Skip to content

Commit 23aaa57

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #34900 from VanMSFT/20250805_updateHash
20250805 update hash
2 parents fb1d306 + a5ecf5e commit 23aaa57

File tree

1 file changed

+105
-97
lines changed

1 file changed

+105
-97
lines changed

‎docs/t-sql/functions/loginproperty-transact-sql.md

Lines changed: 105 additions & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: "LOGINPROPERTY (Transact-SQL)"
33
description: "LOGINPROPERTY (Transact-SQL)"
44
author: VanMSFT
55
ms.author: vanto
6-
ms.date: "03/14/2017"
6+
ms.date: 08/05/2025
77
ms.service: sql
88
ms.subservice: t-sql
99
ms.topic: reference
@@ -29,105 +29,113 @@ helpviewer_keywords:
2929
- "LOGINPROPERTY function"
3030
dev_langs:
3131
- "TSQL"
32-
monikerRange: "= azuresqldb-current || = azuresqldb-mi-current || >= sql-server-2016 || >= sql-server-linux-2017 || = azure-sqldw-latest"
32+
monikerRange: "=azuresqldb-current || =azuresqldb-mi-current || >=sql-server-2016 || >=sql-server-linux-2017 || =azure-sqldw-latest"
3333
---
3434
# LOGINPROPERTY (Transact-SQL)
35+
3536
[!INCLUDE [SQL Server Azure SQL Managed Instance](../../includes/applies-to-version/sql-asdbmi.md)]
3637

37-
Returns information about login policy settings.
38-
39-
:::image type="icon" source="../../includes/media/topic-link-icon.svg" border="false"::: [Transact-SQL syntax conventions](../../t-sql/language-elements/transact-sql-syntax-conventions-transact-sql.md)
40-
41-
## Syntax
42-
38+
Returns information about login policy settings.
39+
40+
:::image type="icon" source="../../includes/media/topic-link-icon.svg" border="false"::: [Transact-SQL syntax conventions](../../t-sql/language-elements/transact-sql-syntax-conventions-transact-sql.md)
41+
42+
## Syntax
43+
4344
```syntaxsql
44-
LOGINPROPERTY ( 'login_name' , 'property_name' )
45-
```
46-
45+
LOGINPROPERTY ( 'login_name' , 'property_name' )
46+
```
47+
4748
## Arguments
48-
*login_name*
49-
Is the name of a [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] login for which login property status will be returned.
50-
51-
*propertyname*
52-
Is an expression that contains the property information to be returned for the login. *propertyname* can be one of the following values.
53-
54-
|Value|Description|
55-
|-----------|-----------------|
56-
|**BadPasswordCount**|Returns the number of consecutive attempts to log in with an incorrect password.|
57-
|**BadPasswordTime**|Returns the time of the last attempt to log in with an incorrect password.|
58-
|**DaysUntilExpiration**|Returns the number of days until the password expires.|
59-
|**DefaultDatabase**|Returns the [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] login default database as stored in metadata or **master** if no database is specified. Returns NULL for non-[!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] provisioned users (for example, Windows authenticated users).|
60-
|**DefaultLanguage**|Returns the login default language as stored in metadata. Returns NULL for non-[!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] provisioned users, for example, Windows authenticated users.|
61-
|**HistoryLength**|Returns the number of passwords tracked for the login, using the password-policy enforcement mechanism. 0 if the password policy is not enforced. Resuming password policy enforcement restarts at 1.|
62-
|**IsExpired**|Indicates whether the login's password has expired.|
63-
|**IsLocked**|Indicates whether the login is locked.|
64-
|**IsMustChange**|Indicates whether the login must change its password the next time it connects.|
65-
|**LockoutTime**|Returns the date when the [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] login was locked out because it had exceeded the permitted number of failed login attempts.|
66-
|**PasswordHash**|Returns the hash of the password.|
67-
|**PasswordLastSetTime**|Returns the date when the current password was set.|
68-
|**PasswordHashAlgorithm**|Returns the algorithm used to hash the password.|
69-
70-
## Returns
71-
Data type depends on requested value.
72-
73-
**IsLocked**, **IsExpired**, and **IsMustChange** are of type **int**.
74-
75-
- 1 if the login is in the specified state.
76-
77-
- 0 if the login is not in the specified state.
78-
79-
**BadPasswordCount** and **HistoryLength** are of type **int**.
80-
81-
**BadPasswordTime**, **LockoutTime**, **PasswordLastSetTime** are of type **datetime**.
82-
83-
**PasswordHash** is of type **varbinary**.
84-
85-
NULL if the login is not a valid [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] login.
86-
87-
**DaysUntilExpiration** is of type **int**.
88-
89-
- 0 if the login is expired or if it will expire on the day when queried.
90-
91-
- -1 if the local security policy in Windows never expires the password.
92-
93-
- NULL if the CHECK_POLICY or CHECK_EXPIRATION is OFF for a login, or if the operating system does not support the password policy.
94-
95-
**PasswordHashAlgorithm** is of type int.
96-
97-
- 0 if a SQL7.0 hash
98-
99-
- 1 if a SHA-1 hash
100-
101-
- 2 if a SHA-2 hash
102-
103-
- NULL if the login is not a valid SQL Server login
104-
105-
## Remarks
106-
This built-in function returns information about the password policy settings of a [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] login. The names of the properties are not case sensitive, so property names such as **BadPasswordCount** and **badpasswordcount** are equivalent. The values of the **PasswordHash, PasswordHashAlgorithm**, and **PasswordLastSetTime** properties are available on all supported configurations of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)], but the other properties are only available when [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] is running on [!INCLUDE[winserver2003](../../includes/winserver2003-md.md)] and both CHECK_POLICY and CHECK_EXPIRATION are enabled. For more information, see [Password Policy](../../relational-databases/security/password-policy.md).
107-
108-
## Permissions
109-
Requires VIEW permission on the login. When requesting the password hash, also requires CONTROL SERVER permission.
110-
111-
## Examples
112-
113-
### A. Checking whether a login must change its password
114-
The following example checks whether [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] login `John3` must change its password the next time it connects to an instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)].
115-
116-
```sql
117-
SELECT LOGINPROPERTY('John3', 'IsMustChange');
118-
GO
119-
```
120-
121-
### B. Checking whether a login is locked out
122-
The following example checks whether [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] login `John3` is locked.
123-
124-
```sql
125-
SELECT LOGINPROPERTY('John3', 'IsLocked');
126-
GO
127-
```
128-
129-
## See Also
130-
[CREATE LOGIN (Transact-SQL)](../../t-sql/statements/create-login-transact-sql.md)
131-
[sys.server_principals (Transact-SQL)](../../relational-databases/system-catalog-views/sys-server-principals-transact-sql.md)
132-
133-
49+
50+
#### *login_name*
51+
52+
The name of a [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] login for which login property status will be returned.
53+
54+
#### *propertyname*
55+
56+
An expression that contains the property information to be returned for the login. *propertyname* can be one of the following values.
57+
58+
| Value | Description |
59+
| --- | --- |
60+
| **BadPasswordCount** | Returns the number of consecutive attempts to log in with an incorrect password. |
61+
| **BadPasswordTime** | Returns the time of the last attempt to log in with an incorrect password. |
62+
| **DaysUntilExpiration** | Returns the number of days until the password expires. |
63+
| **DefaultDatabase** | Returns the [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] login default database as stored in metadata or `master` if no database is specified. Returns NULL for non-[!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] provisioned users (for example, Windows authenticated users). |
64+
| **DefaultLanguage** | Returns the login default language as stored in metadata. Returns NULL for non-[!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] provisioned users, for example, Windows authenticated users. |
65+
| **HistoryLength** | Returns the number of passwords tracked for the login, using the password-policy enforcement mechanism. 0 if the password policy isn't enforced. Resuming password policy enforcement restarts at 1. |
66+
| **IsExpired** | Indicates whether the login's password has expired. |
67+
| **IsLocked** | Indicates whether the login is locked. |
68+
| **IsMustChange** | Indicates whether the login must change its password the next time it connects. |
69+
| **LockoutTime** | Returns the date when the [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] login was locked out because it had exceeded the permitted number of failed login attempts. |
70+
| **PasswordHash** | Returns the hash of the password. |
71+
| **PasswordLastSetTime** | Returns the date when the current password was set. |
72+
| **PasswordHashAlgorithm** | Returns the algorithm used to hash the password. In [!INCLUDE [sssql22-md](../../includes/sssql22-md.md)] and earlier versions, the stored password information is calculated using SHA-512 of the salted password. Starting with [!INCLUDE [ssSQL25](../../includes/sssql25-md.md)], an iterated hash algorithm, RFC2898 (PBKDF) is used. The first byte of the hash indicates the version: `0x02` for version 2 ([!INCLUDE [sssql22-md](../../includes/sssql22-md.md)] and earlier versions) and `0x03` for version 3 ([!INCLUDE [ssSQL25](../../includes/sssql25-md.md)] and later versions). |
73+
74+
## Returns
75+
76+
Data type depends on requested value.
77+
78+
**IsLocked**, **IsExpired**, and **IsMustChange** are of type **int**.
79+
80+
- 1 if the login is in the specified state.
81+
82+
- 0 if the login isn't in the specified state.
83+
84+
**BadPasswordCount** and **HistoryLength** are of type **int**.
85+
86+
**BadPasswordTime**, **LockoutTime**, **PasswordLastSetTime** are of type **datetime**.
87+
88+
**PasswordHash** is of type **varbinary**.
89+
90+
NULL if the login isn't a valid [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] login.
91+
92+
**DaysUntilExpiration** is of type **int**.
93+
94+
- 0 if the login is expired or if it will expire on the day when queried.
95+
96+
- -1 if the local security policy in Windows never expires the password.
97+
98+
- NULL if the CHECK_POLICY or CHECK_EXPIRATION is OFF for a login, or if the operating system doesn't support the password policy.
99+
100+
**PasswordHashAlgorithm** is of type int.
101+
102+
- 0 if a SQL7.0 hash
103+
104+
- 1 if a SHA-1 hash
105+
106+
- 2 if a SHA-2 hash
107+
108+
- NULL if the login isn't a valid SQL Server login
109+
110+
## Remarks
111+
112+
This built-in function returns information about the password policy settings of a [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] login. The names of the properties aren't case sensitive, so property names such as **BadPasswordCount** and **badpasswordcount** are equivalent. The values of the **PasswordHash, PasswordHashAlgorithm**, and **PasswordLastSetTime** properties are available on all supported configurations of [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)], but the other properties are only available when [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] is running on [!INCLUDE [winserver2003](../../includes/winserver2003-md.md)] and both CHECK_POLICY and CHECK_EXPIRATION are enabled. For more information, see [Password Policy](../../relational-databases/security/password-policy.md).
113+
114+
## Permissions
115+
116+
Requires VIEW permission on the login. When requesting the password hash, also requires CONTROL SERVER permission.
117+
118+
## Examples
119+
120+
### A. Checking whether a login must change its password
121+
122+
The following example checks whether [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] login `John3` must change its password the next time it connects to an instance of [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)].
123+
124+
```sql
125+
SELECT LOGINPROPERTY('John3', 'IsMustChange');
126+
GO
127+
```
128+
129+
### B. Checking whether a login is locked out
130+
131+
The following example checks whether [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] login `John3` is locked.
132+
133+
```sql
134+
SELECT LOGINPROPERTY('John3', 'IsLocked');
135+
GO
136+
```
137+
138+
## Related content
139+
140+
- [CREATE LOGIN (Transact-SQL)](../../t-sql/statements/create-login-transact-sql.md)
141+
- [sys.server_principals (Transact-SQL)](../../relational-databases/system-catalog-views/sys-server-principals-transact-sql.md)

0 commit comments

Comments
 (0)