1

Sql server contains logins from 3 different domains (Under security\logins). These are mapped to database users. There are 15 databases.

One of the domain/AD is planned to be decommissioned next year.

  1. What elements other than login and users need to be reviewed to ensure there is no impact to sql server functionality, any jobs, sql server service account, etc?

  2. Assuming domain3 will be decommissioned, what is the process to modify the login and user to domain1? For example- on the sql server, is a delete and create required or is there any way to modify existing login/users?

1 Answer 1

3

I assume that the to-be-decomissioned domain isn't the domain that Sql Server host is joined to. In that case, you need to move sql server host to another domain (guide, guide2 ). But Microsoft does not support host migration when contains applications like sql server (too many dependencies with AD). In that case i reccomend you a complete migration to a fresh installed instance in the target domain.

So your tasks are to find and replace object related to the decommissioned domain: You should look at:

  • Logins (domain user, domain groups)
  • Service accounts (maybe you are running sql server or agent with an account of the to-be-decomissioned domain)
  • SSL certificate (maybe you are using SSL based on a certificate coming from a CA in that to-be-decomissioned domain)
  • Jobs (some jobs could be owned by a domain account in the to-be-decomissioned domain)

So, basically, you have to replace login with new one created in the new domain where application/users will be moved.

You should script current logins's rights (both for the instance and the databases).

I usually use sp_SrvPermissions and sp_DBPermissions

4
  • How to check whether the to-be-decommissioned domain is the domain that Sql Server is joined to or not? Under sqlserver secuirty\logins folder I can see logins from all 3 domains.
    – variable
    Oct 21, 2021 at 7:16
  • sql server is joined to a domain when the server that hosts it is joined to a domain. so you have to look at machine level
    – MBuschi
    Oct 21, 2021 at 8:03
  • The fact that in logins I can see domain3\username confirms that sql server is joined to a domain?
    – variable
    Oct 21, 2021 at 8:07
  • sql is joined to a domain for sure, but it not says wich one. in fact you have logins from 3 different domains
    – MBuschi
    Oct 21, 2021 at 8:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.