Server Logins
The Server Logins screen shows how the logins on your monitored SQL Server instances are configured, and what has changed, without reading through a grid of server role columns. Go to Security › Server Logins.
Every login on this screen comes from the security context of the SQL Server instance itself. A single login can exist on more than one instance. To see every instance a login lives on, filter by that login.
The screen has two tabs:
- Overview: KPIs, charts, and a table with one row per instance. Use it to spot instances with risky logins.
- Details: The same KPIs, charts, and filters scoped to one instance, followed by a table of every login on that instance. Select an instance to open it.
Views, Tag, Filters, Reset, the date range, and Share appear in the toolbar on both tabs, and your selections carry over between tabs. For more on these controls, see Drop-Down Filters and Choosing a Time Range.
Overview tab
Section titled “Overview tab”Five KPIs summarize the logins that match your filters:
| KPI | What it counts |
|---|---|
| Sysadmin | Logins that are members of the sysadmin server role. |
| Elevated, not sysadmin | Logins with elevated server roles other than sysadmin. |
| Password policy off | SQL logins with password policy turned off. |
| Disabled logins | Logins that are disabled. |
| Dropped logins | Logins that WISdom collected and that have since been removed from the instance. |
Charts
Section titled “Charts”Three charts show the share of logins in each state. Each chart shows the count and the percentage of logins.
- Password policy: SQL logins with the policy off or enforced.
- Password expiration: Logins where expiration is not enforced or is enforced.
- Elevated access: Logins with sysadmin, elevated (but not sysadmin), or no server role.
Quick filters
Section titled “Quick filters”The tabs above the table switch the view. They do not apply a filter, and the selected tab does not carry over to Details.
- All instances
- Sysadmin
- Elevated, not sysadmin
- Password policy off
- Disabled
- Dropped
Logins by instance table
Section titled “Logins by instance table”The table has one row per instance.
| Column | Description |
|---|---|
| Logins | Total logins on the instance. |
| Sysadmin | Logins in the sysadmin server role. |
| Elevated, not sysadmin | Logins with elevated roles other than sysadmin. |
| Policy off | SQL logins with password policy off. |
| Expiration off | Logins with password expiration not enforced. |
| Disabled | Disabled logins. |
| Dropped | Dropped logins. |
| Last change | The last time WISdom saw a change to the logins on the instance. The date stays the same until WISdom detects a new change. |
Sort any column, use the column selector to show or hide columns, and use the search bar to find an instance. Select an instance to open its Details tab.
Details tab
Section titled “Details tab”Details requires an instance. Select one on Overview, or choose an instance in Filters. The KPIs, charts, and quick filters match the Overview tab but cover only that instance. The tabs above the table are All Logins, Sysadmin, Elevated, not sysadmin, Password policy off, Disabled, and Dropped.
Logins table
Section titled “Logins table”| Column | Description |
|---|---|
| Login | The login name. |
| Type | The type of login: SQL login, Windows login, or Windows group. |
| Status | Enabled: the login can currently access the instance. Disabled: the login can no longer access the instance. Dropped: the login no longer exists on the instance. |
| Server roles | The server roles the login belongs to. |
| Resources connected | The total number of resources that connected with the login during the selected time range. |
| Password policy | Whether password policy is enforced for the login. |
| Default database | The login’s default database. |
| Created | When the login was created. |
| Modified | When the login was last modified. |
Login details
Section titled “Login details”Select a login, or select the action icon on its row, to open the Server Login flyout. It has two tabs.
Login tab
- Login name
- Login type
- Instances: Every monitored instance the login exists on.
- Default database
- Default language
- Status
- Created
- Modified
- Password last reset
- Last seen
- SID: Select the copy button to copy it.
- Roles
Connections tab
Shows how the login connects, using data from Database Connections. You can see the connections without leaving the screen.
Filters
Section titled “Filters”The available filters differ by tab.
| Filter | Overview | Details | Description |
|---|---|---|---|
| Instance | Yes | Yes | The name of the monitored instance. |
| Login | No | Yes | The login or group created in the security context of the instance. |
| Login Type | No | Yes | SQL login, Windows login, or Windows group. |
| Is Disabled | Yes | Yes | Whether the login is disabled. |
| Is Expired | Yes | Yes | Whether the login has expired. |
| Is Weak Password | Yes | Yes | Whether the password is considered weak. |
| Is Deleted | No | Yes | Whether the login was dropped. |
To find every instance a login exists on, filter by that login, or open its Server Login flyout and check Instances.
Jump from Database Connections
Section titled “Jump from Database Connections”On Performance › Database Connections › Details, select the action icon on a connection row and choose View Security Details to open the Server Login screen for that login. See Database Connections.
How WISdom gets login data
Section titled “How WISdom gets login data”This section is for senior DBAs who want to know where the data comes from.
WISdom collects login data from the system tables that hold it. On SQL Server, these tables are in the master database. On Azure SQL Database, they are in the system tables of the user database. Nothing on this screen is sourced from Database Connections. Database Connections shows which logins connect to which databases, and the Connections tab in the flyout joins that view to the login for convenience.
Dropped logins stay visible for up to 90 days, the same period WISdom keeps Workload Activity data. A login becomes Dropped when WISdom collected it and it is later removed from the instance.
Because a login is defined on the instance, a service account or application login that connects to several instances appears once per instance. Filter by Login to see all of them together.