Logins compared: 5 | Role mismatches: 1
| Login | Type | Roles | Sysadmin | Present On | Missing On | Status |
|---|---|---|---|---|---|---|
| DOM\dba-team | WINDOWS_LOGIN | sysadmin | Yes | SQLNODE01, SQLNODE02 | - | OK |
| DOM\svc-sql | WINDOWS_LOGIN | sysadmin | Yes | SQLNODE01, SQLNODE02 | - | OK |
| app_orders_svc | SQL_LOGIN | public | No | SQLNODE01, SQLNODE02 | - | OK |
| reporting_ro | SQL_LOGIN | dbcreator, public | No | SQLNODE01 | SQLNODE02 | Missing on secondary |
| etl_service | SQL_LOGIN | public | No | SQLNODE01, SQLNODE02 | - | OK |
Server-role membership (sysadmin, dbcreator, ...) is server-level, not database-level - Always On does not replicate it automatically, so a role granted only on the primary silently disappears from permission checks after a failover.