使用DBATools PowerShell修复SQL Server中的孤立用户

This article gives an overview of Orphan users and fixing them using DBATools PowerShell.

本文概述了Orphan用户，并使用DBATools PowerShell对其进行了修复。

孤儿用户概述 (Overview of Orphan Users)

In every organization, we have multiple database environments such as Production, UAT, QA, Test, and Development. We do not have live data in an environment other than production. Usually, a DBA gets a request to refresh lower environments with the recent production database backup. It helps to validate any application release before deploying in production.

在每个组织中，我们都有多个数据库环境，例如生产，UAT，QA，测试和开发。除了生产以外，我们没有其他实时数据。通常，DBA会收到使用最新生产数据库备份刷新较低环境的请求。它有助于在生产环境中部署之前验证所有应用程序版本。

Once we take Production database backup and restore it into lower environments, we get the issue of Orphan users. You can also get this error in moving the database with Detach and Attach method also. Sometimes you can database online, but application users cannot access it.

一旦进行了生产数据库备份并将其还原到较低的环境中，就会遇到孤立用户的问题。您还可以通过使用“分离”和“附加”方法来移动数据库时出现此错误。有时您可以在线数据库，但应用程序用户无法访问它。

In my earlier articles SQL Database Backups using PowerShell Module – DBATools and SQL Restore Database using DBATools, we explored SQL database backup and restored using open-source DBATools PowerShell.

在我以前的文章中，使用PowerShell模块SQL数据库备份– DBATools和使用DBAToolsSQL还原数据库，我们探讨了SQL数据库备份和使用开源DBATools PowerShell进行还原。

Recently I restored database from SQL instance ( .\SQlExpress) to another SQL instance (.\SQL2019CTP) . Once the application users try to access the database, it gave the following error.

最近，我将数据库从SQL实例（。\ SQlExpress）还原到另一个SQL实例（。\ SQL2019CTP）。一旦应用程序用户尝试访问数据库，它将产生以下错误。

Let’s troubleshoot it further. In the following screenshot, you can see a connection to destination SQL instance (.\SQL2019CTP). It shows that SQLDB login exists there.

让我们进一步解决它。在以下屏幕截图中，您可以看到到目标SQL实例（。\ SQL2019CTP）的连接。它显示那里存在SQLDB登录。

Right click on login and provide db_datareader role in SQLDB database.

右键单击登录并在SQLDB数据库中提供db_datareader角色。

Click Ok, and you get another error. We get error 15023 that means user already exists in the SQLDB database, but still we cannot provide any permission to the user to access this database.

单击确定，您会收到另一个错误。我们收到错误15023，这意味着该用户已经存在于SQLDB数据库中，但是仍然不能向该用户提供任何访问该数据库的权限。

We get the errors due to the Orphan users issue in our database environment. We will look at resolving it with DBATools PowerShell. First, we will get a quick overview of Orphan users.

由于数据库环境中的“孤立用户”问题，我们得到了错误。我们将研究使用DBATools PowerShell解决它。首先，我们将快速了解Orphan用户。

In SQL Server, a database user is linked to a SQL Server login. A database user and SQL Server logins link with each other using SID’s.

在SQL Server中，数据库用户链接到SQL Server登录名。数据库用户和SQL Server登录名使用SID相互链接。

We might issue with logins in the following scenarios.

在以下情况下，我们可能会出现登录问题。

In SQL Server, we can check the Orphan user in a database with stored procedure sp_change_users_login. Execute this query in our database, and we can see Orphan user.

在SQL Server中，我们可以使用存储过程sp_change_users_login检查数据库中的Orphan用户。在我们的数据库中执行此查询，我们可以看到孤立用户。

exec sp_change_users_login @Action='Report' ;
GO

使用DBATools PowerShell模块修复孤立的用户 (Fix Orphan users using DBATools PowerShell module)

DBATools is a powerful PowerShell Module that contains useful functions to do administrative tasks with minimum efforts. We can check all commands related to a particular keyword in DBATools PowerShell using Get-help command.

DBATools是功能强大的PowerShell模块，其中包含有用的功能，可以以最少的工作量执行管理任务。我们可以使用Get-help命令在DBATools PowerShell中检查与特定关键字相关的所有命令。

Note: In this article, I am using an integrated terminal of Azure Data Studio to execute DBATools command. You can also use the Windows PowerShell console to execute these as well.
注意 ：在本文中，我正在使用Azure Data Studio的集成终端来执行DBATools命令。 您也可以使用Windows PowerShell控制台执行这些操作。

Let’s check command related to keyword Orphan.

让我们检查与关键字Orphan相关的命令。

>Get-help *Orphan*

Once we restore SQL database in another instance, we can get a list of orphan users with Get-DbaDbOrphanUser command. We should always check the syntax description of a particular command before using it.

在另一个实例中还原SQL数据库后，可以使用Get-DbaDbOrphanUser命令获取孤儿用户列表。在使用特定命令之前，我们应始终检查其语法描述。

>Get-help Get-DbaDbOrphanUser

DBATools PowerShell中Get-DbaDbOrphanUser的语法 (The syntax of Get-DbaDbOrphanUser in DBATools PowerShell)

Get-DbaDbOrphanUser [-SqlInstance] <DbaInstanceParameter[]> [[-SqlCredential] <PSCredential>] [[-Database]     <Object[]>] [[-ExcludeDatabase] <Object[]>] [-EnableException] [<CommonParameters>]

Let’s execute this command in my earlier example. In the following command, it checks orphan users in all online databases in SQL instance.

让我们在前面的示例中执行此命令。在以下命令中，它将检查SQL实例中所有联机数据库中的孤立用户。

> Get-DbaDbOrphanUser -SqlInstance Kashish\SQL2019CTP

In the output, we can see that we have orphan user SQLDB in the database SQLDB.

在输出中，我们可以看到，我们在数据库SQLDB孤儿用户SQLDB。

Suppose we want to check Orphan users in a specified database only. We can execute command Get-DbaDbOrphanUser on a specified database with -Database parameter.

假设我们只想检查指定数据库中的孤立用户。我们可以使用-Database参数在指定的数据库上执行命令Get-DbaDbOrphanUser 。

> Get-DbaDbOrphanUser -SqlInstance Kashish\SQL2019CTP -Database SQLDB

We can use another DBATools PowerShell function Repair-DbaDbOrphanUser to fix Orphan users in SQL Server.

我们可以使用另一个DBATools PowerShell函数Repair-DbaDbOrphanUser来修复SQL Server中的孤立用户。

DBATools PowerShell中的Repair-DbaDbOrphanUser命令 (Repair-DbaDbOrphanUser command in DBATools PowerShell)

> Get-help Repair-DbaDbOrphanUser

It helps to find Orphan users and fix them with remap of their SID’s.

它有助于查找孤儿用户并通过重新映射他们的SID来修复他们。

We can use the following query to fix all orphan users in SQL instance.

我们可以使用以下查询来修复SQL实例中的所有孤立用户。

> Repair-DbaDbOrphanUser -SqlInstance kashish\sql2019CTP

Once we run this command, it remaps the SID’s and fixes the orphan users.

一旦运行此命令，它将重新映射SID并修复孤立的用户。

We can run Get-DbaDbOrphanUser to check if an orphan user still exists in SQLDB or not. We do not get any records this time. It shows we do not have any Orphan users in the SQLDB.

我们可以运行Get-DbaDbOrphanUser来检查SQLDB中是否仍然存在孤立用户。这次我们没有任何记录。它表明我们在SQLDB中没有任何孤立用户。

We can verify it again with system stored procedure sp_change_users_login. We do not get any records for orphan users.

我们可以使用系统存储过程sp_change_users_login再次进行验证。我们没有任何孤立用户的记录。

We can see a few more use cases of Repair-DbaDbOrphanUser.

我们可以看到更多的Repair-DbaDbOrphanUser用例。

Fix Orphan user for a specific database

修复特定数据库的孤立用户

> Repair-DbaDbOrphanUser -SqlInstance kashish\sql2019CTP -Database DB1

Fix Orphan user for multiple databases

修复多个数据库的孤立用户

> Repair-DbaDbOrphanUser -SqlInstance kashish\sql2019CTP -Database DB1,DB2

Fix Orphan users for a specific database and specific user

修复孤立用户的特定数据库和特定用户

> Repair-DbaDbOrphanUser -SqlInstance kashish\sql2019CTP -Database DB1,DB2 -Users OrphanUser

Now, right click on the SQLDB user and go to properties. Previously, we do not see any mapping of SQLDB users in this database. It does not show any existing permissions in SQLDB database. We could not modify permissions as well.

现在，右键单击SQLDB用户并转到属性。以前，我们在此数据库中看不到任何SQLDB用户映射。它在SQLDB数据库中不显示任何现有权限。我们也无法修改权限。

In the following screenshot, we can see user SQLDB is having db_datareader permission in SQLDB database.

在下面的屏幕快照中，我们可以看到用户SQLDB在SQLDB数据库中具有db_datareader权限。

Let us try to give db_datareader permission as well.

让我们尝试给予db_datareader权限。

SID for a database user and SQL login should be similar to prevent any orphan user issues. We can query system tables sys .server_principals and sys.database_principals to check the SID.

数据库用户的SID和SQL登录名应相似，以防止出现任何孤立用户问题。我们可以查询系统表sys .server_principals和sys.database_principals来检查SID。

Execute the following queries and compare the SID of server principal and database principal.

执行以下查询，并比较服务器主体和数据库主体的SID。

select principal_id,[sid],name
from sys.server_principals
where name='SQLDB'
Go
select [sid],name
from sys.database_principals
where name='SQLDB'

In the following screenshot, we can see there is similar SID on server principal and database principal for SQLDB user. It is the reason SQL does not treat this as an orphan user.

在下面的屏幕截图中，我们可以看到SQLDB用户的服务器主体和数据库主体上都有类似的SID。这就是SQL不将其视为孤立用户的原因。

Before we move further with other DBATools PowerShell commands for Orphan users, prepare the environment with the following steps.

在我们继续为孤儿用户使用其他DBATools PowerShell命令之前，请按照以下步骤准备环境。

Drop SQLDB user from destination SQL instance 从目标SQL实例中删除SQLDB用户
Drop existing SQLDB database from destination SQL instance 从目标SQL实例中删除现有SQLDB数据库
Restore SQLDB database again 再次还原SQLDB数据库

We can verify that Orphan user exists in SQLDB database in Kashish\SQL2019CTP instance.

我们可以验证Kashish \ SQL2019CTP实例中SQLDB数据库中是否存在孤立用户。

DBATools PowerShell中的Remove-DbaDbOrphanUser (Remove-DbaDbOrphanUser in DBATools PowerShell)

We might want to drop existing Orphan users in our database. It is simple to drop the orphan users; however if it owns the database objects, we cannot drop it. We need to remap the ownership of all objects for the orphan user to another DB user.

我们可能想在数据库中删除现有的Orphan用户。删除孤立用户很简单；但是，如果它拥有数据库对象，则不能删除它。我们需要将孤立用户的所有对象的所有权重新映射到另一个DB用户。

If our earlier example, we do not have any objects ownership for SQLDB users. We can drop it using DBATool command Remove-DbaDbOrphanUser.

如果是前面的示例，则我们对SQLDB用户没有任何对象所有权。我们可以使用DBATool命令Remove-DbaDbOrphanUser删除它。

As stated earlier, we should check the syntax and parameters before using a command in PowerShell.

如前所述，在PowerShell中使用命令之前，我们应该检查语法和参数。

> get-help Remove-DbaDbOrphanUser

In the following command, we want to remove all orphan users from Kashish\SQL2019CTP instance.

在以下命令中，我们要从Kashish \ SQL2019CTP实例中删除所有孤立用户。

> Remove-DbaDbOrphanUser -SqlInstance Kashish\SQL2019CTP

It does not give any execution message. It moves the cursor to next line once command execution finish.

它不提供任何执行消息。命令执行完成后，它将光标移至下一行。

Now, connect to SQL instance and expand Databases. In the SQLDB database, expand Security.

现在，连接到SQL实例并展开数据库。在SQLDB数据库中，展开“安全性”。

We do not see any database user SQLDB in this database. We have removed it using Remove-DbaDbOrphanUser DBATool command.

我们在该数据库中看不到任何数据库用户SQLDB 。我们已使用Remove-DbaDbOrphanUser DBATool命令将其删除。

We can use -Force parameter to drop Orphan users even if they have matching login in SQL instance. If the users own any schema or objects, ownership of those gets changed to dbo.

即使在SQL实例中具有匹配的登录名，我们也可以使用-Force参数删除孤立的用户。如果用户拥有任何模式或对象，则这些对象的所有权将更改为dbo。

Let’s perform a demo to view this scenario. First, prepare the environment with the following steps.

让我们执行一个演示以查看这种情况。首先，按照以下步骤准备环境。

SQLDB user. In database security, right click on schema and create a new schema SQLDB用户。在数据库安全性中，右键单击架构并创建一个新架构
Once we have restored the database, we should see orphan user SQLDB again.

还原数据库后，我们应该再次看到孤立用户SQLDB。

Let’s try to drop orphan user using Remove-DbaDbOrphanUser command. Earlier, we created a schema in the source database, but that schema does not own any table or objects. Once we execute DBATools PowerShell command to remove orphan user, it assigns the ownership of particular schema to dbo and drops the orphan user.

让我们尝试使用Remove-DbaDbOrphanUser命令删除孤立的用户。之前，我们在源数据库中创建了一个架构，但是该架构不拥有任何表或对象。一旦执行DBATools PowerShell命令以删除孤立用户，它就会将特定模式的所有权分配给dbo并删除该孤立用户。

We can see a warning message in the output Schema ‘Test’ does not have any underlying object. Ownership will be changed to ‘dbo’ so the user can be dropped. Remember to re-check permissions on this schema!

我们可以在输出模式“测试”中看到一条警告消息，其中没有任何基础对象。 所有权将更改为“ dbo”，因此可以删除用户。 切记要重新检查对此架构的权限！

You can see the owner of the schema is changed to dbo.

您可以看到架构的所有者已更改为dbo。

Let’s drop the database again from the destination SQL instance. We need to prepare the environment again with the following steps

让我们再次从目标SQL实例中删除数据库。我们需要通过以下步骤再次准备环境

Create a table in the Test schema and insert some records in it 在测试模式中创建一个表，并在其中插入一些记录
Take database backup and restore it on the destination SQL instance 进行数据库备份并将其还原到目标SQL实例上

Once we have restored the database, try to drop Orphan user again with Remove-DbaDbOrphanuser command. We cannot drop this orphan user because it owns an object in the database.

恢复数据库后，尝试使用Remove-DbaDbOrphanuser命令再次删除 Orphan用户。我们不能删除该孤立用户，因为它在数据库中拥有一个对象。

Either we need to change the ownership of the object to another user, or we can use -Force parameter to do so. It removes the orphan user by assigning permissions to the dbo user. In the following screenshot, we can see the action Alter owner.

我们需要将对象的所有权更改为另一个用户，或者可以使用-Force参数来执行此操作。它通过为dbo用户分配权限来删除孤立用户。在以下屏幕截图中，我们可以看到操作Alter owner。

We can verify it from schema properties. It shows schema owner as dbo.

我们可以从架构属性中进行验证。它显示架构所有者为dbo。

结论 (Conclusion)

In this article, we explored significant usage of DBATools PowerShell command. We should fix orphan users after database restoration. I hope you liked this article. We will cover more on DBATools command in future articles.

在本文中，我们探索了DBATools PowerShell命令的重要用法。数据库还原后，我们应该修复孤立的用户。希望您喜欢这篇文章。在以后的文章中，我们将详细介绍DBATools命令。

目录 (Table of contents)

DBATools PowerShell Module for SQL Server

PowerShell SQL Server Validation Utility – DBAChecks

SQL Database Backups using PowerShell Module – DBATools

IDENTITY columns threshold using PowerShell SQL Server DBATools

DBATools PowerShell SQL Server Database Backups commands

SQL Restore Database using DBATools

Validate backups with SQL restore database operations using DBATools

Fix Orphan users in SQL Server using DBATools PowerShell

Creating a SQL Server Database using DBATools

Get SQL Database details using DBATools

Get-DbaHelpIndex command in DBATools

适用于SQL Server的DBATools PowerShell模块

PowerShell SQL Server验证实用程序– DBAChecks

使用PowerShell模块SQL数据库备份– DBATools

使用PowerShell SQL Server DBATools的IDENTITY列阈值

DBATools PowerShell SQL Server数据库备份命令

使用DBAToolsSQL Restore Database

使用DBATools通过SQL恢复数据库操作验证备份

使用DBATools PowerShell修复SQL Server中的孤立用户

使用DBATools创建SQL Server数据库

使用DBATools获取SQL数据库详细信息

DBATools中的Get-DbaHelpIndex命令

翻译自: https://www.sqlshack.com/fix-orphan-users-in-sql-server-using-dbatools-powershell/