To set up a solution in SSMS start by creating a new project.

I’m choosing to use the template for a “SQL Server Management Studio Project” for “SQL Server Scripts”. And I fill in the name and location of the new project. (If you have much experience with Visual Studio this is all going to look very familiar.)

I now have a blank solution. I add new queries to the Queries section, rename them (right click, select rename), add the script I want and save.

And now I have a list of commonly used scripts.

I should warn you that when you open SSMS and start working it creates a blank solution that get’s filled with any open query windows under Miscellaneous Files.

If you decide to open your Quick Scripts solution later in the day (let’s say you now have a dozen scripts open) then you need to be careful. The default option is to close your current solution, and that is going to close all of your currently open scripts. If you select the Add to Solution option then it will open the new solution along side your current Miscellaneous solution.

Now all you need to do to open up one of your scripts is double-click it in your solution. Handy right?

This SQL Server 2000 system table is included as a view for backward compatibility. We recommend that you use the current SQL Server system views instead. To find the equivalent system view or views, see Mapping SQL Server 2000 System Tables to SQL Server 2005 System Views. This feature will be removed in a future version of Microsoft SQL Server. Avoid using this feature in new development work, and plan to modify applications that currently use this feature.

And we follow the link for Mapping SQL Server 2000 System Tables to SQL Server 2005 System Views we see that sysprocesses is mapped to sys.dm_exec_connections, sys.dm_exec_sessions, and sys.dm_exec_requests. As it happens these are three of my favorite DMOs. Database_Id is in sys.dm_exec_requests but that only helps if the session is actually doing something. In SQL 2012 and up you can find database_id in sys.dm_exec_sessions and this appears to map exactly to the dbid in sysprocesses. So quest solved right! Nope, 90% of the servers I’m working in currently are pre 2012. So now I’m in kind of a conundrum. I could write a query using sysprocesses, but I try to avoid using deprecated features when I can, or I can use sp_who, which I already complained about above.

Then I remembered sys.dm_tran_locks. This DMO displays information on locks currently held in the system. And yay us, being in a database is considered a lock! In fact it is a shared database lock. So now we write the query:

SELECT sys.databases.name DB_Name, request_session_id
FROM sys.dm_tran_locks
JOIN sys.databases
	ON sys.dm_tran_locks.resource_database_id = sys.databases.database_id
WHERE resource_type = 'DATABASE'
ORDER BY request_session_id

This is great! Except that it doesn’t show a shared database lock for master. Not sure why, but it doesn’t. Not really a big deal since chances are I’m never going to be doing anything to master that requires me to know who’s in it. I could go and look in sys.dm_exec_sessions for any session_ids that aren’t in sys.dm_tran_locks but then I’m going to get a number of sessions that, at least according to sysprocesses, belong to dbid 0. It probably doesn’t matter since they are all going to be system connections and again I don’t really need that information anyway. But just in case here is the code anyway.

SELECT sys.databases.name DB_Name, request_session_id
FROM sys.dm_tran_locks
JOIN sys.databases
	ON sys.dm_tran_locks.resource_database_id = sys.databases.database_id
WHERE resource_type = 'DATABASE'
UNION ALL
SELECT 'master' DB_Name, session_id
FROM sys.dm_exec_sessions
WHERE sys.dm_exec_sessions.session_id NOT IN (
		SELECT request_session_id
		FROM sys.dm_tran_locks
		WHERE resource_type = 'DATABASE')
ORDER BY request_session_id

Pretty simple. There are a number of free blogging sites out there. Personally I use WordPress. All you need to do is go to http://www.wordpress.com and sign up for a free space.

I have a blog but setting it up seems like a lot of work.

If you are looking at the setup of mature sites (about pages, formatting, themes etc) then you are forgetting just how long those sites have been up. Start by writing a few posts, then if you feel like it, write an about page. Over time you can add more and more to your blog. Eventually it will look just as evolved as any other.

I don’t have any ideas on what to write about / I don’t have anything to say

This is the easiest one to address. If you are having a hard time coming up with something to write about then use someone else’s ideas. SQL Judo (Russ Thomas) (b/t) does a monthly challenge. Write your answer to one of those challenges. Every month we have a blog party called #tsql2sday. Originally started by Adam Machanic (b/t) each month a different blogger hosts and comes up with an idea for us all to post on. Join in. That’s two different ideas each month.

One other thing that most experienced bloggers do is keep a list of ideas. Some weeks I’ll come up with 4 or 5 ideas, other weeks none. As I come up with ideas I write them down. Then if I don’t have any idea what I want to write about that day I just refer back to my list.

I’m afraid I’ll make a mistake

Ever. Single. Time. Every time I write a new post I’m terrified I’ve made a mistake. I test everything, check against BOL and bloggers I trust and sometimes I go so far as email one or two experts to make sure I’m right. On the other hand, fear of making a mistake is just a form of stage fright. Once you’ve been writing for a bit the fear becomes easier to deal with. I mean everyone makes a mistake now and again right? It’s not really a big deal. What’s the worst that can happen? Someone puts in a comment and corrects you. Usually it’s a polite comment and you’ll learn something (and what could be better right?) I’ve heard of people putting down rude or even mean comments, but in over two years I’ve never had anyone do it to me. And even if I did get one I might be aggravated for a bit but then I would get over it pretty quickly. Sticks and stones right?

On a related note if you aren’t comfortable with your writing skills and want some help there you can submit your posts to Michael J Swart(B/T) who offers to help you become a better writer. He helped me with this post and here is a before and after example I did a while back.

I don’t have time

This is a hard one. You just have to make the time. Schedule yourself half an hour to an hour once a week to do some writing. Personally I write in the evening while my wife and her family watch TV. A long time ago I decided I wasn’t that interested in TV and there are other things I’d rather do. These days that’s reading/writing about SQL Server. But then again I’m a sad confused sort of person. For those of you with a life this is going to be a bit more difficult.

No one is going to read what I write.

I’m going to be honest here. At first, no, not too many people are going to even know you have a blog. But in time you’ll be surprised at how interested people can be in what you have to say. Try syndicating your blog to SQL Server Central and/or Toad World. Both sites are popular places to read blogs so you will end up getting a fair amount of traffic from them.

Excuses are just that. You can always find one, but if you really want to get something done there is almost always a way. If you have any other reasons you don’t feel like you can manage to write a blog but you really want to feel free to drop me a line and I’ll see what I can do to help.

So far I’ve done

• SQL Judo’s Monthly Challenge – January 2014 – Restore the Master
• SQL Judo’s Monthly Challenge – February 2014 – KILL with the DAC

 
And this time I’m doing:

March 2014 – Powershell something

An open ended challenge this month. Use PowerShell to do something involving SQL Server. The script must include at least one variable, perform a task “on the pipeline”, be able to run unattended (i.e. agent or task scheduler).

This was a hard one for me. As I mentioned above I’ve never worked with powershell before now. So step one, learn me some Powershell! Now obviously I’m not going to be able to become a powershell expert over-night. But at least I can learn the basics. Running a Powershell script, the basic commands, format etc.

Now as it happens I also have a project that I’m doing for my wife that has a few sections that PoSh (Powershell) will be perfect for. First I need to unzip all of the zip files in a given directory and then when I’m done I need to move them into an archive folder. I decided the unzip was a bit too much for me as my first script, so went and found this script: http://simon-may.com/extracting-zip-files-directory-powershell/. This script works quite well for my needs. So archiving all of the files in a given directory is my project.

So step one was to learn the basics. Like anything else there is a whole lot of mid-level information out there. It’s a bit harder to start from the beginning. I was able to find two excellent sources.

• Midnight DBAs – Jen and Sean McCown have a whole range of videos on various subjects. One of these, of course, is Powershell. They are mostly task based which makes for easy learning. There are a handful that are targeted directly to DBAs although I haven’t had a chance to read them yet.
• Steve Jones – Steve did a Powershell challenge where he documented his own introduction to Powershell. He has some great pieces on help and basic commands.

 
I haven’t finished everything from either of these sources yet, although I do plan to. Even with what I read and watched I was able to get enough to get started. It’s actually a fairly straightforward language. I did run into a few issues and got some timely help from Mike Fal (b/t) and I recommend his blog for some interesting and useful PoSh scripts.

So here is my script. The requirements were:

• Include at least one variable. I used 3 although I could have gotten away with less.
• Perform a task “on the pipeline”. If I understand this correctly it just means I pipe (|) information from one command to another. Something which is very natural to anyone used to DOS & bat files. In this particular case I’ve piped the output of Get-ChildItem to Where-Object in order to filter it, then piped the information from Where-Object to Move-Item to do the actual file move.
• Be able to run unattended (i.e. agent or task scheduler). This is actually the last piece of a much longer process all of which will run unattended.

# Specify a variable with the name of the directory holding my 
# load files.  Also create a variable with the formatted date
# that I'll use for my archive directory and last but not least
# the full path for the archive directory.
$dir = "C:\LoadFiles\"
$dateStr = Get-Date -uformat "%Y%m%d_%H%M"
$archiveDir = $dir + $dateStr

# Create the new archive directory.  The -ErrorAction Ignore 
# parameter let's me ignore the error if the directory
# already exists.  I could test for the directory first but 
# this seems easier.
New-Item -ErrorAction Ignore -ItemType directory -Path $archiveDir

# Parse through the load file directory, filter it down to just the
# text and zip files, then move them to the archive directory.
# I tried using the -include parameter but couldn't get multiple
# filters to work.
Get-ChildItem $dir | 
    Where-Object {$_.Extension -eq '.txt' -or $_.Extension -eq '.ZIP'} | 
    Move-Item -Destination $archiveDir

Anyone with any experience in PoSh will notice that I didn’t use any of the obvious aliases. This is deliberate. When learning a new language I prefer to avoid any shortcuts (like aliases) until later in my learning process. This is a personal preference and it’s entirely up to you what you do. However, in order to avoid some of the inevitable “how to do it better” comments let me point out this could also be written.

gci $dir | 
    ? {$_.Extension -eq '.txt' -or $_.Extension -eq '.ZIP'} | 
    mi -Destination $archiveDir

Or any number of other ways. Powershell is massively flexible and I can think of half a dozen ways to re-write just this one little script.

So challenge three completed! Looking forward to number four!

Changes

sp_SrvPermissions
— V5.5
— 7/22/2014 – Changed strings to unicode
— V6.0
— 10/19/2014 – Add @UserLikeSearch and @IncludeMSShipped parameters.

sp_DBPermissions
— V5.5
— 7/15/2014 – Bunch of changes recommended by Robert Davis (b/t)
     Primarily changing the strings to unicode & adding QUOTENAME in a few places
     I’d missed it.
— V6.0
— 10/19/2014 – Add @UserLikeSearch and @IncludeMSShipped parameters.

New Parameters:

@UseLikeSearch
When this is set to 1 (the default) then the search parameters will use LIKE (and
%’s will be added around the @Principal and @Role parameters).
When set to 0 searchs will use =.
@IncludeMSShipped
When this is set to 1 (the default) then all principals will be included. When set
to 0 the fixed server roles and SA and Public principals will be excluded.

Some of the common uses I put these scripts to.

I’m not sure I’ve done this before but here are a few common uses I put these SPs to.

Moving a database from one server to another:
Every now and again I need to move a database from one instance to another. This isn’t a case where I’m copying an entire instance, just one DB.

EXEC sp_SrvPermissions @DBName = 'DBName'

You can then copy out the create script (last column, first dataset) for all of the logins associated with this database. Note: In SQL 2005 because the conversion of SID from varbinary to char doesn’t work properly the SID for SQL Logins won’t be correct and once you move the DB these Users will have to be re-associated with the Logins. The passwords however will be correct.

I need to add a user to an AD group that has read only access to a specific database.
This is a common one. I need to list out all of the AD groups and their permissions to see which one is appropriate.

EXEC sp_DBPermissions 'DBName', @Role = 'G'

After reviewing the role memberships and individual permissions I create a list of possible candidates. I then need to check each of these candidates to make sure they don’t have permissions elsewhere on the instance that might be a problem. For each login name from the first dataset of the previous output I run the following scripts and review the output of the second two datasets (role memberships and individual permissions):

-- Check what server level permissions the login might have.
EXEC sp_SrvPermissions 'LoginName'
-- Check for additional permissions in other databases
EXEC sp_DBPermissions 'All', @LoginName = 'LoginName'

The reason you want to use the @LoginName parameter here is to ensure you get all users that are tied to that login. Users, as you probably already know, do not always have the same name as the Login so it’s best to do it this way.

I need to create a new user with the same permissions as a different one.
Start by pulling the permissions of the source user.

EXEC sp_DBPermissions 'All', @LoginName = 'LoginName', 
     @UserLikeSearch = 0

Copy the create scripts from each dataset and paste them into a query window. Then do a search and replace and replace all occurances of [SourceUser] with [NewUser]. You now have a script that will create the users for each database, add them to the required roles, and grant them any individual permissions required. You still have to create the login manually of course.

This is the first example I’ve used @UserLikeSearch in. Usually I’d rather get extra results and review them manually, but in this case that defies the point of making it easy. Without using @UserLikeSearch if my login is called Test I’m going to pull every user associated with Test, MyTest and User_Test.

There are any number of other uses I’ve found over the last year or two but these are some of the more common ones. Feel free to make suggestions or let me know of any bugs you find in the comments.

Feb 23, 2015
Dear Diary,
After some reading I have found the solution. I’m going to use Policy Based Management! PBM (as it’s also known) allows me to create a set of rules and then using a Central Management Server (CMS) I can push each of these Policies out to any or all of the other instances. Each Policy has to have one and only one Condition. Each of those Conditions is tied to a facet. A facet is basically an object that has properties that can be tested. So because a Policy can in the end only be tied to a single facet I will have to have a different policy/condition each for SPs, UDFs, Views and Triggers.

By preference I want my policies to use the Evaluation Mode On Change: prevent but the facets for Views and Triggers don’t appear to allow that. So instead I’m using the Evaluation Mode Schedule on them with a schedule for each night. Then I’ll evaluate the results in the morning and “fix” them. There are two other options for Evaluation Mode. On Change: log only that I don’t really need and On Demand. On Demand is one I’ll probably be using at least occasionally. All that really means is that I can evaluate the policy (or policies) when I want to.

On and in case I need it latter here is the script to generate these Conditions and Policies.

----------------------------------------------------------------------------------
-- Condition: No NOLOCK in Stored Procedure
----------------------------------------------------------------------------------
Declare @condition_id int
EXEC msdb.dbo.sp_syspolicy_add_condition @name=N'No NOLOCK in Stored Procedures', @description=N'', @facet=N'StoredProcedure', @expression=N'<Operator>
  <TypeClass>Bool</TypeClass>
  <OpType>AND</OpType>
  <Count>2</Count>
  <Operator>
    <TypeClass>Bool</TypeClass>
    <OpType>LIKE</OpType>
    <Count>2</Count>
    <Function>
      <TypeClass>String</TypeClass>
      <FunctionType>Upper</FunctionType>
      <ReturnType>String</ReturnType>
      <Count>1</Count>
      <Attribute>
        <TypeClass>String</TypeClass>
        <Name>MethodName</Name>
      </Attribute>
    </Function>
    <Constant>
      <TypeClass>String</TypeClass>
      <ObjType>System.String</ObjType>
      <Value>%NOLOCK%</Value>
    </Constant>
  </Operator>
  <Operator>
    <TypeClass>Bool</TypeClass>
    <OpType>LIKE</OpType>
    <Count>2</Count>
    <Function>
      <TypeClass>String</TypeClass>
      <FunctionType>Upper</FunctionType>
      <ReturnType>String</ReturnType>
      <Count>1</Count>
      <Attribute>
        <TypeClass>String</TypeClass>
        <Name>MethodName</Name>
      </Attribute>
    </Function>
    <Constant>
      <TypeClass>String</TypeClass>
      <ObjType>System.String</ObjType>
      <Value>%UNCOMMITTED%</Value>
    </Constant>
  </Operator>
</Operator>', @is_name_condition=0, @obj_name=N'', @condition_id=@condition_id OUTPUT
Select @condition_id
GO

---------------------------------------------------------------------------------
-- Policy: No NOLOCK in SPs
---------------------------------------------------------------------------------
Declare @object_set_id int
EXEC msdb.dbo.sp_syspolicy_add_object_set @object_set_name=N'No NOLOCK in SPs_ObjectSet', @facet=N'StoredProcedure', @object_set_id=@object_set_id OUTPUT
Select @object_set_id

Declare @target_set_id int
EXEC msdb.dbo.sp_syspolicy_add_target_set @object_set_name=N'No NOLOCK in SPs_ObjectSet', @type_skeleton=N'Server/Database/StoredProcedure', @type=N'PROCEDURE', @enabled=True, @target_set_id=@target_set_id OUTPUT
Select @target_set_id

EXEC msdb.dbo.sp_syspolicy_add_target_set_level @target_set_id=@target_set_id, @type_skeleton=N'Server/Database/StoredProcedure', @level_name=N'StoredProcedure', @condition_name=N'', @target_set_level_id=0
EXEC msdb.dbo.sp_syspolicy_add_target_set_level @target_set_id=@target_set_id, @type_skeleton=N'Server/Database', @level_name=N'Database', @condition_name=N'', @target_set_level_id=0
GO

Declare @policy_id int
EXEC msdb.dbo.sp_syspolicy_add_policy @name=N'No NOLOCK in SPs', @condition_name=N'No NOLOCK in Stored Procedures', @execution_mode=1, @is_enabled=True, @policy_id=@policy_id OUTPUT, @object_set=N'No NOLOCK in SPs_ObjectSet'
Select @policy_id
GO

----------------------------------------------------------------------------------
-- Condition: No NOLOCK in Triggers
----------------------------------------------------------------------------------
Declare @condition_id int
EXEC msdb.dbo.sp_syspolicy_add_condition @name=N'No NOLOCK in Triggers', @description=N'', @facet=N'Trigger', @expression=N'<Operator>
  <TypeClass>Bool</TypeClass>
  <OpType>AND</OpType>
  <Count>2</Count>
  <Operator>
    <TypeClass>Bool</TypeClass>
    <OpType>LIKE</OpType>
    <Count>2</Count>
    <Function>
      <TypeClass>String</TypeClass>
      <FunctionType>Upper</FunctionType>
      <ReturnType>String</ReturnType>
      <Count>1</Count>
      <Attribute>
        <TypeClass>String</TypeClass>
        <Name>MethodName</Name>
      </Attribute>
    </Function>
    <Constant>
      <TypeClass>String</TypeClass>
      <ObjType>System.String</ObjType>
      <Value>%NOLOCK%</Value>
    </Constant>
  </Operator>
  <Operator>
    <TypeClass>Bool</TypeClass>
    <OpType>LIKE</OpType>
    <Count>2</Count>
    <Function>
      <TypeClass>String</TypeClass>
      <FunctionType>Upper</FunctionType>
      <ReturnType>String</ReturnType>
      <Count>1</Count>
      <Attribute>
        <TypeClass>String</TypeClass>
        <Name>MethodName</Name>
      </Attribute>
    </Function>
    <Constant>
      <TypeClass>String</TypeClass>
      <ObjType>System.String</ObjType>
      <Value>%UNCOMMITTED%</Value>
    </Constant>
  </Operator>
</Operator>', @is_name_condition=0, @obj_name=N'', @condition_id=@condition_id OUTPUT
Select @condition_id
GO

---------------------------------------------------------------------------------
-- Policy: No NOLOCK in Triggers
---------------------------------------------------------------------------------
Declare @object_set_id int
EXEC msdb.dbo.sp_syspolicy_add_object_set @object_set_name=N'No NOLOCK in Triggers_ObjectSet', @facet=N'Trigger', @object_set_id=@object_set_id OUTPUT
Select @object_set_id

Declare @target_set_id int
EXEC msdb.dbo.sp_syspolicy_add_target_set @object_set_name=N'No NOLOCK in Triggers_ObjectSet', @type_skeleton=N'Server/Database/Table/Trigger', @type=N'TRIGGER', @enabled=True, @target_set_id=@target_set_id OUTPUT
Select @target_set_id

EXEC msdb.dbo.sp_syspolicy_add_target_set_level @target_set_id=@target_set_id, @type_skeleton=N'Server/Database/Table/Trigger', @level_name=N'Trigger', @condition_name=N'', @target_set_level_id=0
EXEC msdb.dbo.sp_syspolicy_add_target_set_level @target_set_id=@target_set_id, @type_skeleton=N'Server/Database/Table', @level_name=N'Table', @condition_name=N'', @target_set_level_id=0
EXEC msdb.dbo.sp_syspolicy_add_target_set_level @target_set_id=@target_set_id, @type_skeleton=N'Server/Database', @level_name=N'Database', @condition_name=N'', @target_set_level_id=0

EXEC msdb.dbo.sp_syspolicy_add_target_set @object_set_name=N'No NOLOCK in Triggers_ObjectSet', @type_skeleton=N'Server/Database/View/Trigger', @type=N'TRIGGER', @enabled=True, @target_set_id=@target_set_id OUTPUT
Select @target_set_id

EXEC msdb.dbo.sp_syspolicy_add_target_set_level @target_set_id=@target_set_id, @type_skeleton=N'Server/Database/View/Trigger', @level_name=N'Trigger', @condition_name=N'', @target_set_level_id=0
EXEC msdb.dbo.sp_syspolicy_add_target_set_level @target_set_id=@target_set_id, @type_skeleton=N'Server/Database/View', @level_name=N'View', @condition_name=N'', @target_set_level_id=0
EXEC msdb.dbo.sp_syspolicy_add_target_set_level @target_set_id=@target_set_id, @type_skeleton=N'Server/Database', @level_name=N'Database', @condition_name=N'', @target_set_level_id=0
GO

Declare @policy_id int
EXEC msdb.dbo.sp_syspolicy_add_policy @name=N'No NOLOCK in Triggers', @condition_name=N'No NOLOCK in Triggers', @policy_category=N'', @description=N'', @help_text=N'', @help_link=N'', 
     @schedule_uid=N'770725f7-3817-4187-a041-6fc1f846bbc4', @execution_mode=4, @is_enabled=True, @policy_id=@policy_id OUTPUT, @root_condition_name=N'', @object_set=N'No NOLOCK in Triggers_ObjectSet'
Select @policy_id
GO

----------------------------------------------------------------------------------
-- Condition: No NOLOCK in User Defined Functions
----------------------------------------------------------------------------------
Declare @condition_id int
EXEC msdb.dbo.sp_syspolicy_add_condition @name=N'No NOLOCK in User Defined Functions', @description=N'', @facet=N'UserDefinedFunction', @expression=N'<Operator>
  <TypeClass>Bool</TypeClass>
  <OpType>AND</OpType>
  <Count>2</Count>
  <Operator>
    <TypeClass>Bool</TypeClass>
    <OpType>LIKE</OpType>
    <Count>2</Count>
    <Function>
      <TypeClass>String</TypeClass>
      <FunctionType>Upper</FunctionType>
      <ReturnType>String</ReturnType>
      <Count>1</Count>
      <Attribute>
        <TypeClass>String</TypeClass>
        <Name>MethodName</Name>
      </Attribute>
    </Function>
    <Constant>
      <TypeClass>String</TypeClass>
      <ObjType>System.String</ObjType>
      <Value>%NOLOCK%</Value>
    </Constant>
  </Operator>
  <Operator>
    <TypeClass>Bool</TypeClass>
    <OpType>LIKE</OpType>
    <Count>2</Count>
    <Function>
      <TypeClass>String</TypeClass>
      <FunctionType>Upper</FunctionType>
      <ReturnType>String</ReturnType>
      <Count>1</Count>
      <Attribute>
        <TypeClass>String</TypeClass>
        <Name>MethodName</Name>
      </Attribute>
    </Function>
    <Constant>
      <TypeClass>String</TypeClass>
      <ObjType>System.String</ObjType>
      <Value>%UNCOMMITTED%</Value>
    </Constant>
  </Operator>
</Operator>', @is_name_condition=0, @obj_name=N'', @condition_id=@condition_id OUTPUT
Select @condition_id
GO

---------------------------------------------------------------------------------
-- Policy: No NOLOCK in UDFs
---------------------------------------------------------------------------------
Declare @object_set_id int
EXEC msdb.dbo.sp_syspolicy_add_object_set @object_set_name=N'No NOLOCK in UDFs_ObjectSet', @facet=N'UserDefinedFunction', @object_set_id=@object_set_id OUTPUT
Select @object_set_id

Declare @target_set_id int
EXEC msdb.dbo.sp_syspolicy_add_target_set @object_set_name=N'No NOLOCK in UDFs_ObjectSet', @type_skeleton=N'Server/Database/UserDefinedFunction', @type=N'FUNCTION', @enabled=True, @target_set_id=@target_set_id OUTPUT
Select @target_set_id

EXEC msdb.dbo.sp_syspolicy_add_target_set_level @target_set_id=@target_set_id, @type_skeleton=N'Server/Database/UserDefinedFunction', @level_name=N'UserDefinedFunction', @condition_name=N'', @target_set_level_id=0
EXEC msdb.dbo.sp_syspolicy_add_target_set_level @target_set_id=@target_set_id, @type_skeleton=N'Server/Database', @level_name=N'Database', @condition_name=N'', @target_set_level_id=0
GO

Declare @policy_id int
EXEC msdb.dbo.sp_syspolicy_add_policy @name=N'No NOLOCK in UDFs', @condition_name=N'No NOLOCK in User Defined Functions', @policy_category=N'', @description=N'', @help_text=N'', @help_link=N'', @schedule_uid=N'00000000-0000-0000-0000-000000000000', @execution_mode=1, @is_enabled=True, @policy_id=@policy_id OUTPUT, @root_condition_name=N'', @object_set=N'No NOLOCK in UDFs_ObjectSet'
Select @policy_id
GO

----------------------------------------------------------------------------------
-- Condition: No NOLOCK in Views
----------------------------------------------------------------------------------
 Declare @condition_id int
EXEC msdb.dbo.sp_syspolicy_add_condition @name=N'No NOLOCK in Views', @description=N'', @facet=N'View', @expression=N'<Operator>
  <TypeClass>Bool</TypeClass>
  <OpType>AND</OpType>
  <Count>2</Count>
  <Operator>
    <TypeClass>Bool</TypeClass>
    <OpType>LIKE</OpType>
    <Count>2</Count>
    <Function>
      <TypeClass>String</TypeClass>
      <FunctionType>Upper</FunctionType>
      <ReturnType>String</ReturnType>
      <Count>1</Count>
      <Attribute>
        <TypeClass>String</TypeClass>
        <Name>Schema</Name>
      </Attribute>
    </Function>
    <Constant>
      <TypeClass>String</TypeClass>
      <ObjType>System.String</ObjType>
      <Value>%NOLOCK%</Value>
    </Constant>
  </Operator>
  <Operator>
    <TypeClass>Bool</TypeClass>
    <OpType>LIKE</OpType>
    <Count>2</Count>
    <Function>
      <TypeClass>String</TypeClass>
      <FunctionType>Upper</FunctionType>
      <ReturnType>String</ReturnType>
      <Count>1</Count>
      <Attribute>
        <TypeClass>String</TypeClass>
        <Name>Schema</Name>
      </Attribute>
    </Function>
    <Constant>
      <TypeClass>String</TypeClass>
      <ObjType>System.String</ObjType>
      <Value>%UNCOMMITTED%</Value>
    </Constant>
  </Operator>
</Operator>', @is_name_condition=0, @obj_name=N'', @condition_id=@condition_id OUTPUT
Select @condition_id

GO

---------------------------------------------------------------------------------
-- Policy: No NOLOCK in Views
---------------------------------------------------------------------------------
Declare @object_set_id int
EXEC msdb.dbo.sp_syspolicy_add_object_set @object_set_name=N'No NOLOCK in Views_ObjectSet', @facet=N'View', @object_set_id=@object_set_id OUTPUT
Select @object_set_id

Declare @target_set_id int
EXEC msdb.dbo.sp_syspolicy_add_target_set @object_set_name=N'No NOLOCK in Views_ObjectSet', @type_skeleton=N'Server/Database/View', @type=N'VIEW', @enabled=True, @target_set_id=@target_set_id OUTPUT
Select @target_set_id

EXEC msdb.dbo.sp_syspolicy_add_target_set_level @target_set_id=@target_set_id, @type_skeleton=N'Server/Database/View', @level_name=N'View', @condition_name=N'', @target_set_level_id=0
EXEC msdb.dbo.sp_syspolicy_add_target_set_level @target_set_id=@target_set_id, @type_skeleton=N'Server/Database', @level_name=N'Database', @condition_name=N'', @target_set_level_id=0
GO

Declare @policy_id int
EXEC msdb.dbo.sp_syspolicy_add_policy @name=N'No NOLOCK in Views', @condition_name=N'No NOLOCK in Views', @policy_category=N'', @description=N'', @help_text=N'', @help_link=N'', @schedule_uid=N'770725f7-3817-4187-a041-6fc1f846bbc4', @execution_mode=4, @is_enabled=True, @policy_id=@policy_id OUTPUT, @root_condition_name=N'', @object_set=N'No NOLOCK in Views_ObjectSet'
Select @policy_id
GO

Now, you may be thinking “Won’t that be a lot of work to re-write my query each time?” No, not really. It’s actually pretty simple. Watch:

-- DELETE version
DELETE 
FROM [Sales].[Store]
WHERE [Store].[BusinessEntityID] NOT IN 
		(SELECT BusinessEntityId
		 FROM [Person].[BusinessEntityContact])
-- UPDATE version
UPDATE [Sales].[Store] SET BusinessEntityID = NULL
WHERE [Store].[BusinessEntityID] NOT IN 
		(SELECT BusinessEntityId
		 FROM [Person].[BusinessEntityContact])
-- SELECT version
SELECT * 
FROM [Sales].[Store]
WHERE [Store].[BusinessEntityID] NOT IN 
		(SELECT BusinessEntityId
		 FROM [Person].[BusinessEntityContact])

They aren’t really all that different are they? To be fair this isn’t going to catch all possible mistakes but it’s certainly going to catch some. More than enough to be worth the extra effort.

Now you can also go the other direction. Let’s say you need complex logic for a DELETE or UPDATE. Build a SELECT first. Then once your query is perfect just modify it into an UPDATE or DELETE.

When I suggest this I usually get similar concerns about the difficulty (it’s easy). I also get questions about dealing with alias’ which are somewhat common in more complex queries. Still not a problem as I discussed here and here. Believe it or not I’ve never run across a query I couldn’t easily convert between a SELECT, DELETE or UPDATE. In fact in some ways going from a SELECT to a DELETE or UPDATE is even easier than going the other way.

1. Make sure that the table you want to UPDATE or DELETE from is the table right after the FROM. You can reference it in one or more JOINs as well but it has to at least but the FROM table.

   -- Step 1
   SELECT Field1, Field2
   FROM DeleteOrUpdateTable

2. Write your SELECT to pull exactly the rows you want to DELETE or UPDATE.

   -- Step 2
   WITH MyCTE AS (SELECT Field1 FROM AnotherTable 
   		WHERE Conditions = 'True')
   SELECT Field1, Field2
   FROM DeleteOrUpdateTable DoUT
   JOIN MyCTE
   	ON DoUT.Field1 = MyCTE.Field1
   WHERE MoreConditions = 'True'

3. Delete the SELECT FieldList part of the SELECT. Note: If you have CTE(s) they will stay in the same place (at the beginning of the query). Only delete SELECT and the fieldlist.

   -- Step 3
   WITH MyCTE AS (SELECT Field1 FROM AnotherTable 
   		WHERE Conditions = 'True')
   
   FROM DeleteOrUpdateTable DoUT
   JOIN MyCTE
   	ON DoUT.Field1 = MyCTE.Field1
   WHERE MoreConditions = 'True'

4. Put DELETE/UPDATE in place of the SELECT and then the table you want to affect right after that.
   Note: If you aliased the table in the FROM clause use the alias here.
   Note 2: You can reference a CTE, to DELETE or UPDATE, under the right circumstances. I’m not sure of all the conditions but at the very least it can only reference a single table (no JOINs).

   -- Step 4
   WITH MyCTE AS (SELECT Field1 FROM AnotherTable 
   		WHERE Conditions = 'True')
   DELETE DoUT
   FROM DeleteOrUpdateTable DoUT
   JOIN MyCTE
   	ON DoUT.Field1 = MyCTE.Field1
   WHERE MoreConditions = 'True'
   -- or 
   WITH MyCTE AS (SELECT Field1 FROM AnotherTable 
   		WHERE Conditions = 'True')
   UPDATE DoUT
   FROM DeleteOrUpdateTable DoUT
   JOIN MyCTE
   	ON DoUT.Field1 = MyCTE.Field1
   WHERE MoreConditions = 'True'

5. If you are doing an UPDATE then you want to put the SET statement between the table name/alias and the FROM clause.

   -- Step 5 (Only if it's an UPDATE)
   WITH MyCTE AS (SELECT Field1 FROM AnotherTable 
   		WHERE Conditions = 'True')
   UPDATE DoUT
   	SET Field2 = 'SomeString'
   FROM DeleteOrUpdateTable DoUT
   JOIN MyCTE
   	ON DoUT.Field1 = MyCTE.Field1
   WHERE MoreConditions = 'True'

See, not hard at all. Give it a shot yourself. Do it yourself once or twice and you will realize just how easy it really is.

Nov 14, 2014
Dear Diary,
Great day! I found the problem! It even has a simple fix! (can you tell I’m excited?) Turns out there is a SP that runs hundreds of times a minute. Every now and again it’s getting compiled with a value that’s a bit skewed. It means the SP runs just a little bit slower but that makes all the difference. I suggested adding OPTIMIZE FOR UNKNOWN to the queries in the SP and it should fix the problem.

Nov 17, 2014
Dear Diary,
No word on the changes yet but I’m sure they will be done testing soon. It’s not like the changes can cause the data to be different. It shouldn’t be all that hard to test. I can’t wait. It will be awesome to not have to worry about this problem anymore.

Nov 28, 2014
Dear Diary,
Still no word on the code changes I suggested. Last time this happened they decided it was to much work to test and they wouldn’t bother.

Dec 18, 2014
Dear Diary,
(*#*&%^(#$(%)^#*@
I got a response back. And I quote “I tested it but didn’t get a performance improvement. Here are the changes we will put in.”
They ^#*$(% added NOLOCK to each of the table references.

Dec 19, 2014
Dear Diary,
Oh for the love of …. Not only did they add NOLOCK everywhere they already had SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED at the beginning of the SP. Good thing I’m going on vacation in the next few days and can cool off.

Jan 10, 2015
Dear Diary,
I just went back and looked and they are setting the isolation level to READ UNCOMMITTED at the beginning of 90% of the code in this @*#&$ database. I’m even finding NOLOCK on temporary tables! These people have absolutely no idea what they are doing.

Jan 20, 2015
Dear Diary,
This will fix them! From now on they won’t be able to create or alter any code with NOLOCK or UNCOMMITTED in them. The HAL 0001 was just for fun. But now, I give you .. The HAL 0002!

CREATE TRIGGER HAL0002
ON DATABASE
FOR CREATE_PROCEDURE, ALTER_PROCEDURE,
	CREATE_FUNCTION, ALTER_FUNCTION,
	CREATE_VIEW, ALTER_VIEW,
	CREATE_TRIGGER, ALTER_TRIGGER
AS 
	IF EVENTDATA().value('(/EVENT_INSTANCE/ObjectName)[1]',  'NVARCHAR(255)') != 'HAL0002'
	BEGIN
		IF EVENTDATA().value('(/EVENT_INSTANCE/TSQLCommand/CommandText)[1]','nvarchar(max)') LIKE '%NOLOCK%'
		BEGIN
			PRINT 'No, you may not use NOLOCK.  No, not even for that.'
			ROLLBACK
		END
		IF EVENTDATA().value('(/EVENT_INSTANCE/TSQLCommand/CommandText)[1]','nvarchar(max)') LIKE '%UNCOMMITTED%'
		BEGIN
			PRINT 'READ UNCOMMITTED is just as bad as NOLOCK.  No, just no.'
			ROLLBACK
		END
	END
GO

Continued in Part 2

SQL Server Security by the Community

Chapter 1 – Overview

Sebastian Meine (b/t)
Sebastian freaked me out for a second with his frightening blog title You’ve been hacked! This is at once a frightening overview of why we need security and a high level overview of how to fix it. I particularly like the onion.

Edwin M Sarmiento (b/t)
I have only one thing to say about Edwin’s post. What do we frequently forget? The Human Factor.

Chapter 2 – Physical Security

Paul Randal (b/t)
Paul picked a topic I don’t see very often. Securing the data technologically is important. And you certainly don’t want to forget the human factor. But to be truly secure you also can’t forget the physical side of security.

Chapter 3 – Database Engine Security

Section 1 – Privileged accounts

Boris Hristov (b/t)
Boris’ post on managing security discusses that all too common horror story of a vendor that requires sysadmin permissions. He then moves on to discuss the risk of NT Authority\SYSTEM. (And if you don’t already know what that risk is you really need to read this one.)

Andrea Allred (b/t)
Andrea may be known for her princess gowns and sweet demeanor but based on her first official T-SQL Tuesday post she doesn’t need any Prince Charming to step in and save her servers. Her advice is actually something I’d read about recently and I really love the idea. If you’ve ever wondered what to do to protect yourself from malicious use of sa you need to read her post.

Kenneth Fisher (me)(b/t)
For my own contribution I discussed the reality of denying permissions to db_owner vs dbo.

Jason Brimhall (b/t)
As the SQLRNNR Jason delivered a few quick (get it runner/quick?) but very effective case studies on the over use of privileged accounts.

Section 2 – Using roles

Steve Jones (b/t)
Using database roles has been considered a best practice as far back as I can remember. In his post Steve gives us an example from his past of why this is so important and the steps they took to implement it.

Jim Dorame (b/t)
In another take on roles Jim takes his grouping layer out to the server itself.

Section 3 – Dealing with Logins

Robert Pearl (b/t)
Robert mentions a couple of very handy bits of security information. First, if you are using SQL authenticated logins there are some settings you had better be aware of. And second he gives us some handy T-SQL for looking at the current status of the logins on a server. It also turns out that Robert’s upcoming book (quick plug here) HealthySQL will contain even more security goodness.

Mike Fal (b/t)
Mike discusses setting your default database as a good best practice (and I tend to agree). Is anyone surprised that he decided to give us a powershell script to change it?

Section 4 – Coding

Rob Farley (b/t)
Rob discusses SQL Injection in his excellent post SQL Injection – the golden rule. In it he describes a way to think about SQL injection that makes it much easier to tell if you are vulnerable and to avoid that vulnerability in the first place.

Section 5 – Monitoring

Daniel Mellor (b/t)
Using Policy Based Management to review your security setup is something I’ve been looking at recently myself. In Daniel’s post on the subject he answered one of my current questions and has set me on the road to solving something that has been bugging me. Expect to hear tweets on the subject Daniel. I should also mention this is his first time joining us on T-SQL Tuesday. So thanks for joining in!

Section 6 – HA & DR

Warwick Rudd (b/t)
Are you using AlwaysOn Availability Groups? If so you need to read Warwick’s post on making sure the security of your replicas continues to work when you fail over.

Angela Henry (b/t)
A server going down is never fun. When that server is your payroll server and you are on a hard deadline it’s even worse. Angela relates a “somewhat embellished” story from her own career and the security ramifications of restoring your databases on a new server.

Chapter 4 – BI security (SSAS & SSIS)

Koen Verbeeck (b/t)
One aspect of security that tends to trip up DBAs and developers alike is that of the SSIS protection levels. Koen’s post gives a great rundown of the protection levels for SSIS packages and when to use each. He also keeps us up to date by going over some of the changes made to this aspect of SSIS in 2012.

Jens Vestergaard (b/t)
In Jens’ debut T-SQL Tuesday post (way to go Jens) he gives us a rundown on SSAS security and a tool called Forefront Identity Manager that can be used to manage it.

Capter 5 – Key Management

Russ Thomas (b/t)
Russ gives us a great breakdown on why EKM (Extensible Key Management) is probably part of our future.

Summary

Chris Yates (b/t)
In summary security is something with a lot of moving parts that we have to pay attention to. There is a mindset needed to keep your data secure and Chris Yates does a great job letting us know where our heads should be when it comes to security.

So can you deny a permission to a member of the db_owner role? Yep, appears you can. I’d always believed this was true myself but a simple test proves this wrong.

USE master
GO
CREATE LOGIN Kenneth_DBO WITH PASSWORD = 'Ken', CHECK_POLICY = OFF;
GO
USE Test
GO
CREATE TABLE DenyTest (Id int);
INSERT INTO DenyTest VALUES (1),(2),(3);
CREATE USER Kenneth_DBO FROM LOGIN Kenneth_DBO;
EXEC sp_addrolemember 'db_owner','Kenneth_DBO';
DENY SELECT ON DenyTest TO Kenneth_DBO;
GO

Now log in as Kenneth_DBO and run this test.

USE Test
GO
SELECT * FROM sys.user_token;
SELECT * FROM sys.fn_my_permissions('DenyTest','object');
GO
SELECT * FROM DenyTest;
GO
DELETE FROM DenyTest;
GO

Notice that sys.user_token shows we are indeed a member of db_owner. When we look at sys.fn_my_permissions for DenyTest, however, it shows lot’s of permissions but SELECT is not one of them. This should mean that the select permission isn’t there, but you never know until you try it out.

-- Try to SELECT
Msg 229, Level 14, State 5, Line 2
The SELECT permission was denied on the object 'DenyTest', database 'Test2012', schema 'dbo'.
-- Try to DELETE

(3 row(s) affected)

When look at the output you notice that the SELECT was indeed denied but the DELETE worked just fine.

So why the myth in the first place? Well sysadmin can not be denied anything, and neither can dbo. I can just hear someone saying “Uh wait just a minute here. You showed that db_owner CAN be denied. Be consistent dude!” Well I am being consistent. The actual owner of the database (dbo) is different from a member of the db_owner role. Of course the only differences I know is that there can only be one dbo and it can’t be denied anything while there can be multiple members of the db_owner role and it can be denied.

But I don’t want you to take my word for it, we need an example!

First of all we have to remove the user Kenneth_Test from the database. The dbo cannot already be a principal in the database. That would mean the same SID would be used for two different database principals, and that’s not allowed. Next use sp_changedbowner to set Kenneth_DBO to be the DBO.

USE Test
GO
DROP USER Kenneth_DBO;
GO
EXEC sp_changedbowner 'Kenneth_DBO';
GO

Next we try to DENY Kenneth_DBO.

DENY SELECT ON DenyTest TO Kenneth_DBO;

and we get an error.

Msg 15151, Level 16, State 1, Line 11
Cannot find the user 'Kenneth_DBO', because it does not exist or you do not have permission.

Wondering why? It’s because the principal Kenneth_DBO doesn’t exist. We assigned it to dbo. If you are interested you can prove it with this query.

SELECT Logins.name AS Login_Name, Users.name AS User_Name
FROM sys.server_principals Logins
JOIN sys.database_principals Users
	ON Logins.sid = Users.sid
WHERE Logins.name = 'Kenneth_DBO';

So let’s try to DENY dbo.

DENY SELECT ON DenyTest TO dbo;

This time we get the very self explainitory error:

Cannot grant, deny, or revoke permissions to sa, dbo, entity owner, information_schema, sys, or yourself.

So there you go. You can DENY a permission to members of the db_owner role, but not to the database owner.