3

Is there a risk of not deleting unused Windows logins that have been disabled in AD or is it simply a housekeeping issue?

e.g. Windows authentication is used to provide database access. A user leaves the organisation. Their Active Directory account is disabled, but their SQL login remains.

  • 6
    ideally you would have this set up through AD and remove SQL from the equation altogether. create groups in AD that have the permissions sets that are required (and nothing more), and then have your AD admin manage from there. employee leaves the company? disable account and remove from groups. – swasheck May 26 '15 at 14:58
  • 2
    Right, agreed with @swasheck. You shouldn't be managing individual logins within SQL Server - it's totally redundant to what you're already doing in AD. This is especially true if turnover is high enough in your company that you're actually worried about this... – Aaron Bertrand May 26 '15 at 15:34
2

The simplest scenario is to avoid managing individual AD accounts in SQL Server whenever possible. The most common solution is to use AD groups and provide the groups access to the correct SQL server database. Then when people join or leave the AD administrators control what their rights are within AD. This does assume that the AD team has a well defined process for managing accounts. This was the solution suggested in the comment by @swasheck. I just thought it deserved to be an answer.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.