Sql-server – How to create new users for restored databases

sql serversql-server-2008

I am not too familiar with SQL Server and am facing the following problem: The server was freshly installed and the only existing login is sa.

Then a couple of databases were restored from earlier backups.

Now I'd like to run a few SQL scripts that create new users for these databases, running as sa, but am getting the message that I am not allowed to do this.

Best Answer

This means that database users have no matching server logins.

That is, each database sys.database_principals has no match in sys.server_principals

For Windows logins this is easy. This generates your missing CREATE LOGINS

USE MyDB
SELECT
    'CREATE LOGIN ' + QUOTENAME(SUSER_SNAME(sid)) + ' FROM WINDOWS'
FROM
    sys.database_principals DP
WHERE
    DP.type IN ('G', 'U')
    AND 
    NOT EXISTS (SELECT * FROM sys.server_principals SP WHERE SP.sid = DP.sid);

For SQL Logins, you need to recreate it with the correct SID.

SELECT 
    'CREATE LOGIN ' + QUOTENAME(DP.name) + 
                ' WITH PASSWORD = ''ChangeMe'', SID = ' + 
                CONVERT(varchar(128), sid, 1)
FROM
    sys.database_principals DP
WHERE
    DP.type = 'S' AND DP.principal_id > 4 
    AND 
    NOT EXISTS (SELECT * FROM sys.server_principals SP WHERE SP.sid = DP.sid);

Note that sp_change_users_login is deprecated.

Now, if your SQL Logins already exist, then the names match but the sid values are different. For this you use ALTER USER use the LOGIN option.

Finally, the SQL Login passwords can be recreated if you have a backup of the "old" master database. If you restore this as, say, FixLogins then you can use this

SELECT 
    'CREATE LOGIN ' + QUOTENAME(DP.name) + 
                ' WITH PASSWORD = ' + CONVERT(varchar(256), SL.password_hash, 1) + ' HASHED, SID = ' + 
                CONVERT(varchar(128), DP.sid, 1)

FROM
    sys.database_principals DP
    JOIN
    FixLogins.sys.sql_logins SL ON DP.sid = SL.sid  
WHERE
    DP.type = 'S' AND DP.principal_id > 4 
    AND 
    NOT EXISTS (SELECT * FROM sys.server_principals SP WHERE SP.sid = DP.sid);
Related Question