Get-SqlSafe Server List Runner
==============================

Purpose
-------
This package provides a small PowerShell wrapper for running the free
Get-SqlSafe Community Edition against a list of SQL Server instances.

Get-SqlSafe performs a SQL Server security assessment and generates a separate
HTML report for each successfully assessed instance. It checks areas such as
configuration, access control, authentication, auditing, and encryption.


Package contents
----------------
Invoke-GetSqlSafeForServerList.ps1
    Sample wrapper that invokes Get-SqlSafe for each entry in a server list.

Servers.example.txt
    Annotated example showing supported target-name formats.

README.txt
    This file.

Get-SqlSafe.ps1 is not included in this package. Download the current Community
Edition separately from:

https://sarpedonqualitylab.us/resources/


Before you begin
----------------
1. Review all PowerShell scripts before running them.
2. Run the assessment only against systems you are authorized to access.
3. Use an account with the permissions required by Get-SqlSafe.
4. Confirm network connectivity to the target SQL Server instances.
5. Start with two or three known instances before using a larger list.

If Windows marks the downloaded files as blocked, review them first and then
unblock only the files you trust. Do not weaken the system-wide PowerShell
execution policy to run this sample.


Setup
-----
1. Extract this package to a working folder.
2. Download and extract Get-SqlSafe.
3. Place Get-SqlSafe.ps1 where the wrapper expects it, or update the
   $getSqlSafePath value in the wrapper.
4. Copy Servers.example.txt to Servers.txt.
5. Replace the example entries with your SQL Server targets, one per line.
6. Verify that $serverListPath in the wrapper points to Servers.txt.

Blank lines and lines beginning with # are ignored. Duplicate entries are
removed by the wrapper.


Run
---
Open PowerShell in the working folder and run:

    .\Invoke-GetSqlSafeForServerList.ps1

The wrapper invokes Get-SqlSafe in console-only mode and prevents each
individual report from automatically opening in a browser.


Results
-------
Get-SqlSafe writes the generated HTML reports to its Results folder. The
wrapper reports failed targets and the total runtime at the end of the run.

A missing report may indicate an unavailable or obsolete target, a connection
problem, an authentication failure, or insufficient permissions. Review failed
targets individually.


Sensitive information
---------------------
Generated reports can contain server names, database names, account names, and
details about potential security weaknesses. Store and share them accordingly.
Do not publish reports from a real environment without reviewing and sanitizing
their contents.

Do not place passwords or other credentials in Servers.txt or in the wrapper.


Scope and limitations
---------------------
This wrapper is a learning sample and a starting point, not a production
orchestration framework. Review and adapt its error handling and safeguards for
your environment.

The sample uses sequential execution. Reliable parallel processing requires
additional controls for concurrency, timeouts, retries, result tracking, and
unambiguous association between each target and its output.

The server list is an input list, not a discovery mechanism. Successfully
processing the list does not prove that it represents the complete SQL Server
estate.


Terms and disclaimer
--------------------
Get-SqlSafe Community Edition is distributed separately under the license
published at:

https://github.com/Sarpedon-Quality-Lab/sql-security-community-scripts/blob/main/LICENSE.md

The wrapper is separate sample code and is not part of the official Get-SqlSafe
Community Edition release. Its permission terms and disclaimer are included
directly in the script header.

The wrapper may be copied and adapted for internal use, provided the complete
notice remains included. Redistribution, resale, or inclusion in another
product requires prior written permission from Sarpedon Quality Lab.

The wrapper is unsupported, provided without warranty, and used at your own
risk. Review and test it before use.
