sp_help_revlogin causing loss of characters on LOGINs with Unicode characters - sql

Question

I want to export all users of SQL Server and I found following stored procedure from the documentation but when I Ran the Procedure, the results of some names just exported as ??????. For example:
-- Login: ??????
IF NOT EXISTS (SELECT * FROM sys.server_principals WHERE name = N'??????')
BEGIN
CREATE LOGIN [??????] WITH PASSWORD = 0x0200B27F654A0090DFA7C3C857709164CDC91F1 HASHED, SID = 0x27926CE54FA0E64BB2300AE2E104C22C, DEFAULT_DATABASE = [master], DEFAULT_LANGUAGE = [us_english], CHECK_POLICY = OFF, CHECK_EXPIRATION = OFF
EXEC master.dbo.sp_addsrvrolemember #loginame='?????', #rolename='sysadmin'
END
All of Unicode users was shown as ?????? . the SP is as follow:
SET QUOTED_IDENTIFIER ON
SET ANSI_NULLS ON
GO
CREATE PROCEDURE [dbo].[sp_help_revlogin]
(
#login_name sysname = NULL
)
AS
BEGIN
DECLARE #name SYSNAME
DECLARE #type VARCHAR (1)
DECLARE #hasaccess INT
DECLARE #denylogin INT
DECLARE #is_disabled INT
DECLARE #PWD_varbinary VARBINARY (256)
DECLARE #PWD_string VARCHAR (514)
DECLARE #SID_varbinary VARBINARY (85)
DECLARE #SID_string VARCHAR (514)
DECLARE #tmpstr VARCHAR (1024)
DECLARE #is_policy_checked VARCHAR (3)
DECLARE #is_expiration_checked VARCHAR (3)
Declare #Prefix VARCHAR(255)
DECLARE #defaultdb SYSNAME
DECLARE #defaultlanguage SYSNAME
DECLARE #tmpstrRole VARCHAR (1024)
IF (#login_name IS NULL)
BEGIN
DECLARE login_curs CURSOR
FOR
SELECT p.sid, p.name, p.type, p.is_disabled, p.default_database_name, l.hasaccess, l.denylogin, p.default_language_name
FROM sys.server_principals p
LEFT JOIN sys.syslogins l ON ( l.name = p.name )
WHERE p.type IN ( 'S', 'G', 'U' )
AND p.name <> 'sa'
ORDER BY p.name
END
ELSE
DECLARE login_curs CURSOR
FOR
SELECT p.sid, p.name, p.type, p.is_disabled, p.default_database_name, l.hasaccess, l.denylogin, p.default_language_name
FROM sys.server_principals p
LEFT JOIN sys.syslogins l ON ( l.name = p.name )
WHERE p.type IN ( 'S', 'G', 'U' )
AND p.name = #login_name
ORDER BY p.name
OPEN login_curs
FETCH NEXT FROM login_curs INTO #SID_varbinary, #name, #type, #is_disabled, #defaultdb, #hasaccess, #denylogin, #defaultlanguage
IF (##fetch_status = -1)
BEGIN
PRINT 'No login(s) found.'
CLOSE login_curs
DEALLOCATE login_curs
RETURN -1
END
SET #tmpstr = '/* sp_help_revlogin script '
PRINT #tmpstr
SET #tmpstr = '** Generated ' + CONVERT (varchar, GETDATE()) + ' on ' + ##SERVERNAME + ' */'
PRINT #tmpstr
PRINT ''
WHILE (##fetch_status <> -1)
BEGIN
IF (##fetch_status <> -2)
BEGIN
PRINT ''
SET #tmpstr = '-- Login: ' + #name
PRINT #tmpstr
SET #tmpstr='IF NOT EXISTS (SELECT * FROM sys.server_principals WHERE name = N'''+#name+''')
BEGIN'
Print #tmpstr
IF (#type IN ( 'G', 'U'))
BEGIN -- NT authenticated account/group
SET #tmpstr = 'CREATE LOGIN ' + QUOTENAME( #name ) + ' FROM WINDOWS WITH DEFAULT_DATABASE = [' + #defaultdb + ']'
END
ELSE
BEGIN -- SQL Server authentication
-- obtain password and sid
SET #PWD_varbinary = CAST( LOGINPROPERTY( #name, 'PasswordHash' ) AS varbinary (256) )
EXEC sp_hexadecimal #PWD_varbinary, #PWD_string OUT
EXEC sp_hexadecimal #SID_varbinary,#SID_string OUT
-- obtain password policy state
SELECT #is_policy_checked = CASE is_policy_checked WHEN 1 THEN 'ON' WHEN 0 THEN 'OFF' ELSE NULL END
FROM sys.sql_logins
WHERE name = #name
SELECT #is_expiration_checked = CASE is_expiration_checked WHEN 1 THEN 'ON' WHEN 0 THEN 'OFF' ELSE NULL END
FROM sys.sql_logins
WHERE name = #name
SET #tmpstr = 'CREATE LOGIN ' + QUOTENAME( #name ) + ' WITH PASSWORD = ' + #PWD_string + ' HASHED, SID = '
+ #SID_string + ', DEFAULT_DATABASE = [' + #defaultdb + ']' + ', DEFAULT_LANGUAGE = [' + #defaultlanguage + ']'
IF ( #is_policy_checked IS NOT NULL )
BEGIN
SET #tmpstr = #tmpstr + ', CHECK_POLICY = ' + #is_policy_checked
END
IF ( #is_expiration_checked IS NOT NULL )
BEGIN
SET #tmpstr = #tmpstr + ', CHECK_EXPIRATION = ' + #is_expiration_checked
END
END
IF (#denylogin = 1)
BEGIN -- login is denied access
SET #tmpstr = #tmpstr + '; DENY CONNECT SQL TO ' + QUOTENAME( #name )
END
ELSE IF (#hasaccess = 0)
BEGIN -- login exists but does not have access
SET #tmpstr = #tmpstr + '; REVOKE CONNECT SQL TO ' + QUOTENAME( #name )
END
IF (#is_disabled = 1)
BEGIN -- login is disabled
SET #tmpstr = #tmpstr + '; ALTER LOGIN ' + QUOTENAME( #name ) + ' DISABLE'
END
SET #Prefix = '
EXEC master.dbo.sp_addsrvrolemember #loginame='''
SET #tmpstrRole=''
SELECT #tmpstrRole = #tmpstrRole
+ CASE WHEN sysadmin = 1 THEN #Prefix + [LoginName] + ''', #rolename=''sysadmin''' ELSE '' END
+ CASE WHEN securityadmin = 1 THEN #Prefix + [LoginName] + ''', #rolename=''securityadmin''' ELSE '' END
+ CASE WHEN serveradmin = 1 THEN #Prefix + [LoginName] + ''', #rolename=''serveradmin''' ELSE '' END
+ CASE WHEN setupadmin = 1 THEN #Prefix + [LoginName] + ''', #rolename=''setupadmin''' ELSE '' END
+ CASE WHEN processadmin = 1 THEN #Prefix + [LoginName] + ''', #rolename=''processadmin''' ELSE '' END
+ CASE WHEN diskadmin = 1 THEN #Prefix + [LoginName] + ''', #rolename=''diskadmin''' ELSE '' END
+ CASE WHEN dbcreator = 1 THEN #Prefix + [LoginName] + ''', #rolename=''dbcreator''' ELSE '' END
+ CASE WHEN bulkadmin = 1 THEN #Prefix + [LoginName] + ''', #rolename=''bulkadmin''' ELSE '' END
FROM (
SELECT CONVERT(VARCHAR(100),SUSER_SNAME(sid)) AS [LoginName],
sysadmin,
securityadmin,
serveradmin,
setupadmin,
processadmin,
diskadmin,
dbcreator,
bulkadmin
FROM sys.syslogins
WHERE ( sysadmin<>0
OR securityadmin<>0
OR serveradmin<>0
OR setupadmin <>0
OR processadmin <>0
OR diskadmin<>0
OR dbcreator<>0
OR bulkadmin<>0
)
AND name=#name
) L
PRINT #tmpstr
PRINT #tmpstrRole
PRINT 'END'
END
FETCH NEXT FROM login_curs INTO #SID_varbinary, #name, #type, #is_disabled, #defaultdb, #hasaccess, #denylogin, #defaultlanguage
END
CLOSE login_curs
DEALLOCATE login_curs
RETURN 0
END
GO
The number of users registered in the system as Unicode is large and it takes a long time to transfer them manually. So I need a solution that I can use to display Unicode users correctly.

Answer 1

I'll preface this by saying that it's much better to do this via some tool, rather than cobbling together something in T-SQL. You can use SSMS or similar.
Be that as it may:
The script you have posted has multiple issues.
The primary issue you were facing: use of varchar instead of nvarchar, means that other languages get clobbered.
Use of a cursor unnecessarily. This can be done in a single query using string aggregation.
The binary-to-hex procedure is complete overkill, as this can be done with a simple CONVERT. Even if it were necessary, it could have been done with an inline TVF.
Some missing QUOTENAME usages, to quote the names correctly.
It only adds fixed server roles, rather than any user-defined roles
It only adds CONNECT permissions, rather than any other permissions.
Usage of the deprecated sys.syslogins, which was replaced in 2005.
The following script is a full rewrite.
It returns all SQL logins and Windows logins based on AD users or AD groups (but not any other logins such as certificate based ones).
It adds all server-level permissions.
It adds all server roles, including user-defined.
CREATE OR ALTER PROCEDURE [dbo].[sp_help_revlogin]
#login_name sysname = NULL
AS
SELECT
'
/* sp_help_revlogin script
** Generated ' + CONVERT(nvarchar(30), GETDATE()) + ' on ' + QUOTENAME(##SERVERNAME) + ' */
GO
' + STRING_AGG(CONCAT(
'
IF NOT EXISTS (SELECT 1 FROM sys.server_principals WHERE name = N',
QUOTENAME(p.name, ''''),
')
BEGIN
CREATE LOGIN ',
QUOTENAME(p.name),
CASE WHEN p.type IN ('G', 'U') THEN ' FROM WINDOWS' END,
' WITH',
CASE WHEN p.type = 'S' THEN CONCAT(
' PASSWORD = ',
CONVERT(nvarchar(max), ISNULL(l.password_hash, 0x0), 1),
' HASHED, SID = ',
CONVERT(nvarchar(max), p.sid, 1),
CASE WHEN l.is_policy_checked = 0 THEN ', CHECK_POLICY = OFF' END,
CASE WHEN l.is_expiration_checked = 1 THEN ', CHECK_EXPIRATION = ON' END,
','
) END,
' DEFAULT_DATABASE = ',
QUOTENAME(p.default_database_name),
', DEFAULT_LANGUAGE = ',
QUOTENAME(p.default_language_name),
';
END;
GO
',
CASE WHEN p.is_disabled = 1 THEN
'ALTER LOGIN ' + QUOTENAME(p.name) + ' DISABLE;
GO
'
END,
r.roles + '
GO
',
sp.perms + '
GO
'
), N'
') WITHIN GROUP (ORDER BY p.name)
FROM sys.server_principals p
LEFT JOIN sys.sql_logins l ON l.principal_id = p.principal_id
CROSS APPLY (
SELECT STRING_AGG(
'EXEC sp_addsrvrolemember #loginame = ' + p2.name + ', #rolename = ' + QUOTENAME(r.name, '''') + ';'
, '
GO
'
)
FROM sys.server_role_members rm
JOIN sys.server_principals r ON r.principal_id = rm.role_principal_id
CROSS APPLY (VALUES( QUOTENAME(p.name, '''') )) p2(name) -- error 8124
WHERE rm.member_principal_id = p.principal_id
) r(roles)
CROSS APPLY (
SELECT STRING_AGG(CONCAT(
CASE WHEN sp.state = 'W' THEN N'GRANT' ELSE sp.state_desc END,
' ',
sp.permission_name COLLATE DATABASE_DEFAULT,
' TO ',
p2.name,
CASE WHEN sp.state = 'W' THEN N' WITH GRANT OPTION' END,
';'
), N'
GO
'
)
FROM sys.server_permissions sp
CROSS APPLY (VALUES( QUOTENAME(p.name, '''') )) p2(name) -- error 8124
WHERE sp.grantee_principal_id = p.principal_id
AND sp.class = 100
) sp(perms)
WHERE p.type IN ('S', 'G', 'U')
AND p.name <> 'sa'
AND (p.name = #login_name OR #login_name IS NULL);
GO
db<>fiddle