Skip to main content
Database Administrators

Return to Question

added 3 characters in body; edited tags
Source Link
Paul White ♦
Paul White ♦
  • 90.3k
  • 30
  • 424
  • 663

MS SqlSQL Server 2008 (soon to be 2012).

We have a vendor that is providing us with log shipped backups of our production database. We use this log shipped database for BI staging, reporting, etc. I've seen several blogs and articles discussing pass through authentication and trusted domains, but we have no access at all to their domain. Is is possible to create an AD user or group on their side and have it function on our side?

As a workaround - probably unsupported, we take the log shipped db offline, copy the datafiles to a shell db and bring both dbs back online. This gives us a read/write copy of the database and allows us to configure security; and make any other changes we might need.

I'm wondering if there is any way to have the vendor just create windowsWindows or SqlSQL Server logins (say with specific SIDs to match our AD account SIDs) and therefore keep us from having to make copies of the db in order to manage security. I'm hoping the question is clear enough, I'll try to rephase it here:

Is it possible to create a login on one server, move the db to another server, and have an AD login already there that keeps the user from being orphaned.?

MS Sql Server 2008 (soon to be 2012)

We have a vendor that is providing us with log shipped backups of our production database. We use this log shipped database for BI staging, reporting, etc. I've seen several blogs and articles discussing pass through authentication and trusted domains, but we have no access at all to their domain. Is is possible to create an AD user or group on their side and have it function on our side?

As a workaround - probably unsupported, we take the log shipped db offline, copy the datafiles to a shell db and bring both dbs back online. This gives us a read/write copy of the database and allows us to configure security; and make any other changes we might need.

I'm wondering if there is any way to have the vendor just create windows or Sql logins (say with specific SIDs to match our AD account SIDs) and therefore keep us from having to make copies of the db in order to manage security. I'm hoping the question is clear enough, I'll try to rephase it here:

Is it possible to create a login on one server, move the db to another server, and have an AD login already there that keeps the user from being orphaned.

SQL Server 2008 (soon to be 2012).

We have a vendor that is providing us with log shipped backups of our production database. We use this log shipped database for BI staging, reporting, etc. I've seen several blogs and articles discussing pass through authentication and trusted domains, but we have no access at all to their domain. Is is possible to create an AD user or group on their side and have it function on our side?

As a workaround - probably unsupported, we take the log shipped db offline, copy the datafiles to a shell db and bring both dbs back online. This gives us a read/write copy of the database and allows us to configure security; and make any other changes we might need.

I'm wondering if there is any way to have the vendor just create Windows or SQL Server logins (say with specific SIDs to match our AD account SIDs) and therefore keep us from having to make copies of the db in order to manage security. I'm hoping the question is clear enough, I'll try to rephase it here:

Is it possible to create a login on one server, move the db to another server, and have an AD login already there that keeps the user from being orphaned?

Source Link
paulbarbin
paulbarbin
  • 764
  • 4
  • 7

Managing Security for a Log Shipped db across two (unconnected) domains

MS Sql Server 2008 (soon to be 2012)

We have a vendor that is providing us with log shipped backups of our production database. We use this log shipped database for BI staging, reporting, etc. I've seen several blogs and articles discussing pass through authentication and trusted domains, but we have no access at all to their domain. Is is possible to create an AD user or group on their side and have it function on our side?

As a workaround - probably unsupported, we take the log shipped db offline, copy the datafiles to a shell db and bring both dbs back online. This gives us a read/write copy of the database and allows us to configure security; and make any other changes we might need.

I'm wondering if there is any way to have the vendor just create windows or Sql logins (say with specific SIDs to match our AD account SIDs) and therefore keep us from having to make copies of the db in order to manage security. I'm hoping the question is clear enough, I'll try to rephase it here:

Is it possible to create a login on one server, move the db to another server, and have an AD login already there that keeps the user from being orphaned.