Commands / Import-sqmDatabaseLogins
Import-sqmDatabaseLogins
Security sqmSQLTool v1.9.78+ · Import ✓ -WhatIf supported  ·  ⚠ Policy re-enabled via finally block
Counterpart to Export-sqmDatabaseLogins. Reads the self-contained T-SQL script that function wrote - already placed at -InputPath by some external, separately controlled transport (file share, scheduled copy job, ...) since source and destination may sit in domains/networks that cannot reach each other directly - and applies it against -SqlInstance (the destination, e.g. Test). Only the destination is ever contacted; there is no connection back to the original source. Every login block is executed individually rather than as one combined script, so each of the potentially thousands of logins gets its own result (Success / SkippedSysadmin / SkippedSidCollision / Failed) instead of one all-or-nothing outcome.
ⓘ  A block's own PRINT output - emitted when it deliberately left a sysadmin/'sa' login alone, or found a SID already claimed by a differently-named login - is captured and reflected in that login's result Status. The sysadmin protection built into the file is therefore auditable here, not a silent no-op. Repair-DbaDbOrphanUser always runs last against -Database, exactly as Invoke-sqmRestoreDatabase and Copy-sqmLogins already do after any login change.

Parameters

ParameterTypeRequiredDefaultNotes
-SqlInstancestringRequired, Destination SQL Server instance (e.g. Test). Only this instance is ever contacted.
-SqlCredentialPSCredentialOptional, Credential for -SqlInstance.
-InputPathstringRequired, Path to the .sql file produced by Export-sqmDatabaseLogins, already transported here by an external process.
-DatabasestringRequired, Database to run the final orphan-user repair against. Compared to the database name recorded in the file's header - a mismatch only warns, it does not block the run.
-DisablePolicyboolOptional$trueDisables the configured DefaultPolicy on the destination before applying the logins and re-enables it afterwards via finally block.
-ContinueOnErrorswitchSwitch$falseContinue with the next login block if one fails, instead of aborting the whole run.
-EnableExceptionswitchSwitch$falseThrow terminating exceptions immediately (overrides -ContinueOnError).

Execution Flow

START 1. Connect to -SqlInstance (Test/destination) only No connection back to the source, ever 2. Read -InputPath, parse header + split into per-login blocks Header: source, database, timestamp, login count (informational) -Database vs. header mismatch → warning only, run is not aborted No login blocks found in file? YES Warning + return nothing applied NO 3. Disable configured DefaultPolicy on the destination Set-sqmSqlPolicyState - same guaranteed-reenable pattern as Copy-sqmLogins 4. Execute each login block individually (not one big script) Captures PRINT output → Success / SkippedSysadmin / SkippedSidCollision / Failed -ContinueOnError keeps going past a single failed login FINALLY, re-enable DefaultPolicy Runs even after an unhandled exception in the step above 5. Repair-DbaDbOrphanUser against -Database Same cleanup Invoke-sqmRestoreDatabase / Copy-sqmLogins already run DONE, per-login results + orphan-repair summary returned

Examples

Apply a previously exported login file to Test and repair orphaned users afterwards
Import-sqmDatabaseLogins `
    -SqlInstance 'TestSQL' `
    -Database 'Frontarena' `
    -InputPath 'D:\Handover\Frontarena_Logins.sql'
Apply without policy handling, keep going past any single login failure
Import-sqmDatabaseLogins `
    -SqlInstance 'TestSQL' `
    -Database 'Frontarena' `
    -InputPath 'D:\Handover\Frontarena_Logins.sql' `
    -DisablePolicy $false `
    -ContinueOnError
Counterpart
Export-sqmDatabaseLogins
Combined use
Sync-sqmDatabaseLogins
Runs after this refresh
Invoke-sqmRestoreDatabase
⬆ Index
All Commands