text: SET NOCOUNT ON;
  SET TRANSACTION ISOLATION LEVEL READ UNCOMMITTED;
  
  DECLARE @LinkedServers AS table (ServerName sysname NOT NULL, IsSysAdmin smallint NULL DEFAULT(-1));
  
  INSERT INTO @LinkedServers (ServerName)
  SELECT a.name
  FROM sys.servers a
  INNER JOIN sys.linked_logins b ON b.server_id = a.server_id
  WHERE b.local_principal_id = 0 -- default security context
  AND b.uses_self_credential = 0 -- not use own credentials
  AND a.server_id <> 0 -- not local
  AND (a.is_data_access_enabled = 1 or a.is_distributor = 0)
  
  RAISERROR(N'Found %d linked server(s) with possible vulnerability.',0,1,@@ROWCOUNT) WITH NOWAIT;
  
  DECLARE @CurrServer sysname, @IsSysAdmin bit, @CMD nvarchar(MAX), @OuterCmd nvarchar(MAX), @SpExecuteSql nvarchar(1000)
  SET @CMD = N'SET @IsSysAdmin = IS_SRVROLEMEMBER(''sysadmin'')'
  
  DECLARE Srv CURSOR
  LOCAL FAST_FORWARD
  FOR
  SELECT ServerName
  FROM @LinkedServers
  
  OPEN Srv;
  
  WHILE 1=1
  BEGIN
  	FETCH NEXT FROM Srv INTO @CurrServer
  	IF @@FETCH_STATUS <> 0 BREAK;
  	
  	SET @SpExecuteSql = QUOTENAME(@CurrServer) + N'...sp_executesql'
  
  	BEGIN TRY
  		RAISERROR(N'Checking (RPC): %s',0,1, @CurrServer) WITH NOWAIT;
  
  		EXEC @SpExecuteSql @CMD, N'@IsSysAdmin bit OUTPUT', @IsSysAdmin OUTPUT
  
  		UPDATE @LinkedServers SET IsSysAdmin = @IsSysAdmin
  		WHERE ServerName = @CurrServer
  	END TRY
  	BEGIN CATCH
  		PRINT ERROR_MESSAGE()
  		
  		SET @OuterCmd = N'SELECT @IsSysAdmin = isadmin FROM OPENQUERY(' + QUOTENAME(@CurrServer) + N', N''SELECT isadmin = IS_SRVROLEMEMBER(''''sysadmin'''')'') AS q'
  
  		BEGIN TRY
  			RAISERROR(N'Checking (Query): %s',0,1, @CurrServer) WITH NOWAIT;
  
  			EXEC sp_executesql @OuterCmd, N'@IsSysAdmin bit OUTPUT', @IsSysAdmin OUTPUT
  
  			UPDATE @LinkedServers SET IsSysAdmin = @IsSysAdmin
  			WHERE ServerName = @CurrServer
  		END TRY
  		BEGIN CATCH
  			PRINT ERROR_MESSAGE()
  		END CATCH
  
  	END CATCH
  
  END
  
  CLOSE Srv;
  DEALLOCATE Srv;
  
  SELECT ServerName, IsSysAdmin
  FROM @LinkedServers