Copy-SqlLogin should not require sysadmin privileges about dbatools HOT 2 CLOSED

Looks like this is an issue with Connect-SqlServer generally requiring SA, we can definitely connect to the server with the -RegularUser switch, which wont attempt to enforce this.

There is still some mulling going on around general permissions and how much we want to manage them, I think the current behavior of the command is acknowleding that managing permissions is a PITA.

Going forward, I think we have a few options:

1. Continue as usual until someone complains and add additional code
2. Make it easier to swap in a regular user and make them deal with the permissions of the user must be sufficient (obviously dealing with errors)
3. Code in the understanding of the required permissions to manage this feature, which will be a moving target as newer functions of SQL Server come out, but we could potentially abstract this into its own set of functions.
4. ???

I was wondering if you had any opinion on the topic @paschott?

from dbatools.

My opinion is handle the option by just validating if the user has direct sysadmin privileges via role membership or explicitly granted CONTROL SERVER. If they do not then just post a warning like:

[Security] The user account in use is not granted elevated privileges to [server name], some actions may fail or error.

I mean look how applications handle it, on average, none of them are going to check if you have permissions and then fail (before taking that action). They are just going to fail after trying it, and in their documentation state what permissions are required for each user that handles whatever process. Microsoft does the same thing for the most part (e.g. SharePoint services, SQL Server install account).

from dbatools.