Error 33129: Cannot use ALTER LOGIN with the ENABLE or DISABLE argument for a Windows group.

Recently an incredbily wise DBA friend of mine -- really -- attempted to disable the BUILTIN\Administrators login in SQL Server with this statement:

     ALTER LOGIN [BUILTIN\Administrators] DISABLE

     GO

But it failed with this message (user name dummified):

Message

Executed as user: domain\svc_account. Cannot use ALTER LOGIN with the ENABLE or DISABLE argument for a Windows group. GRANT or REVOKE the CONNECT SQL permission instead. [SQLSTATE 42000] (Error 33129).  The step failed.

Per BOL, "The login of a Windows Group cannot be disabled. To temporarily remove access permission granted to a Windows Group, REVOKE the CONNECT permission of the login for the Windows Group. Windows users might still have access through their individual login or through another Windows Group." 

So my incredibly talented DBA friend changed their statement to this, and the members of this Windows Group can no longer connect to SQL Server:

    REVOKE CONNECT SQL TO [BUILTIN\Administrators];

NOTE:  Don't miss that underlined piece about any member of that Windows Group can still get in if they are members of any other Windows Group.

More information on Error 33129:

https://learn.microsoft.com/en-us/sql/relational-databases/errors-events/mssqlserver-33129-database-engine-error?view=sql-server-ver16

Using xp_readerrorlog to read the SQL Server Error Log

The SQL Server Error Log contains a lot of information -- some of which can be very useful.  :)  But, how do you find what you're looking for in the Error Log quickly?  How might you trace an event over time to see when it was recorded in the Error Log?  

In this post I will show you how to use xp_readerrorlog to quickly find what you may be looking for in the Error Log.  In this example we are looking for all incidents of 'Login Failed':

       IF OBJECT_ID('tempdb..#ErrorLog') IS NOT NULL
       DROP TABLE #ErrorLog
 
       CREATE TABLE #ErrorLog (
         LogDate DATETIME ,
         ProcessInfo VARCHAR(1000) ,
         LogMessage TEXT
       );
 
       INSERT #ErrorLog  -- see below for xp_readerrorlog parms
       EXEC sys.xp_readerrorlog 0, 1, "Login failed"

-- now take a look at any occurrences that were recorded
SELECT * FROM #ErrorLog
ORDER BY LogDate DESC;

This is the output:

The above example was just login failures, but you can use this to track down just about anything that is recorded in the Error Log.  I used it recently to track down the cause of database timeout exceptions.  The end user could only say when the timeouts were occurring, so I looked into the error log at the given time and found this:

I/O is frozen on database XXXX.  No user action is required. However, if I/O is not resumed promptly, you could cancel the backup.

Then I used the above method to find the message in the Error Log every day at the same time that the full server backups were occurring.  And there you have it.  That was the cause of the timeouts they were seeing.  Not uncommon at all to see this w/the 3rd party full server backups, which they were then able to workaround.  

Anyway... this is just something you can use to quickly read the SQL Server Error Log to identify whenever a particular event is occurring.  Hope you find it useful.

These are the xp_readerrorlog parameters:

Stored procedure created & last modified date

To go alongside the last executed date of the stored procedure, you can use this to tell you when the procedure(s) were created and last moddified.  

       SELECT

             [DatabaseName] = DB_NAME(),
             [ProcedureName] = SCHEMA_NAME([schema_id]) +'.'+ [name],
             [Created] = create_date,
             [LastModified] = modify_date
       FROM
             sys.objects
       WHERE
             [type] = 'P'

Should return a little something like this:

You can narrow it down to a single procedure by adding this into your WHERE clause:

    AND [name] = 'usp_BackupAudit'

Stored Procedure - Last Executed Date

Cannot grant, deny, or revoke permissions to sa, dbo, entity owner, information_schema, sys, or yourself.

All I did was this:    GRANT SHOWPLAN TO [domain\userName];
And the server returned this message:

Cannot grant, deny, or revoke permissions to sa, dbo, entity owner, information_schema, sys, or yourself.

So what does that mean?  Per MSFT, this message occurs when you try to grant or revoke permissions for the following database principals:

    yourself, sa, dbo, entity owner, information_schema, sys

Weird. The [domain\userName] is not any of these users. Even more weird, the [domain\userName] was not even a user in the database yet.  So I dig a little further and found that this user was mapped to dbo within the database I was trying to GRANT SHOWPLAN to:

How to correct?

USE master;
ALTER AUTHORIZATION ON DATABASE::[databaseName] TO [sa]; -- or the desired owner
USE databaseName;
CREATE USER [domain\userName] FOR LOGIN [domain\userName] WITH DEFAULT_SCHEMA=[dbo];

Then my GRANT SHOWPLAN completes without error:

GRANT SHOWPLAN TO [domain\userName];

Commands completed successfully.
Completion time: 2021-03-18T14:48:18.5162709-05:00

ALTER AUTHORIZATION is the new version of sp_changedbowner, which has been deprecated.  More details here:

https://docs.microsoft.com/en-us/sql/t-sql/statements/alter-authorization-transact-sql?view=sql-server-ver15

Many people say that there are risks to granting SHOWPLAN to users, but I disagree.  For the authorized user, of course, I believe it is ideal for them to have this permission so that they can become aware of the resource overhead of their statements, and potentially help them to write better code. 😏😏

More details on SHOWPLAN:

https://docs.microsoft.com/en-us/sql/t-sql/statements/grant-database-permissions-transact-sql?view=sql-server-ver15

Hope I've helped!

Can you query SQL Server's Error Log file location or size?

Why yes.  You can!  Working a new server today that I have limited access to... and I needed a way to get around that limitation.  I just needed to find the location of the SQL Server error log files -- and you know what else?  The size, too, because it was taking an ungodly amount of time to open the error log within SSMS.  The server hasn't been cycled in months, so I was sure the thing was pretty big.  

What does the DBA without sysadmin privileges do?  😏 

 

DECLARE @logfiles TABLE (

       [FilArchive#] TINYINT,

       [Date] DATETIME,

       [LogFileSizeB] BIGINT

)

 

INSERT @logfiles

EXEC xp_enumerrorlogs

 

SELECT

       [FilArchive#],

       [Date],

       CONVERT(VARCHAR(50),CAST(SUM(CAST([LogFileSizeB] AS FLOAT)) / 1024 / 1024 AS DECIMAL(10,4))) + ' MB' SizeMB

FROM

       @logfiles

GROUP BY

       [FilArchive#],

       [Date],

       [LogFileSizeB];

 

-- to identify error log file location

SELECT SERVERPROPERTY('ErrorLogFileName') [Error_Log_Location];

The current one is not quite as large as I expected, but here you go -- the location and size of the current and all archived SQL Server Error logs.

Enjoy!

DBCC SQLPERF(logspace) -- Only one database, or with conditions.

Many SQL Server DBAs often use 'DBCC SQLPERF(logspace)' to analyze transaction log utilization for their databases.  It is very helpful.  When run exactly as I've quoted (but without the quotes), you will return log usage details for all databases on the server:

But - what if you have a ton of databases on the server and you don't want to be scrolling through everything to find what you care about?  Or, maybe you only wish to see those databases where the log usage is greater than X%. 

Here's a quick little trick to use DBCC SQLPERF(logspace) with conditions, only returning details for the databases you care about.  

-- optional parameters

DECLARE

       @dbname VARCHAR(155) = NULL,

       @SpaceUsed FLOAT = NULL

 

DECLARE @LOGSPACE TABLE(

       dbName VARCHAR(155),

       LogSizeMB FLOAT,

       [LogSpaceUsed%] FLOAT,

       [Status] INT

       )

INSERT @LOGSPACE

EXEC ('DBCC SQLPERF(''logspace'')')

 

-- Now pull it back for review

-- if your optional parms are null, you return log usage for all databases

SELECT dbName, LogSizeMB, [LogSpaceUsed%], [Status]

FROM @LOGSPACE

WHERE (dbName = @dbName OR @dbName IS NULL)

AND ([LogSpaceUsed%] >= @SpaceUsed OR @SpaceUsed IS NULL);

Here I have populated my optional @SpaceUsed parameter, to only return details where the log is 30% used or greater.  Most likely you'll want to use a higher @SpaceUsed, but this is just a visual so you can see what I mean.

Or in this case, I've input the @dbName:                            

Hopefully you find it useful!

More details here:

https://docs.microsoft.com/en-us/sql/t-sql/database-console-commands/dbcc-sqlperf-transact-sql?view=sql-server-ver15

Auto-generate ALTER DATABASE statements to move SQL Server database files

This is for the DBA who needs to move a LOT of SQL Server database files, but has very little patience to sit and type each one up one by one.  Like me.  Someone I know had to move log files and adjust filegrowths for nearly 50 databases yesterday, and she tells me she began pulling her hair out about 15 minutes into it. 😣

This query is just a fast way to generate the ALTER DATABASE statements to modify file location and filegrowth settings for the given @dbName.  And, it generates the rollback as well, just in case.  Remember, always cya.  Check the variables, edit to suit your needs.

USE master;  -- run it in the master db 

SET NOCOUNT ON;

DECLARE

       @dbname SYSNAME = 'tempdb',  -- change to db you are moving

       @oldpath VARCHAR(255) =  'C:\MSSQL\2017\TempDB',  -- input existing path

       @newpath VARCHAR(255) = 'C:\MSSQL\2017\Data',  -- input new path

       @dFileGrowth CHAR(5) = '256MB',  -- change, if needed

       @lFileGrowth CHAR(5) = '128MB'  -- change, if needed

-- Generate ALTER statement to move files

SELECT + CHAR(13) + CHAR(10) +

'ALTER DATABASE ' + @dbname + '
MODIFY FILE (

       Name = ' + name + ',

       FileName = ''' + REPLACE(physical_name,@oldpath,@newpath) +''',

       FileGrowth = ' + CASE WHEN mf.type = 1 THEN @lFileGrowth ELSE @dFileGrowth END + ');'

FROM sys.master_files mf

WHERE database_id = DB_ID(@dbname);

/* Generate ROLLBACK statement for safety measures.  */

SELECT + CHAR(13) + CHAR(10) +

'ALTER DATABASE ' + @dbname + '

MODIFY FILE (

       Name = ' + name + ',

       FileName = ''' + physical_name + ''');'

FROM sys.master_files

WHERE database_id = DB_ID(@dbname);

SET NOCOUNT OFF;

Standard SSMS query to grid results will give you something like this, where you can just cut/paste into another query window to execute.

Or, if you change the SSMS query results to output to text, you can better see the structure of the ALTER statement.  Like this:

Happy SQL.  Hope to have helped!!