Skip to content

Copy-DbaLogin may lead to unaccessable SQL instance #8572

@AndreasESchubert

Description

@AndreasESchubert

Verified issue does not already exist?

I have searched and found no existing issue

What error did you receive?

Copy-dbalogin does only perform a simple check to verify the login currently being migrated is not the same login as the user doing the migration. This is not sufficient when using AD groups only.
When the migrating user has no individual login and when using the command with the -force parameter, the existing AD group will be dropped, but re-adding it will not work any more due to the login not being able to connect.

In environments where high privilege accounts are exclusively added via AD groups, this may lead to the situation where no sysadmins are left.

Steps to Reproduce

# provide your command(s) executed pertaining to dbatools
# please include variable values (redacted or fake if needed) for reference

Copy-DbaLogin -Source $Source -Destination $Destination -Login $_.Name -Force

Please confirm that you are running the most recent version of dbatools

yes, I do

Other details or mentions

No response

What PowerShell host was used when producing this error

Windows PowerShell (powershell.exe)

PowerShell Host Version

Independent, since it is a logic flaw

SQL Server Edition and Build number

Independent, since it is a logic flaw

.NET Framework Version

Independent, since it is a logic flaw

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugs lifetriage requiredNew issue that has not been reviewed by maintainers

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions