---
title: Database Local Account Security Reports
slug: kronpam-reference-guide-3-9-0/database-local-account-security-reports
docTags: 
createdAt: 2026-06-30T13:10:32.783Z
---

Once a Database Audit job has finished, a separate PDF is generated for every database engine that is present in the configuration (SQL Server, Oracle, PostgreSQL, MySQL). Each PDF follows the same three parts, Inactive Accounts, Expired Accounts and Accounts are not managed by Vault. So the reader can move from a each one of them.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/FxgoHRIqyvAcObTmBOTGZ_image.png "“Export to PDF”")

:::hint{type="info"}
Oracle, MSSQL, PostgreSQL and MySQL have different columns from each other. Below are explanation of each Database.
:::

### Microsoft SQL Server – *Database Local Account Security Report*

| **Chart**                     | **Interpretation**                                                                                                                | **Data Source**                                   |
| ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- |
| Inactive Accounts             | The percentage of logins whose **last\_login** value exceeds the inactivity threshold configured in *Security ⇒ Policy Settings*. | sys.dm\_exec\_sessions, sys.dm\_exec\_connections |
| Expired Accounts              | Logins whose passwords have passed the age defined by the SQL Server password-policy engine (password\_expiration\_date).         | sys.sql\_logins                                   |
| Accounts Not Managed by Vault | Logins whose credentials are not rotated by Kron PAM Vault (vault enrolment flag is *false*).                                     | DAM credential inventory                          |

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/v_zqJPFfjoi562d_ZGZzH_image.png "MSSQL Audit Table")

| Column                   | Description                                                                 | Populated from                                     |
| ------------------------ | --------------------------------------------------------------------------- | -------------------------------------------------- |
| Hostname / IP Address    | Instance name and listener IP detected by the collector.                    | Collector metadata                                 |
| User Name                | Login identifier.                                                           | sys.server\_principals.name                        |
| User Type                | SYSTEM, NORMAL, WINDOWS\_LOGIN, CERTIFICATE, etc.                           | sys.server\_principals.type\_desc                  |
| Server Roles             | Comma-separated roles granted at server scope (sysadmin, securityadmin, …). | sys.server\_role\_members → sys.server\_principals |
| Server Level Permissions | Explicit server-scope privileges (CONNECT SQL, VIEW ANY DEFINITION, …).     | sys.server\_permissions                            |

### Oracle – *Database Local Account Security Report*

| Chart                         | Interpretation                                                                 | Data Source                |
| ----------------------------- | ------------------------------------------------------------------------------ | -------------------------- |
| Inactive Accounts             | Users whose LAST\_LOGIN is older than the inactivity window.                   | dba\_users                 |
| Expired Accounts              | Users whose PASSWORD\_EXPIRE flag is set or whose password-lifetime has ended. | dba\_users, profile limits |
| Accounts Not Managed by Vault | Users whose passwords are outside Kron PAM Vault management.                   | DAM credential inventory   |



![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/vSt7NRFvxArQfeBU-S5ZA_image.png "Oracle Audit Table")

| Column                | Description                                                               | Populated from                          |
| --------------------- | ------------------------------------------------------------------------- | --------------------------------------- |
| Hostname / IP Address | Database service (or SCAN for RAC) plus listener IP.                      | Collector metadata                      |
| User Name             | Oracle user/schema.                                                       | dba\_users.username                     |
| User Type             | SYSTEM, NORMAL, SUPER (for SYS-type accounts).                            | dba\_users.account\_status + role check |
| DBA Role              | Displays DBA when the role is granted, otherwise “–”.                     | dba\_role\_privs                        |
| Powerful Roles        | Union of high-impact roles (e.g., AQ\_ADMINISTRATOR\_ROLE, OEM\_MONITOR). | dba\_role\_privs                        |

### PostgreSQL – *Database Local Account Security Report*

The three charts mirror the MSSQL/Oracle semantics, calculated from pg\_authid.rolvaliduntil (expiration) and DAM inactivity tracking.

| **Column**            | **Description**                                                                                                | **Populated from**                     |
| --------------------- | -------------------------------------------------------------------------------------------------------------- | -------------------------------------- |
| Hostname / IP Address | Server identifier and interface IP.                                                                            | Collector metadata                     |
| User Name             | Role name.                                                                                                     | pg\_roles.rolname                      |
| User Type             | *SYSTEM* (catalog roles), *NORMAL* (customer-defined), *SUPER* (if rolsuper).                                  | pg\_roles flags                        |
| Privileges            | Aggregated role attributes: superuser, create databases, create roles, replication, can login, inherit rights. | Derived from pg\_roles Boolean columns |

No extra paragraphs are appended; all role attributes are compressed into the **Privileges** column.

### MySQL – *Database Local Account Security Report*

The three charts mirror the MSSQL/Oracle semantics.

| **Column**                | **Description**                                                                                                | **Populated from**                     |
| ------------------------- | -------------------------------------------------------------------------------------------------------------- | -------------------------------------- |
| **Hostname / IP Address** | Server identifier and interface IP.                                                                            | Collector metadata                     |
| **User Name**             | Role name.                                                                                                     | mysql.user.User, mysql.user.Host       |
| **User Type**             | Aggregated role attributes: superuser, create databases, create roles, replication, can login, inherit rights. | Flag and name inspection in mysql.user |

No extra paragraphs are appended; all role attributes are compressed into the **Privileges** column.