← Security
Oracle · Security

How to find users with powerful privileges in Oracle

Find accounts holding the DBA role, SYSDBA/SYSOPER, or sweeping ANY privileges, using DBA_ROLE_PRIVS, V$PWFILE_USERS, and DBA_SYS_PRIVS.

Tested on11g12c18c19c21c23ai26ai

Find accounts that hold powerful access: the DBA role, SYSDBA/SYSOPER, or sweeping ANY privileges.

-- Users granted the DBA role
SELECT grantee, granted_role, admin_option
FROM   dba_role_privs
WHERE  granted_role = 'DBA'
ORDER  BY grantee;

-- Accounts with SYSDBA / SYSOPER (password file)
SELECT username, sysdba, sysoper
FROM   v$pwfile_users
ORDER  BY username;

-- Sweeping system privileges
SELECT grantee, privilege, admin_option
FROM   dba_sys_privs
WHERE  privilege LIKE '%ANY%'
   OR  privilege IN ('GRANT ANY PRIVILEGE','GRANT ANY ROLE','ALTER SYSTEM','BECOME USER')
ORDER  BY grantee, privilege;
SecurityPrivilegesDBA_SYS_PRIVS