Tag Info

Hot answers tagged

16

No. While the documentation currently has the following arguably ambiguous statement about what this flag means: Password policy is checked. What it really means, and should say, is that the flag serves two purposes: The password policy might have been checked, but only if (a) the password policy was enabled at the time the password was last ...


12

You are attempting to pass Windows credentials in plain text from the connection string of an application. This simply isn't how Windows authentication works, and largely defeats the purpose. You also can't just create the same username with the same password in your own domain, and expect that to magically work. Domain name is still part of the validation ...


12

My understanding is that if you aren't using Contained Databases, you will have to ensure logins are created on other instances manually. Something like this script from SQLSoldier, originally posted as Transferring Logins to a Database Mirror, should do the trick.


10

This means that the login [R2Server\AAOUser] is already mapped to a user in that database. Or, in other words, another database user is using this login. You can see what database user is using your login with the following query: use YourDB go SELECT su.name as DatabaseUser FROM sys.sysusers su join sys.syslogins sl on sl.sid = su.sid where sl.name = ...


9

State codes and their meaning. 1 'Account is locked out' 2 'User id is not valid' 3-4 'Undocumented' 5 'User id is not valid' 6 'Undocumented' 7 'The login being used is disabled' 8 'Incorrect password' 9 'Invalid password' 10 'Related to a SQL login being bound to Windows domain password policy enforcement. ...


9

There is another way, which I now use in preference to the runas /netonly method. You can add the credentials to your profile in Windows using the Credential Manager found in the windows control panel. Open Credential Manager Click "Add A Windows Credential" Populate the "internet or network address" field with the name and port number of the SQL ...


9

My article will help if you set it up in advance, but not when the event happened in the past and you didn't have any kind of auditing mechanism set up. There is still hope, though. Let's say I did this: CREATE LOGIN flooberella WITH PASSWORD = N'x', CHECK_POLICY = OFF; This information is in the default trace under EventClass 104 (Audit Addlogin Event). ...


7

You should be able to do something like this EXECUTE AS login = 'loginname'; SELECT name FROM sys.databases WHERE HAS_DBACCESS(name) = 1 For reference see EXECUTE AS and HAS_DBACCESS


6

Is the TCP port SQL Server is listening on open globally? If so, yes I'd be concerned. If there is a password that can be brute-forced or guessed, or an exploit that allows someone to bypass authentication, eventually your database could be compromised. You'll also be vulnerable to attacks that don't require access, such as someone filling up the drive that ...


5

A user that was explicitly created with WITHOUT LOGIN cannot be mapped to a login after the fact. A user that was created with a login and then lost its association, e.g. because the database was moved to another server, can be remapped by first creating a new login (any name) and then using the ALTER USER ... WITH LOGIN = ... command. To demonstrate I am ...


5

My answer... From my comments: The issue was that the server was set to "Windows Authentication Mode" only. To fix this I Right click the server - > Properties Click "Security" in the left side of the "Server Properties" dialog Changed server Authentication to "SQL Server and Windows Authentication mode" Clicked "OK" Restarted Associated services. At ...


5

You can use the EXECUTE AS command: http://msdn.microsoft.com/en-us/library/ms181362.aspx


5

This should put you in the right direction: DECLARE @results TABLE ( database_name sysname, db_user_name sysname, login_name sysname ); INSERT @results EXEC sp_MsForEachDB ' USE [?]; SELECT DB_NAME() AS database_name, dp.name AS db_user_name, sp.name AS login_name FROM sys.database_principals dp INNER JOIN sys.server_principals sp ...


4

These logins are created from a certificate. In fact, if you run the following query: select name, type_desc from sys.server_principals where type = 'c'; You will see that they are of type CERTIFICATE_MAPPED_LOGIN. They are used typically to sign code. And you cannot use a certificate mapped login to connect with SQL Server. Please see this ...


4

You can leverage xp_logininfo for this process. This extended stored procedure can be used to provide information from Active Directory for Windows logins in SQL Server. The procedure returns an error if no login exists, so we can put a TRY/CATCH block around it to provide SQL for logins that are no longer valid when the procedure errors: declare @user ...


4

Per my original comment, it appears the SUSER_SID function just grabs whatever sid was recorded when the login was created, and doesn't actually query Active Directory (makes sense, as that could be expensive -- I even tried restarting the server service). Here is a C# console application that accomplishes the task, allowing you to audit the logins that ...


4

The hashing method is presumably an implementation detail which may or may not change in future releases (as it has at least once already). They're telling you not to do it in order to absolve themselves of breaking your scripts/automation if you try to run them on newer or older releases. It's partially supported purely to allow for migrating logins. At ...


4

That stored procedure sp_change_users_login only reports on SQL users, not Windows users. Here is the actual reporting query that the stored procedure uses (you can get the stored procedure text with sp_helptext 'sp_change_users_login'): select UserName = name, UserSID = sid from sysusers where issqluser = 1 and (sid is not null and sid <> 0x0) ...


4

Thomas has explained why that stored procedure isn't capturing orphaned Windows users, but here is how you can check: SELECT p.name FROM database_name.sys.database_principals AS p WHERE [type] IN (N'U', N'G') AND NOT EXISTS ( SELECT 1 FROM sys.server_principals AS sp WHERE sp.sid = p.sid ); If you need to do this for all databases, you can generate ...


4

Per the following article, This information can be found in: Start -> All Programs -> Local Security Policy Then navigate to Account Policies -> Password policy You should see something similar to this: http://www.mssqltips.com/sqlservertip/1088/sql-server-login-properties-to-enforce-password-policies-and-expiration/


4

This isn't an answer to the actual question asked, but commentary too long for a comment. FWIW I don't create SQL Auth logins that obey Windows password policies. I can avoid that simply with: CREATE LOGIN foo WITH PASSWORD = N'bar', CHECK_POLICY = OFF; If I want logins to use Windows-based password policies, I'll make users log in with Windows ...


4

You should never try to update system tables directly, in most cases it is not going to let you as you have found. In your case you will want to build out a dynamic statement for the ALTER LOGIN without knowing how many there are on the instance. However, you will need to be cautious in doing this to ensure you do not touch logins you shouldn't. This query ...


4

I blogged about it exactly one month ago. Since link-only answers are discouraged and pasting here the whole blog post would be ridiculous, here is a summary of what you will find there. Basically, you have to record index usage in a user table, in order to make sure that server restarts and index maintenance don't delete entries for the databases you're ...


3

to do it correctly is not very simple, although once setup, your done. Data users or application roles default have database scoped permissions. Database users are linked to Logins and therefore can have server wide permissions from their Login. Application roles aren't linked and can only get server wide permission by using a form of impersonation. Any ...


3

Please stop looking at syslogins. This is a deprecated system table that is now a backward compatibility view and is only there for that purpose (to prevent breaking old code). The user is dbo probably because they created the database. You should be able to find the login the user is associated with using: SELECT login_name = sp.name, user_name = dp.name ...


3

The only way a login has rights to a server is if those rights have been granted. The question is likely: How did these rights get granted? If DOMAIN\USER_A is a member of some Windows group, then through the rights granted to the group the DOMAIN\USER_A login exists in the server. This is true even if there is no individual entry in ...


3

If you have a list of known usernames, you can store them in a table somewhere: CREATE TABLE dbo.WebDevelopers(name SYSNAME PRIMARY KEY); INSERT dbo.WebDevelopers(name) SELECT N'YourDomain\User1' UNION ALL SELECT N'YourDomain\User2'; Now you can create a variety of scripts to ensure that: they exist as a login at the server level for each ...


3

Use a database role. Database roles are database specific (obviously) so you can't create a role that grant's permissions to multiple databases at once. However within the database you create a role either through the GUI or using the command CREATE ROLE <rolename>. Once it is created you can then grant the role permissions just like you would a ...


3

this is longer than a comment, posting as answer select top(10) [Transaction ID], [Begin Time], [Transaction Name], [Transaction SID], SUSER_SNAME([Transaction SID]) from fn_dblog(null, null) where Operation = 'LOP_BEGIN_XACT'; Transaction ID Begin Time Transaction Name Transaction SID -------------- ...


3

Well Management Studio, for example, by default, only asks for (and only requires) server name and credentials. You can override these if you bother going into Options, but most people don't. Do you really want all of your users connecting to master? In a lot of shops this can cause quite a bit of headache, especially with loose security. If users have the ...



Only top voted, non community-wiki answers of a minimum length are eligible