Skip to content

Commit 6487f33

Browse files
Montro1981Montro1981
committed
#3377 Expanded msdb permission checks
1 parent 4bb747a commit 6487f33

File tree

1 file changed

+123
-11
lines changed

1 file changed

+123
-11
lines changed

‎sp_Blitz.sql‎

Lines changed: 123 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,10 @@ AS
196196
,@SkipXPFixedDrives bit = 0
197197
,@SkipXPCMDShell bit = 0
198198
,@SkipMaster bit = 0
199-
,@SkipMSDB bit = 0
199+
,@SkipMSDB_objs bit = 0
200+
,@SkipMSDB_jobs bit = 0
201+
,@SkipMSDB_alerts bit = 0
202+
,@SkipMSDB_operators bit = 0
200203
,@SkipModel bit = 0
201204
,@SkipTempDB bit = 0
202205
,@SkipValidateLogins bit = 0
@@ -379,7 +382,7 @@ AS
379382
END;
380383
END;
381384

382-
IF ISNULL(@SkipMSDB, 0) != 1 /*If @SkipMSDB hasn't been set to 1 by the caller*/
385+
IF ISNULL(@SkipMSDB_objs, 0) != 1 /*If @SkipMSDB_objs hasn't been set to 1 by the caller*/
383386
BEGIN
384387
IF EXISTS
385388
(
@@ -395,16 +398,103 @@ AS
395398
FROM msdb.sys.objects
396399
)
397400
BEGIN
398-
SET @SkipMSDB = 0; /*We have read permissions in the msdb database, and can view the objects*/
401+
SET @SkipMSDB_objs = 0; /*We have read permissions in the msdb database, and can view the objects*/
399402
END;
400403
END TRY
401404
BEGIN CATCH
402-
SET @SkipMSDB = 1; /*We have read permissions in the msdb database ... oh wait we got tricked, we can't view the objects*/
405+
SET @SkipMSDB_objs = 1; /*We have read permissions in the msdb database ... oh wait we got tricked, we can't view the objects*/
403406
END CATCH;
404407
END;
405408
ELSE
406409
BEGIN
407-
SET @SkipMSDB = 1; /*We don't have read permissions in the msdb database*/
410+
SET @SkipMSDB_objs = 1; /*We don't have read permissions in the msdb database*/
411+
END;
412+
END;
413+
414+
IF ISNULL(@SkipMSDB_jobs, 0) != 1 /*If @SkipMSDB_jobs hasn't been set to 1 by the caller*/
415+
BEGIN
416+
IF EXISTS
417+
(
418+
SELECT 1/0
419+
FROM @db_perms
420+
WHERE database_name = N'msdb'
421+
)
422+
BEGIN
423+
BEGIN TRY
424+
IF EXISTS
425+
(
426+
SELECT 1/0
427+
FROM msdb.dbo.sysjobs
428+
)
429+
BEGIN
430+
SET @SkipMSDB_jobs = 0; /*We have read permissions in the msdb database, and can view the objects*/
431+
END;
432+
END TRY
433+
BEGIN CATCH
434+
SET @SkipMSDB_jobs = 1; /*We have read permissions in the msdb database ... oh wait we got tricked, we can't view the objects*/
435+
END CATCH;
436+
END;
437+
ELSE
438+
BEGIN
439+
SET @SkipMSDB_jobs = 1; /*We don't have read permissions in the msdb database*/
440+
END;
441+
END;
442+
443+
IF ISNULL(@SkipMSDB_alerts, 0) != 1 /*If @SkipMSDB_alerts hasn't been set to 1 by the caller*/
444+
BEGIN
445+
IF EXISTS
446+
(
447+
SELECT 1/0
448+
FROM @db_perms
449+
WHERE database_name = N'msdb'
450+
)
451+
BEGIN
452+
BEGIN TRY
453+
IF EXISTS
454+
(
455+
SELECT 1/0
456+
FROM msdb.dbo.sysalerts
457+
)
458+
BEGIN
459+
SET @SkipMSDB_alerts = 0; /*We have read permissions in the msdb database, and can view the objects*/
460+
END;
461+
END TRY
462+
BEGIN CATCH
463+
SET @SkipMSDB_alerts = 1; /*We have read permissions in the msdb database ... oh wait we got tricked, we can't view the objects*/
464+
END CATCH;
465+
END;
466+
ELSE
467+
BEGIN
468+
SET @SkipMSDB_alerts = 1; /*We don't have read permissions in the msdb database*/
469+
END;
470+
END;
471+
472+
IF ISNULL(@SkipMSDB_operators, 0) != 1 /*If @SkipMSDB_operators hasn't been set to 1 by the caller*/
473+
BEGIN
474+
IF EXISTS
475+
(
476+
SELECT 1/0
477+
FROM @db_perms
478+
WHERE database_name = N'msdb'
479+
)
480+
BEGIN
481+
BEGIN TRY
482+
IF EXISTS
483+
(
484+
SELECT 1/0
485+
FROM msdb.dbo.sysoperators
486+
)
487+
BEGIN
488+
SET @SkipMSDB_operators = 0; /*We have read permissions in the msdb database, and can view the objects*/
489+
END;
490+
END TRY
491+
BEGIN CATCH
492+
SET @SkipMSDB_operators = 1; /*We have read permissions in the msdb database ... oh wait we got tricked, we can't view the objects*/
493+
END CATCH;
494+
END;
495+
ELSE
496+
BEGIN
497+
SET @SkipMSDB_operators = 1; /*We don't have read permissions in the msdb database*/
408498
END;
409499
END;
410500
END;
@@ -574,19 +664,41 @@ AS
574664
WHERE @SkipModel = 1;
575665

576666
INSERT #SkipChecks (DatabaseName, CheckID, ServerName)
667+
SELECT
668+
v.*
669+
FROM (VALUES(NULL, 28, NULL)) AS v (DatabaseName, CheckID, ServerName) /*Tables in the MSDB Database*/
670+
WHERE @SkipMSDB_objs = 1;
671+
672+
INSERT #SkipChecks (DatabaseName, CheckID, ServerName)
577673
SELECT
578674
v.*
579675
FROM (VALUES(NULL, 6, NULL), /*Jobs Owned By Users*/
580-
(NULL, 28, NULL), /*SQL Agent Job Runs at Startup*/
581-
(NULL, 57, NULL), /*Tables in the MSDB Database*/
676+
(NULL, 57, NULL), /*SQL Agent Job Runs at Startup*/
582677
(NULL, 79, NULL), /*Shrink Database Job*/
583678
(NULL, 94, NULL), /*Agent Jobs Without Failure Emails*/
584679
(NULL, 123, NULL), /*Agent Jobs Starting Simultaneously*/
585680
(NULL, 180, NULL), /*Shrink Database Step In Maintenance Plan*/
586-
(NULL, 181, NULL), /*Repetitive Maintenance Tasks*/
681+
(NULL, 181, NULL) /*Repetitive Maintenance Tasks*/
682+
) AS v (DatabaseName, CheckID, ServerName)
683+
WHERE @SkipMSDB_jobs = 1;
684+
685+
INSERT #SkipChecks (DatabaseName, CheckID, ServerName)
686+
SELECT
687+
v.*
688+
FROM (VALUES(NULL, 30, NULL), /*Not All Alerts Configured*/
689+
(NULL, 59, NULL), /*Alerts Configured without Follow Up*/
690+
(NULL, 61, NULL), /*No Alerts for Sev 19-25*/
691+
(NULL, 96, NULL), /*No Alerts for Corruption*/
692+
(NULL, 98, NULL), /*Alerts Disabled*/
587693
(NULL, 219, NULL) /*Alerts Without Event Descriptions*/
588-
) AS v (DatabaseName, CheckID, ServerName)
589-
WHERE @SkipMSDB = 1;
694+
) AS v (DatabaseName, CheckID, ServerName)
695+
WHERE @SkipMSDB_alerts = 1;
696+
697+
INSERT #SkipChecks (DatabaseName, CheckID, ServerName)
698+
SELECT
699+
v.*
700+
FROM (VALUES(NULL, 31, NULL)) AS v (DatabaseName, CheckID, ServerName) /*No Operators Configured/Enabled*/
701+
WHERE @SkipMSDB_operators = 1;
590702

591703
INSERT #SkipChecks (DatabaseName, CheckID, ServerName)
592704
SELECT
@@ -9976,4 +10088,4 @@ EXEC [dbo].[sp_Blitz]
997610088
@OutputProcedureCache = 0 ,
997710089
@CheckProcedureCacheFilter = NULL,
997810090
@CheckServerInfo = 1
9979-
*/
10091+
*/

0 commit comments

Comments
 (0)