User created new login - how to find where they got permissions from One of our developers just mentioned how he created a login on a server. I didn't think he should have permissions to do that, so I went and checked.

I've looked at which logins have sysadmin, and he's not a member of any of those groups. There are no logins in the security admin role.
There also don't seem to be any ALTER ANY LOGIN granted in the sys.server_permissions table.

Is there anything else I can look for here?
As first thing I'd check server level permissions of that login:

exec as login = 'TheLogin';
select * from sys.fn_my_permissions(null, 'server');


As second thing I'd check login's groups/roles, like this:

exec as login = 'TheLogin'; 
select *
from sys.login_token
where principal_id &gt; 0;


And my future actions depend on what I've got for now.
The thing may be tricky: One can have impersonate on sa or be a db_owner of trustworthy's database, so he has "hidden" permissions