3

Is there a risk of not deleting unused Windows logins that have been disabled in AD or is it simply a housekeeping issue?

e.g. Windows authentication is used to provide database access. A user leaves the organisation. Their Active Directory account is disabled, but their SQL login remains.

Improve this question
2
  • 6
    ideally you would have this set up through AD and remove SQL from the equation altogether. create groups in AD that have the permissions sets that are required (and nothing more), and then have your AD admin manage from there. employee leaves the company? disable account and remove from groups.
    – swasheck
    Commented May 26, 2015 at 14:58
  • 2
    Right, agreed with @swasheck. You shouldn't be managing individual logins within SQL Server - it's totally redundant to what you're already doing in AD. This is especially true if turnover is high enough in your company that you're actually worried about this...
    – Aaron Bertrand
    Commented May 26, 2015 at 15:34

1 Answer 1

Reset to default
2

The simplest scenario is to avoid managing individual AD accounts in SQL Server whenever possible. The most common solution is to use AD groups and provide the groups access to the correct SQL server database. Then when people join or leave the AD administrators control what their rights are within AD. This does assume that the AD team has a well defined process for managing accounts. This was the solution suggested in the comment by @swasheck. I just thought it deserved to be an answer.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.