Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

Do you think it is possible to create a SQL server ODBC Connection for an active directory user who doesn't log in into the windows.

Ideally this type of users will be used in the batch process. So, Another person logs in and creates a batch process and runs it with another user.

Note: I dont want to create a SQL server authentication. Instead would like to use active directory.

Thanks.

share|improve this question

migrated from security.stackexchange.com Apr 2 '13 at 20:06

This question came from our site for Information security professionals.

3 Answers 3

Although you cannot login to SQL Server unless you user either a SQL Login or a Windows Account with permissions to connect to the SQL Server, you could create a low-permission user that can EXEC certain stored procedures. Those stored procedures could then contain code that switches into the context of another, more highly privileged account.

EXECUTE AS Login = 'DOMAIN\User';
SELECT * FROM sys.databases;
REVERT 

Read more about EXECUTE AS on MSDN

share|improve this answer

You can deny local logon to a Windows user thus it will only be allowed to be used as a service account.

share|improve this answer
    
But can you use that service account in an ODBC connection? I cannot find a way to use it the way the OP suggests. I use service accounts in my environment, but client connections through ODBC use the logged in user, unless you configure server auth. –  schroeder Apr 2 '13 at 18:13
    
@Schroeder - true, you may be correct if the application is running as the actual user. I've always done it by having the application running as the service account and then connecting via ODBC. It would be trickier if it is a local application, though you could still configure the application to launch as the service user when a local user runs it. –  AJ Henderson Apr 2 '13 at 18:15

A quick review of Microsoft documentation suggests the answer is no as it was in 2011 when a very similar question was addressed on Stack Exchange http://stackoverflow.com/questions/6720193/how-can-i-send-an-odbc-connection-string-to-an-sql-server-if-the-user-is-authent

share|improve this answer
    
Can I create a windows session without that user being logged in? –  John Apr 2 '13 at 17:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.