The passwords are stored in the master database. But the only thing that he can do with them is something like this:
CREATE PROCEDURE isp_Transfer_Logins
AS
SET NOCOUNT ON
DECLARE @login sysname
DECLARE @pwd sysname
DECLARE @new_pwd varchar(255)
DECLARE cur_Users CURSOR FOR
SELECT l.name, l.password
FROM master.dbo.syslogins l
INNER JOIN DTS.dbo.sysusers u ON l.sid = u.sid
WHERE (l.isntname = 0) AND (u.islogin = 1 AND u.isaliased = 0 AND u.hasdbaccess = 1)
ORDER BY u.name
OPEN cur_Users
FETCH cur_Users INTO @login, @pwd
WHILE @@FETCH_STATUS = 0
BEGIN
-- If the login does not exist on the destination server, then add it.
IF ((SELECT count(*) FROM SDDEVSQL1.master.dbo.syslogins WHERE name = @login) = 0)
BEGIN
EXEC SDDEVSQL1.master.dbo.sp_addlogin @loginame = @login, @passwd = @pwd, @encryptopt = skip_encryption, @defdb = 'QTRACS'
END
-- If the login does exist on the destination server, then synchronize the password.
ELSE
BEGIN
EXEC SDDEVSQL1.master.dbo.sp_droplogin @login
EXEC SDDEVSQL1.master.dbo.sp_addlogin @loginame = @login, @passwd = @pwd, @encryptopt = skip_encryption, @defdb = 'QTRACS'
END
FETCH cur_Users INTO @login, @pwd
END
CLOSE cur_Users
DEALLOCATE cur_Users
RETURN
GO
Tara