Interface & Features — Security Manager

Walk through the main screens, tabs, and controls you will use day to day.

Dashboard

The dashboard provides a security overview with real-time metrics:

Logins Tab

Displays all server-level logins with management capabilities:

• Search — Filter logins by name, type, status, or server role
• Enable/Disable — Toggle login access with confirmation prompts
• Unlock — Unlock logins locked due to failed password attempts
• Reset Password — Set a new password with optional “force change at next login”
• Create Login — Create new SQL Server logins with default database and policy options
• Drop Login — Remove logins with safety confirmation
• Copy Script — Generate a CREATE LOGIN script with SID and password hash for migration
• Export All SQL — Export all logins as a SQL script file
• Export Excel — Export the login list to an Excel spreadsheet

Each login shows: name, type, status (Active/Disabled/Locked), default database, server roles, mapped databases, risk score, password policy status, days since password change, creation date, and last login time.

Users Tab

Shows database-level users for the selected database:

• User list — Name, type, linked login, default schema, database roles, friendly access level, orphan status
• Friendly Access — Color-coded badge showing “Read”, “Write”, “Read + Write”, or “Full Control” based on database roles
• Effective Permissions — Select a user to see their complete permission chain — what they can access and why (direct grant, role membership, or inheritance)
• Create User — Map a server login to a database user
• Drop User — Remove a database user with confirmation

Roles Tab

Displays server roles and database roles side by side:

• Server Roles — All server-level roles (sysadmin, securityadmin, etc.) with member counts and member lists
• Database Roles — All roles in the selected database with friendly names and member lists
• Role Management — Add or remove members from any role by specifying the member and role names

Permissions Tab

Object-level permissions for the selected database showing who has access to what objects (tables, views, stored procedures, functions):

• Grantee — The user or role with the permission
• Object — Schema.ObjectName with friendly type name
• Permission — Both the SQL permission name and friendly equivalent (SELECT → Read, INSERT → Write)
• State — GRANT, DENY, or GRANT WITH GRANT OPTION
• Path — Whether the permission is direct or inherited through a role

Password Policy

Audits password security for all SQL Server logins:

Audit Tab

Two audit views:

• Failed Login Attempts (24h) — Reads from the SQL Server error log to show failed login attempts with timestamp, login name, client host, application name, and error details
• Permission Changes (7d) — Reads from the SQL Server default trace to show GRANT, REVOKE, DENY, ADD MEMBER, and DROP MEMBER operations with the performing principal, affected object, and database

Compliance

Automated compliance checks identify security issues and provide remediation recommendations:

Export compliance reports to Excel or PDF for management review and regulatory documentation.

Drift Detection

Compare security configurations between two databases to detect inconsistencies:

1. Select a Reference Database (the standard you want to match)
2. Select a Target Database (the one being compared)
3. Click Detect Drift

The tool reports:

• Missing — Users or roles that exist in the reference but not in the target
• Extra — Users or roles in the target that don’t exist in the reference
• Mismatch — Users with different role memberships between the two databases

Each drift result includes a severity rating (High, Medium, Low) and a description of the difference.

Friendly Permission Names

The tool maps SQL Server’s technical names to business-friendly labels:

Risk Scoring

Each login receives an automated risk score (0–100) based on:

• sysadmin membership — +40 points
• securityadmin membership — +15 points
• No password policy — +15 points
• Password never expires — +10 points
• Password old (>90 days) — +10 points
• No recent login (>180 days) — +10 points

Risk levels:

Export Options