Checking database permissions in SQL Server 2000

I recently had to write a script to confirm that correct database permissions had been set on a database. Here's how I did it. Hopefully the comments will make it clear what's going on.

--- This uses the syspermissions.actadd column. 
--- This is an undocumented column and is not guaranteed to work in future versions of SQL Server.

SELECT 'ATTENTION:' AS Type, 'Any entries below have not been granted adequate permissions' AS Name

UNION

-- This query will return all user tables that xxxxxx has not granted SELECT, INSERT, UPDATE & DELETE permissions

SELECT 'TABLE', o.name
FROM sysobjects o
WHERE o.xtype = 'U'
AND o.name != 'dtproperties'
AND o.name NOT IN (
 SELECT o.name
 FROM syspermissions p, sysobjects o, sysusers u
 WHERE p.id = o.id
 AND u.uid = p.grantee
 AND u.name = 'xxxxxx'
 AND o.xtype = 'U'  --User Table
 AND p.actadd = 27 ) --  = 1 (SELECT) + 2 (UPDATE) + 8 (INSERT) + 16 (DELETE)

UNION

-- This query will return any view that xxxxxx has not been granted SELECT permission
--  If other permissions have also been granted they will be ignored

SELECT 'VIEW', o.name
FROM sysobjects o
WHERE o.xtype = 'V'
AND o.category = 0
AND o.name NOT IN (
 SELECT o.name
 FROM syspermissions p, sysobjects o, sysusers u
 WHERE p.id = o.id
 AND u.uid = p.grantee
 AND u.name = 'xxxxxx'
 AND o.xtype = 'V'  --View
 AND (p.actadd & 1) = 1 ) -- BITWISE check to confirm that the SELECT permission is set

UNION

-- This query will return any stored procedure that xxxxxx has not been granted EXEC permission

SELECT 'STORED PROCEDURE', o.name
FROM sysobjects o
WHERE o.xtype = 'P'
AND o.name NOT LIKE 'dt_%'
AND o.name NOT IN (
 SELECT o.name
 FROM sysobjects o, syspermissions p, sysusers u
 WHERE o.id = p.id
 AND p.grantee = u.uid
 AND u.name = 'xxxxxx'
 AND o.xtype = 'P'  --Stored Procedure
 AND p.actadd = 32 )-- 32 = EXEC

UNION

-- This query will return any functions that xxxxxx has not been granted EXEC permission

SELECT 'FUNCTION', o.name
FROM sysobjects o
WHERE (o.xtype = 'FN' OR xtype = 'IF')
AND o.name NOT IN (
 SELECT o.name
 FROM sysobjects o, syspermissions p, sysusers u
 WHERE o.id = p.id
 AND p.grantee = u.uid
 AND u.name = 'xxxxxx'
 AND (o.xtype = 'FN' OR xtype = 'IF')  --Scalar Function or In-lined table-Function
 AND p.actadd = 32 )-- 32 = EXEC
ORDER BY 1, 2