I'm running SSIS packages stored in a SQL Server 2014 catalog via scheduled SSA jobs. I'm reviewing my SQL Audit capture and noting calls to SSISDB are coming from the proxy I created when looking at the value for [session_server_principal_name], but the SID showing up in [server_principal_name] doesn't correspond to the Active Directory SID. My proxy has an AD SID prefixed with the typical 'S-1-5...' but the audit is returning a SID with a prefix of 'S-1-9...'. Is that indicative of a contained user for SSISDB dynamically created at job runtime to execute the SSIS task?


Check the blog post I wrote concerning how to identify this S-1-9 SID.

From that post:

This can happen as a result of using EXECUTE AS USER = 'SomeUser'; to switch context to another user that doesn’t have a server-level account.

I imagine you'd see this exact scenario for contained users.

There is also an MSDN post from 2006 showing this SID.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.