOTES
Tags: Login, Security
Author: Stephen Bennett, https://sqlnotesfromtheunderground.wordpress.com/ | Chrissy LeMaire (@cl)
Website: https://dbatools.io
Copyright: (c) 2018 by dbatools, licensed under MIT
License: MIT https://opensource.org/licenses/MIT
-------------------------- EXAMPLE 1 --------------------------
PS C:\\>Test-DbaWindowsLogin -SqlInstance Dev01
Tests all logins in the current Active Directory domain that are either disabled or do not exist on the SQL Server
instance Dev01
-------------------------- EXAMPLE 2 --------------------------
PS C:\\>Test-DbaWindowsLogin -SqlInstance Dev01 -FilterBy GroupsOnly | Select-Object -Property *
Tests all Active Directory groups that have logins on Dev01, and shows all information for those logins
-------------------------- EXAMPLE 3 --------------------------
PS C:\\>Test-DbaWindowsLogin -SqlInstance Dev01 -IgnoreDomains testdomain
Tests all Domain logins excluding any that are from the testdomain
RELATED LINKS
https://dbatools.io/Test-DbaWindowsLogin
SYNOPSIS
Test-DbaWindowsLogin finds any logins on SQL instance that are AD logins with either disabled AD user accounts or
ones that no longer exist
SYNTAX
Test-DbaWindowsLogin [-SqlInstance] <Sqlcollaborative.Dbatools.Parameter.DbaInstanceParameter[]> [[-SqlCredential]
<Pscredential>] [[-Login] <System.Object[]>] [[-ExcludeLogin] <System.Object[]>] [[-FilterBy] <String>]
[[-IgnoreDomains] <System.String[]>] [-EnableException <Switch>] [<CommonParameters>]
DESCRIPTION
The purpose of this function is to find SQL Server logins that are used by active directory users that are either
disabled or removed from the domain. It allows you to keep your logins accurate and up to date by removing
accounts that are no longer needed.
PARAMETERS
-EnableException [<Switch>]
By default, when something goes wrong we try to catch it, interpret it and give you a friendly warning message.
This avoids overwhelming you with "sea of red" exceptions, but is inconvenient because it basically disables
advanced scripting.
Using this switch turns this "nice by default" feature off and enables you to catch exceptions with your own
try/catch.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-ExcludeLogin [<System.Object[]>]
Specifies a list of logins to exclude from the results. Options for this list are auto-populated from the
server.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-FilterBy [<String>]
Specifies the object types to return. By default, both Logins and Groups are returned. Valid options for this
parameter are 'GroupsOnly' and 'LoginsOnly'.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-IgnoreDomains [<System.String[]>]
Specifies a list of Active Directory domains to ignore. By default, all domains in the forest as well as all
trusted domains are traversed.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-Login [<System.Object[]>]
Specifies a list of logins to include in the results. Options for this list are auto-populated from the server.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-SqlCredential [<Pscredential>]
Login to the target instance using alternative credentials. Accepts PowerShell credentials (Get-Credential).
Windows Authentication, SQL Server Authentication, Active Directory - Password, and Active Directory -
Integrated are all supported.
For MFA support, please use Connect-DbaInstance.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
-SqlInstance [<Sqlcollaborative.Dbatools.Parameter.DbaInstanceParameter[]>]
The SQL Server instance you're checking logins on. You must have sysadmin access and server version must be
SQL Server version 2000 or higher.
Required? false
Position? named
Default value
Accept pipeline input? False
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (https:/go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
OUTPUTS
NOTES
Tags: Login, Security
Author: Stephen Bennett, https://sqlnotesfromtheunderground.wordpress.com/ | Chrissy LeMaire (@cl)
Website: https://dbatools.io
Copyright: (c) 2018 by dbatools, licensed under MIT
License: MIT https://opensource.org/licenses/MIT
-------------------------- EXAMPLE 1 --------------------------
PS C:\\>Test-DbaWindowsLogin -SqlInstance Dev01
Tests all logins in the current Active Directory domain that are either disabled or do not exist on the SQL Server
instance Dev01
-------------------------- EXAMPLE 2 --------------------------
PS C:\\>Test-DbaWindowsLogin -SqlInstance Dev01 -FilterBy GroupsOnly | Select-Object -Property *
Tests all Active Directory groups that have logins on Dev01, and shows all information for those logins
-------------------------- EXAMPLE 3 --------------------------
PS C:\\>Test-DbaWindowsLogin -SqlInstance Dev01 -IgnoreDomains testdomain
Tests all Domain logins excluding any that are from the testdomain
RELATED LINKS
https://dbatools.io/Test-DbaWindowsLogin