Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[sp_Blitz] Checks with stored procedures sp_validatelogins, xp_regread, and xp_readerrorlog fail because of permissions #3356

Closed
Montro1981 opened this issue Sep 26, 2023 · 4 comments
Assignees

Comments

@Montro1981
Copy link
Contributor

Version of the script
Version 8.16
VersionDate 2023-08-20

What is the current behavior?
The fn_my_permissions function returns that we can execute the stored procedures sp_validatelogins and xp_regread but when we try to execute them we get errors that we have no permissions.
Also permissions for stored procedure xp_readerrorlog are not checked.

If the current behavior is a bug, please provide the steps to reproduce.
Create a user on the SQL server with VIEW SERVER STATE rights that is not sysadmin.

sp_validatelogins

SELECT [entity_name], [subentity_name], [permission_name]
FROM fn_my_permissions(N'sp_validatelogins', N'OBJECT') AS fmp
WHERE fmp.permission_name = N'EXECUTE';
entity_name subentity_name permission_name
sp_validatelogins EXECUTE
EXEC sp_validatelogins;
/*
Msg 15247, Level 16, State 1, Procedure sp_validatelogins, Line 6 [Batch Start Line 0]
User does not have permission to perform this action.
*/

xp_regread

SELECT [entity_name], [subentity_name], [permission_name]
FROM fn_my_permissions(N'xp_regread', N'OBJECT') AS fmp
WHERE fmp.permission_name = N'EXECUTE'
entity_name subentity_name permission_name
xp_regread EXECUTE
EXEC xp_regread @rootkey = N'HKEY_LOCAL_MACHINE', @key = N'', @value_name = N'';
/*
Msg 22001, Level 16, State 1, Line 31
xp_regread() returned error 5, 'Access is denied.'
*/

xp_readerrorlog

SELECT [entity_name], [subentity_name], [permission_name]
FROM fn_my_permissions(N'xp_readerrorlog', N'OBJECT') AS fmp
WHERE fmp.permission_name = N'EXECUTE';
entity_name subentity_name permission_name

All these errors are not fatal and the procedure will continue to run.

What is the expected behavior?
For sp_validatelogins, xp_regread we need to check if we can actually execute the procedures and set the @SkipValidateLogins and @SkipXPRegRead variables accordingly.
For xp_readerrorlog there is no variable (yet) so we need to add an skip variable to the list ,@SkipXPReadErrorLog bit = 0 and set it accordingly and disable check 193 if @SkipXPReadErrorLog = 1

Montro1981 added a commit to Montro1981/SQL-Server-First-Responder-Kit that referenced this issue Sep 26, 2023
Montro1981 added a commit to Montro1981/SQL-Server-First-Responder-Kit that referenced this issue Sep 26, 2023
Montro1981 added a commit to Montro1981/SQL-Server-First-Responder-Kit that referenced this issue Sep 26, 2023
Montro1981 added a commit to Montro1981/SQL-Server-First-Responder-Kit that referenced this issue Sep 26, 2023
Montro1981 added a commit to Montro1981/SQL-Server-First-Responder-Kit that referenced this issue Sep 26, 2023
Montro1981 added a commit to Montro1981/SQL-Server-First-Responder-Kit that referenced this issue Sep 26, 2023
Montro1981 added a commit to Montro1981/SQL-Server-First-Responder-Kit that referenced this issue Sep 26, 2023
Montro1981 added a commit to Montro1981/SQL-Server-First-Responder-Kit that referenced this issue Sep 26, 2023
Montro1981 added a commit to Montro1981/SQL-Server-First-Responder-Kit that referenced this issue Sep 26, 2023
Montro1981 added a commit to Montro1981/SQL-Server-First-Responder-Kit that referenced this issue Sep 26, 2023
@Montro1981
Copy link
Contributor Author

Made three separate pull request as the issue required three different solutions.

@erikdarlingdata
Copy link
Contributor

@Montro1981 thanks for doing all this work on the permissions checks. I knew it was going to be a sordid process.

@Montro1981
Copy link
Contributor Author

@erikdarlingdata you're welcome.

BrentOzar added a commit that referenced this issue Oct 10, 2023
…it_3356_sp_validatelogins

#3356 Fix for sp_validatelogins
@BrentOzar BrentOzar added this to the 2023-10 Release milestone Oct 10, 2023
@BrentOzar
Copy link
Member

Thanks for the pull request. Looks good, merging into the dev branch, will be in the next release with credit to you in the release notes.

BrentOzar added a commit that referenced this issue Oct 10, 2023
BrentOzar added a commit that referenced this issue Oct 10, 2023
…it_3356_xp_readerrorlog

#3356 Fix for xp_readerrorlog
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants