Søren Eggert Lundsteen Olsen
4ebae4efe6
One place recognises AX (version 3.0/4.0/2009/2012/2012 R2/F&O, schema owner, model store) from metadata only. Per-version adapters hold all table/column knowledge, check every column in sys.columns before use and degrade to 'ikke målbar' with the exact column or the exact GRANT text. Only AX 3.0 is verified against a real customer schema; 2009/2012 are written from Microsoft's documented schema (docs/dynamics-ax/*.documented.tsv, replaced by a real export when one is dropped in). grant-dynamics-ax-read.sql is version- and schema-aware (bmssa) and covers exactly the adapters' tables. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
48 lines
2.1 KiB
Transact-SQL
48 lines
2.1 KiB
Transact-SQL
/*
|
|
SQLInsight Pro: fjern den valgfri læseadgang til Dynamics AX' systemtabeller
|
|
==============================================================================
|
|
|
|
Fjerner det, grant-dynamics-ax-read.sql gav, i én AX-database: SELECT på AX' batch-, nummerserie-, RecId- og
|
|
firmatabeller. Agentens database-bruger slettes ikke (den kan være oprettet af grant-least-privilege.sql). Bagefter
|
|
viser SQLInsight AX-datatjekkene som "ikke målbar" med den GRANT, der skal til for at slå dem til igen.
|
|
|
|
Understøtter SQL Server 2005 og nyere. Kør som sysadmin eller som db_owner/db_securityadmin i AX-databasen.
|
|
*/
|
|
SET NOCOUNT ON;
|
|
|
|
DECLARE @DatabaseName sysname;
|
|
DECLARE @LoginName sysname;
|
|
SET @DatabaseName = N'AXDB'; -- <== ret til AX-databasen
|
|
SET @LoginName = N'DOMÆNE\svc-sqlinsight$'; -- <== ret til agentens login
|
|
|
|
IF DB_ID(@DatabaseName) IS NULL
|
|
BEGIN
|
|
RAISERROR(N'Databasen %s findes ikke.', 16, 1, @DatabaseName);
|
|
RETURN;
|
|
END;
|
|
|
|
DECLARE @Procedure nvarchar(300);
|
|
DECLARE @Sql nvarchar(max);
|
|
SET @Procedure = QUOTENAME(@DatabaseName) + N'.sys.sp_executesql';
|
|
SET @Sql = N'
|
|
SET NOCOUNT ON;
|
|
DECLARE @user sysname;
|
|
DECLARE @revoke nvarchar(max);
|
|
DECLARE @count int;
|
|
SELECT @user = name FROM sys.database_principals WHERE sid = SUSER_SID(@login);
|
|
IF @user IS NULL
|
|
BEGIN
|
|
PRINT N''Login''''et har ingen bruger i '' + DB_NAME() + N''. Intet at fjerne.'';
|
|
RETURN;
|
|
END;
|
|
|
|
SET @revoke = N'''';
|
|
SET @count = 0;
|
|
SELECT @revoke = @revoke + N''REVOKE SELECT ON '' + QUOTENAME(s.name) + N''.'' + QUOTENAME(t.name) + N'' FROM '' + QUOTENAME(@user) + N''; '', @count = @count + 1
|
|
FROM sys.tables t
|
|
JOIN sys.schemas s ON s.schema_id = t.schema_id
|
|
WHERE UPPER(t.name) IN (N''BATCH'', N''BATCHJOB'', N''BATCHJOBHISTORY'', N''NUMBERSEQUENCETABLE'', N''NUMBERSEQUENCESCOPE'',
|
|
N''NUMBERSEQUENCEREFERENCE'', N''SYSTEMSEQUENCES'', N''SQLDICTIONARY'', N''DATAAREA'');
|
|
IF @count > 0 EXEC (@revoke);
|
|
PRINT N''SELECT fjernet på '' + CAST(@count AS nvarchar(10)) + N'' AX-tabeller i '' + DB_NAME() + N'' for '' + @user + N''.'';';
|
|
EXEC @Procedure @Sql, N'@login sysname', @login = @LoginName;
|