Skip to content

Commit 7111e69

Browse files
SQLDBAWithABeardSQLDBAWithABeard
authored
Merge pull request #993 from dataplat/instancecheckscontinued
Instancecheckscontinued
2 parents d3b866e + 7b07e4d commit 7111e69

File tree

4 files changed

+103
-1
lines changed

4 files changed

+103
-1
lines changed

‎developing/Robs-Instance.ps1

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1-
$Checks = 'ErrorLogCount', 'XESessionExists', 'XESessionStopped', 'XpCmdShellDisabled', 'WhoIsActiveInstalled', 'CLREnabled', 'TwoDigitYearCutoff', 'MaxDopInstance', 'ErrorLogCount', 'ModelDbGrowth', 'DefaultBackupCompression', 'SaExist', 'SaDisabled', 'SaRenamed', 'DefaultFilePath', 'AdHocDistributedQueriesEnabled', 'AdHocWorkload', 'DefaultTrace', 'OleAutomationProceduresDisabled', 'CrossDBOwnershipChaining', 'ScanForStartupProceduresDisabled', 'RemoteAccessDisabled', 'SQLMailXPsDisabled', 'DAC', 'OLEAutomation', 'ServerNameMatch', 'OrphanedFile', 'MaxMemory', 'NetworkLatency'
1+
./build.ps1 -Tasks build
2+
3+
$Checks = 'ErrorLogCount', 'XESessionExists', 'XESessionStopped', 'XpCmdShellDisabled', 'WhoIsActiveInstalled', 'CLREnabled', 'TwoDigitYearCutoff', 'MaxDopInstance', 'ErrorLogCount', 'ModelDbGrowth', 'DefaultBackupCompression', 'SaExist', 'SaDisabled', 'SaRenamed', 'DefaultFilePath', 'AdHocDistributedQueriesEnabled', 'AdHocWorkload', 'DefaultTrace', 'OleAutomationProceduresDisabled', 'CrossDBOwnershipChaining', 'ScanForStartupProceduresDisabled', 'RemoteAccessDisabled', 'SQLMailXPsDisabled', 'DAC', 'OLEAutomation', 'ServerNameMatch', 'OrphanedFile', 'MaxMemory', 'NetworkLatency', 'PublicPermission'
24

35
$Checks = 'XESessionRunningAllowed', 'XESessionRunning', 'XESessionRunningAllowed', 'XESessionExists', 'XESessionStopped', 'XpCmdShellDisabled'
46
$Checks = 'TraceFlagsNotExpected', 'TraceFlagsExpected'
@@ -18,6 +20,9 @@ $Checks = 'SuspectPageLimit'
1820
$Checks = 'SupportedBuild'
1921
$Checks = 'LoginMustChange'
2022
$Checks = 'LoginAuditSuccessful', 'LoginAuditFailed'
23+
Set-DbcConfig -Name skip.security.PublicPermission -Value $false
24+
$Checks = 'PublicRolePermission'
25+
$Checks = 'PUblicPermission'
2126

2227
Invoke-PerfAndValidateCheck -Checks $Checks
2328
Invoke-PerfAndValidateCheck -Checks $Checks -PerfDetail

‎source/checks/Instancev5.Tests.ps1

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,16 @@ Describe "Ad Hoc Workload Optimization" -Tag AdHocWorkload, Medium, Instance -Fo
5555
}
5656
}
5757

58+
Describe "SQL Agent Service Admin" -Tags AgentServiceAdmin, Security, CIS, Medium, Instance -ForEach $InstancesToTest {
59+
$skip = ($__dbcconfig | Where-Object { $_.Name -eq 'skip.security.AgentServiceAdmin' }).Value
60+
Context "Testing whether SQL Agent account is a local administrator on <_.Name>" {
61+
It "The SQL Agent service account should not be a local administrator on <_.Name>" -Skip:$skip {
62+
# We don't make this -BeFalse because the possible results are $true/$false/'Could not connect'
63+
$psitem.AgentServiceAdminExist | Should -Be $false -Because "We expected the service account for the SQL Agent to not be a local administrator"
64+
}
65+
}
66+
}
67+
5868
Describe "Backup Path Access" -Tag BackupPathAccess, Storage, DISA, Medium, Instance -ForEach $InstancesToTest {
5969
$skip = ($__dbcconfig | Where-Object { $_.Name -eq 'skip.instance.BackupPathAccess' }).Value
6070
Context "Testing Backup Path Access on <_.Name>" {
@@ -357,6 +367,16 @@ Describe "Login SA cannot exist" -Tag SaExist, CIS, Medium, Instance -ForEach $I
357367
}
358368
}
359369

370+
Describe "Public Role Permissions" -Tag PublicPermission, PublicRolePermission, Security, CIS, Instance -ForEach $InstancesToTest {
371+
$skip = ($__dbcconfig | Where-Object { $_.Name -eq 'skip.security.PublicPermission' }).Value
372+
373+
Context "Testing if the public role permissions don't have permissions on <_.Name>" {
374+
It "All permissions should be set to CIS standards on the public role on <_.Name>" -Skip:$skip {
375+
$PsItem.PublicRolePermissions | Should -Be 0 -Because "We expected the public role to have no permissions for CIS compliance."
376+
}
377+
}
378+
}
379+
360380
Describe "SA Login Renamed" -Tag SaRenamed, DISA, CIS, Medium, Instance -ForEach $InstancesToTest {
361381
$skip = ($__dbcconfig | Where-Object { $_.Name -eq 'skip.instance.SaRenamed' }).Value
362382
Context "Checking that sa login has been renamed on <_.Name>" {
@@ -384,6 +404,18 @@ Describe "SQL and Windows names match" -Tag ServerNameMatch, Medium, Instance -F
384404
}
385405
}
386406

407+
Describe "SQL Engine Service" -Tags SqlEngineServiceAccount, ServiceAccount, High, Instance -ForEach $InstancesToTest {
408+
$skip = ($__dbcconfig | Where-Object { $_.Name -eq 'skip.instance.sqlengineserviceaccount' }).Value
409+
Context "Testing SQL Engine Service on <_.Name>" -Skip:$skip {
410+
It "SQL Engine service account should be <_.State> on <_.InstanceName>" -ForEach $PsItem.SqlEngineServiceAccount {
411+
$PsItem.State | Should -Be $PsItem.ExpectedState -Because "We expected the SQL Engine service account to be $($PsItem.ExpectedState)"
412+
}
413+
It "SQL Engine service account should have a start mode of <_.ExpectedStartType> on instance <_.InstanceName>" -ForEach $PsItem.SqlEngineServiceAccount {
414+
$PsItem.StartType | Should -Be $PsItem.ExpectedStartType -Because $Psitem.because
415+
}
416+
}
417+
}
418+
387419
Describe "SQL Mail XPs Disabled" -Tag SQLMailXPsDisabled, Security, CIS, Low, Instance -ForEach $InstancesToTest {
388420
$skip = ($__dbcconfig | Where-Object { $_.Name -eq 'skip.instance.SQLMailXPsDisabled' }).Value
389421
Context "Checking SQL Mail XPs on <_.Name>" {

‎source/internal/configurations/configuration.ps1

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -293,6 +293,13 @@ Set-PSFConfig -Module dbachecks -Name skip.instance.maxmemory -Validation bool -
293293
Set-PSFConfig -Module dbachecks -Name skip.instance.orphanedfile -Validation bool -Value $false -Initialize -Description "Skip the check for orphaned file"
294294
Set-PSFConfig -Module dbachecks -Name skip.instance.servernamematch -Validation bool -Value $false -Initialize -Description "Skip the check for server name match"
295295
Set-PSFConfig -Module dbachecks -Name skip.instance.supportedbuild -Validation bool -Value $false -Initialize -Description "Skip the checks for supported build"
296+
# becuase we can't run this on core
297+
if ($IsCoreCLR) {
298+
$value = $true
299+
} {
300+
$value = $false
301+
}
302+
Set-PSFConfig -Module dbachecks -Name skip.instance.sqlengineserviceaccount -Validation bool -Value $value -Initialize -Description "Skip the checks for sql engine service account"
296303

297304

298305

‎source/internal/functions/NewGet-AllInstanceInfo.ps1

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -416,6 +416,21 @@ function NewGet-AllInstanceInfo {
416416
$Instance.SetDefaultInitFields([Microsoft.SqlServer.Management.Smo.Settings], $LoginInitFields)
417417
}
418418

419+
{ 'PublicRolePermissions' -or 'PublicPermission' } {
420+
#This needs to be done in query just in case the account had already been renamed
421+
$query = "
422+
SELECT Count(*) AS [RowCount]
423+
FROM master.sys.server_permissions
424+
WHERE (grantee_principal_id = SUSER_SID(N'public') and state_desc LIKE 'GRANT%')
425+
AND NOT (state_desc = 'GRANT' and [permission_name] = 'VIEW ANY DATABASE' and class_desc = 'SERVER')
426+
AND NOT (state_desc = 'GRANT' and [permission_name] = 'CONNECT' and class_desc = 'ENDPOINT' and major_id = 2)
427+
AND NOT (state_desc = 'GRANT' and [permission_name] = 'CONNECT' and class_desc = 'ENDPOINT' and major_id = 3)
428+
AND NOT (state_desc = 'GRANT' and [permission_name] = 'CONNECT' and class_desc = 'ENDPOINT' and major_id = 4)
429+
AND NOT (state_desc = 'GRANT' and [permission_name] = 'CONNECT' and class_desc = 'ENDPOINT' and major_id = 5);
430+
"
431+
$PublicRolePermsCount = $srv.Query($query).RowCount
432+
}
433+
419434
'SuspectPageLimit' {
420435
$sql = "Select
421436
COUNT(file_id) as 'SuspectPageCount'
@@ -474,6 +489,46 @@ function NewGet-AllInstanceInfo {
474489
$LoginPasswordExpirationCount = ($Instance.Logins | Where-Object { $_.Name -in $Instance.Roles['sysadmin'].EnumMemberNames() } | Where-Object { $_.LoginType -eq 'SqlLogin' -and $_.PasswordExpirationEnabled -EQ $false -and $_.IsDisabled -EQ $false }).Count
475490
}
476491

492+
'AgentServiceAdmin' {
493+
try {
494+
$SqlAgentService = Get-DbaService -ComputerName $Instance.ComputerName -InstanceName $Instance.DbaInstanceName -Type Agent -ErrorAction SilentlyContinue
495+
$LocalAdmins = Invoke-Command -ComputerName $ComputerName -ScriptBlock { Get-LocalGroupMember -Group "Administrators" } -ErrorAction SilentlyContinue
496+
$AgentServiceAdminExist = $localAdmins.Name.Contains($SqlAgentService.StartName)
497+
498+
} catch [System.Exception] {
499+
if ($_.Exception.Message -like '*No services found in relevant namespaces*') {
500+
$AgentServiceAdminExist = $false
501+
} else {
502+
$AgentServiceAdminExist = 'Some sort of failure'
503+
}
504+
} catch {
505+
$AgentServiceAdminExist = 'We Could not Connect to $Instance $ComputerName , $InstanceName from catch'
506+
}
507+
}
508+
509+
'SqlEngineServiceAccount' {
510+
$EngineAccounts = Get-DbaService -ComputerName $psitem -Type Engine -ErrorAction SilentlyContinue
511+
$starttype = ($__dbcconfig | Where-Object { $_.Name -eq 'policy.instance.sqlenginestart' }).Value
512+
$state = ($__dbcconfig | Where-Object { $_.Name -eq 'policy.instance.sqlenginestate' }).Value
513+
if ($Instance.IsClustered) {
514+
$starttype = 'Manual'
515+
$because = 'This is a clustered instance and Clustered Instances required that the SQL engine service is set to manual'
516+
} else {
517+
$because = "The SQL Service Start Type was expected to be $starttype"
518+
}
519+
520+
$SqlEngineServiceAccount = foreach ($EngineAccount in $EngineAccounts) {
521+
[PSCustomObject]@{
522+
InstanceName = $Instance.Name
523+
State = $EngineAccount.State
524+
ExpectedState = $state
525+
StartType = $EngineAccount.StartType
526+
ExpectedStartType = $starttype
527+
because = $because
528+
}
529+
}
530+
}
531+
477532
Default { }
478533
}
479534

@@ -578,6 +633,9 @@ function NewGet-AllInstanceInfo {
578633
SupportedBuild = $SupportedBuild
579634
LoginMustChangeCount = $LoginMustChangeCount
580635
LoginPasswordExpirationCount = $LoginPasswordExpirationCount
636+
AgentServiceAdminExist = $AgentServiceAdminExist
637+
SqlEngineServiceAccount = $SqlEngineServiceAccount
638+
PublicRolePermissions = $PublicRolePermsCount
581639
# TempDbConfig = [PSCustomObject]@{
582640
# TF118EnabledCurrent = $tempDBTest[0].CurrentSetting
583641
# TF118EnabledRecommended = $tempDBTest[0].Recommended

0 commit comments

Comments
 (0)