Deactivating Admin And Domain-Admins

Sep 10, 2007

Hello,

is it possible to deactivate the groups admins and domain-admins in sql server without getting in trouble with the sql-server. For example when the system boots the program should start normally without any problems.

We want do deactivate the accounts because we have some critical information in sql server and dont want to give all admins the possibility to have a look at these data.

We just want to have sa within the role sysadmin.


Regards
Franz

View 4 Replies


ADVERTISEMENT

SQL Security :: Domain Migration Altered SA Or Domain Admin Access To DBs

Jun 19, 2015

we recently migrated from our in-house domain to the Enterprise domain. Everything went smooth except for the fact that I can no longer accept my dBs using my SA or my domain admin account. There is only 1 account I can get into the management studio with but it has no admin privileges, so I can't make any  password changes or add accounts. I don't have a test environment so kind of hesitant to experiment with our production system.

View 6 Replies View Related

Domain Admin And Sa

Dec 13, 1999

A couple of newbie questions:

1) Do Domain Admins have SA rights by default in SQL7? If so, is there a way to keep domain admins out of particular databases.

2) Is it possible to create a database or table that even SA can't get into?

Thanks
JD

View 1 Replies View Related

Permission Domain Admin

Nov 6, 2007

Hi ,
We are using SBS2000 with SQL 2000 and Terminal server .
In the Terminal server ,we have an application that connect to sbs (sql) .
The Problem is that User without Domain Admin permission can not modify in database.
How Is it possible to grant full access to SQL2000 without giving users domain admin access?


Thanks ,
Samuel

View 5 Replies View Related

SQL Security :: Domain Admin Users Cannot Login

Jun 12, 2015

Is SQL Server sensitive to Domain group name? Like "Domain Admin"?

I have user that belong to "myDomainDomain Admin" group. Group is in SQL as sysadmin but user cannot login using domain credentials. When I move that user to a different domain group which that group is in SQL again as sysadmin my user is able to login. 

Environment: SQL 2008 Standard Edition. 

View 12 Replies View Related

Admin Access To SQL Without Server/domain Admin Access

Sep 6, 2007

We are using Win2k3 R2 with SQL 2000 in a domain environment.

Is it possible to create a domain group to grant admin level and user level access to SQL2000/2005 without giving users server admin or domain admin access?

It has always been my impression that to have admin access to SQL that you had to at least had admin level access on the server.

Any clarification would be greatly appreciated.

Thanks!

View 1 Replies View Related

How To Prevent Domain Admin Users From Accessing SQL 2000 Databases?

Mar 6, 2008

Based on our database infrastructure, we need to secure our SQL databases. The security issue concerns on allowing a limited number of Domain Admin users to access the SQL databases.
We tried certain ways, based on the documents in the Microsoft web site, but we couldn€™t reach to the point of preventing the Domain Admin users accessing the SQL databases.

Thanks in advance.

View 5 Replies View Related

SQL Server Admin 2014 :: Disjoining Clustered Environment And Rejoining It To A Different Domain

Aug 6, 2015

Would it be possible to disjoin the SQL Server Clustered environment to a new domain without having to reinstall the cluster?

disjoin
e.g 2 node activeactive cluster with 4 named instances. SQLserver1.dn.za; SQLserver2.dn.za; SQLserver3.dn.za;SQLserver4.dn.za
servernode1.dn.za; servernode2

re-join them as SQLserver1.dn.ra; SQLserver2.dn.ra; SQLserver3.dn.ra;SQLserver4.dn.ra
servernode1.dn.ra; servernode2.dn.ra

What would be the impact on the servers, will they be able to resolve the new dns.?

View 1 Replies View Related

SQL Server Admin 2014 :: DNS Name Not Match Active Directory Domain Name For Reporting Services

Feb 11, 2015

I am running into a weird issue with a new SQL Reporting Services 2014 server I built. I installed SQL Reporting 2014 on Windows Server 2012 R2 and configured Kerberos, but the site is extremely slow. After some reconfiguration and log captures I have determined the issue has to do with the Kerberos setup, however I am running a similar configuration with SQL Reporting Services 2008 on Windows Server 2008 R2 and do not run into the same errors.

The error I see while using Wireshark is KRB Error: KRB5KDC_ERR_BADOPTION NT Status: STATUS_NO_MATCH. When I drill down the into the error I can see the kerberos string is testprjmnmtreports14.company.com, which is the URL we are using to access the site. I made sure to add that name as an SPN for the service account that is running SQL Reporting Services, however I still receive the error.

Then I tried configuring the site to run without a hostheader, so I accessed the site with the server name, ECTSTSQLRS5, and the site works perfectly fine, no errors are reported either. So it seems I have isolated the issue down to Kerberos but I am not sure how to resolve it. Here is some more information about my environment:

DNS/URL used: testprjmnmtreports14.company.com
Server Name (FQDN): ECTSTSQLRS5.company.int
AD Domain Name: company.int
Server Version: Windows Server 2012 R2
AD Functional Level: 2008 R2

As you can see I am trying to use a .com address but my AD domain is .int which I think is the issue, but I do not have the same problem on my other server that is running Windows Server 2008 R2. What do I need to do to allow my new site on 2012 R2 to work with this DNS Alias?

View 0 Replies View Related

Installing SQL 2005 In An Existing W2k3 Cluster - Is Domain Admin Rights Required?

Apr 17, 2008

I have DBA that is convinced that they need domain admin rights to install SQL 2005 into an existing cluster. The domain groups and service accounts for SQL have been created already. Is having domain admin rights required during the install of SQL 2005 in a cluster?

View 1 Replies View Related

Too Many Admins

Jul 20, 2005

I need to make a tigger on some tables that diffrent ppl have Adminaccess to themusing Ent-Manger.is there a way to store the current windows login user-name in to alog Table ??the problem is all our IT dep have admin access to this database and Inoticed that some tables are missing some info and I want to trackthis !the user-group's server roll on this server is "system Admins" and onthe database is Public and db_owner.thanksDon

View 2 Replies View Related

NT Group For SQL Admins?

Mar 1, 2001

I have an NT local user group called DOMAINSQL_Admins. I have created the SQL account for this group but when I try to execute sp_changedbowner 'DOMAINSQL_Admins' to make it the dbo of one of my user db's I get an error saying 'The login 'NORDAMSQL_Admins' does not exist.' This group is a member of the sysadmin server role. What else do I need to do to it? Do I need to specify any special access rights in NT?

View 1 Replies View Related

Admins. How Do You Configure More Memory.

May 14, 2002

I had a SQL server 7.0 with 1 gb of RAM.
I just added more memory and now I have 4 gb of RAM. How can I canfigure SQL to take advantage of this.

View 2 Replies View Related

Locking Down Windows Admins

Sep 27, 2007

We have some Windows admins that curently have complete access to our SQL Server 2000 and 2005 databases and are making the most of it. What I would like to do is either lock them out or at least clamp down on their permissions within the instance. They tell me that their application of system patches fails when they do not have the System Administrator Server Role. I would really like to revoke that from them since they are running amuck. Are there any best practices or even good practices about the BUILTINAdministrators login or on how to allow the Windows Admins to do their job yet keep them from interfering with mine?
Thanks for your help.
Bob

View 8 Replies View Related

Admins, Surface Area Configuration

Apr 16, 2008

Up til now i've been working with Access, i have only got a few weeks experience with SQL, so dont eat me.
I set up a SQL Database, and placed it into my site, etc, set up all the connection strings. It connects fine, but cannot log in.  It tells me;
Cannot open database "C:USERSJAREDDESKTOPSTYXSTYX - BUILD 2APP_DATASTYXDB.MDF" requested by the login. The login failed.Login failed for user 'Webdev01Jared'.
I'm running Vista (x86), and SQL Server 2005 Express SP2, and i'm aware that Vista by default does not automatically enable remote access in SQLExpress for local admins.
 So i go into Surface Area Configuration. I've read about it, and it's two steps, Click "Add New Administrator", then select the priveleges in the left box and click the button to put them in the right box. Simple enough, and it works, sure, click the button, it moves across, done.
But. Hit OK. It's done nothing, i still cant connect, and the cherry on top; open up the SAC again to check and there is nothing in the right box. It's exactly how it was before i changed it. The problem is definitely this, and not the account, as i can log in for SQL Management Studio just fine, with the same windows authentication credentials.
 Thanks in advance.

View 3 Replies View Related

What Does VIEW SERVER STATE Give To Non-admins Over 2000?

Oct 4, 2007

Hello, without going into the politics of why I'm asking, does anyone have a compiled list of functionality that only sysadmin's could do in 2000 that VIEW SERVER STATE permission opens up in 2005?

From the documentation, so far I've found fn_get_sql (and it's dm view) but I'd really like a complete list.

View 5 Replies View Related

User On Trusted Domain Does Have Permission To Access Linked Server On AD Deployed In Another Domain

Sep 28, 2007

Hi,
We have the followoing:

-A "master domain" AD, a "sub domain" AD, a trust relationship between the two (sub trust master)
-A sql server 2005 on a win server 2003 in "sub domain" AD
-A linked server to "sub domain" AD
-A linked server login using a "sub domain" admin acccount
-A view to this linked server
-A grant on masterDomain/Domain Users to the database
-A grant on subDomain/Domain Users to the database
-We want all connections done through "Windows Authentication" not "Database Authentication".

Queries on the view work fine using "sub domain" user accounts.
Queries on the view fail using "master domain" user accounts (including master domain admin accounts)


"Msg 7399, Level 16, State 1, Line 1

The OLE DB provider "ADsDSOObject" for linked server "ADSI" reported an error. The provider indicates that the user did not have the permission to perform the operation."

All connections are done through "Windows Authentication" not "Database Authentication".

Can we establish cross domain connectivity with "Windows Authentication" ?


Below are details of the implementation:

SELECT TOP (100) PERCENT *
FROM OPENQUERY(ADSI,
'SELECT displayname, givenName, sn, cn (etc...)
FROM ''LDAP://OU=PEOPLE,DC=subDomain,DC=com''
WHERE objectCategory = ''Person'' AND objectClass = ''user'' ')

EXEC sp_addlinkedsrvlogin @rmtsrvname ='ADSI', @useself='false',
@rmtuser='subDomainAdminAccnt', @rmtpassword='sunDomainAdminAccntPassword';

In SQL Server Mngt Studio in Server Objects/Linked Servers/Providers/ ADSI properties security tab I have:

"connections will: <be made using this security context> Remote login:'subDomainAdminAccnt' With password: 'subDomainAdminAccntPassword'

Error:
Msg 7399, Level 16, State 1, Line 1

The OLE DB provider "ADsDSOObject" for linked server "ADSI" reported an error. The provider indicates that the user did not have the permission to perform the operation.

Msg 7320, Level 16, State 2, Line 1

Cannot execute the query "SELECT displayname, givenName, sn, cn

FROM 'LDAP://OU=PEOPLE,DC=subDomain,DC=com'

WHERE

objectCategory = 'Person'

AND objectClass = 'user'

" against OLE DB provider "ADsDSOObject" for linked server "ADSI".

View 7 Replies View Related

Problems With Change Sql Permissions After Migrating Domain User/group Accounts Into Root Domain

Apr 5, 2007

I have a root domain and child domain.



After using ADMT to migrate the domain user or group into the root domain, when I use enterprise manager to try and change the permissions allocated to that domain user/group, i get the 'Error 15401 NT user or Group not found'.



This is a correct error as the user is now in the root domain, however sql (in sysxlogins) still thinks its in the child domain.



Is there a simpler way, other than collecting the users permissions, deleting the user from SQL then adding back in with the correct domainusername format, then adding the permissions back?



I tried renaming the 'name' in sysxlogins (not recommended) and while that worked, whenever I tried to add the migrated user to another database, the login name was missing and would not resolve.



I believe it is something to do with the SID not matching.



Any ideas on how to fix this ?

View 1 Replies View Related

None-Domain Server Cannot Access SQL2005 Data On Windows 2003 Domain Server

Sep 26, 2006

I'm trying to run a test from my test environment which is a non-domain Windows 2000 server to access my domain 2003 with SQL2005. I have install 2005 tools to try to access the SQL server.



- I have try following the KB265808 - no success.
- Reading alot of blogs and it seems all are pointing to the same problem. "Remote access" but the settign is enabled.Error Message:

TITLE: Connect to Server
------------------------------

Cannot connect to ardsqldatawh.

------------------------------
ADDITIONAL INFORMATION:

An error has occurred while establishing a connection to the server. When connecting to SQL Server 2005, this failure may be caused by the fact that under the default settings SQL Server does not allow remote connections. (provider: Named Pipes Provider, error: 40 - Could not open a connection to SQL Server) (Microsoft SQL Server, Error: 53)

For help, click: http://go.microsoft.com/fwlink?ProdName=Microsoft+SQL+Server&EvtSrc=MSSQLServer&EvtID=53&LinkId=20476


Question: Could Windows 2003 security be blocking access? I'm using sa account to access.

Also, sa account does not seems to work for remote access. It is ok when accessing locally.

Any help would be appreciated.
949jc

View 1 Replies View Related

SQL Server Admin 2014 :: Does Security-admin Role Plus Deny Alter Any Login Cancel Each Other Out

Aug 27, 2015

I want to set up a database role so that users can use sp_readerrorlog through SSMS. It does a check on membership in the securityadmin role.

I have tested it and can see you can grant execute on xp_readerrorlog but the SSMS GUI uses sp_readerrorlog.

I thought I could create a user/certificate and add the signature to sp_readerrorlog but it's not permitted (likely because it's not a normal database object).

So the other solution is to add the users to the securityadmin role but then explicitly deny alter any login (best done with a custom server role in 2012+ but otherwise just manually in 2008). I tested this out and it works, I'm not able to alter any logins or increase my own permissions, I also did a check of what's reported from fn_my_permissions(null, null) and it shows minimal permissions like I'd expect.

View 0 Replies View Related

NON DOMAIN AND DOMAIN CONNECTION

Jul 20, 2005

Hi all,it happen to me a strange problem:i have a mdb file (in Access 2K) with SQL Server 2K linked tables whoruns on a workstation which is on a different domain that the SQLServer. It works.If i create a mdb file from a workstation which is a the domain of theSQL Server and then i run it a my non-domain workstation i have errormessage:Login failed for user '(null)'. Reason: Not associated with a trustedSQL Server connectionBut if i reattached my tables it works.If someone have an idea....PS: same ODBC on both machines

View 1 Replies View Related

Migrating SQL 2000 From A 2000 Domain To 2003 Domain

Mar 2, 2006

Currently running a SQL 2000 server in 2000 domain and want to migrate it to a new 2003 domain of the same name.

How do I go about it and is there any problems with this plan?

View 1 Replies View Related

Replication From Machine Not In Domain To Machine In A Domain

Jul 11, 2007

Hi



I'm trying to set up replication from one SQL server to another.



The publishing server is not a member of a domain and is located in a hosting center (but we have full control over the server). I can set up a Snapshot publication just fine.



The subscribing server is located in another remote location and is a member of a domain. Here I can also set up the subscription without errors.



The errors, I think, comes when the snapshot is about to be created, the error is, on the publisher server:



[298] SQLServer Error: 18456, Login failed for user 'NT AUTHORITYANONYMOUS LOGON'. [SQLSTATE 28000]



And the snapshot is not created.



Is it even possible to set up replication like this. I need to transfer the data from one sql server to another so we have a working "backup" so to speek if the other server does not respond.

View 1 Replies View Related

Can We See The Domain?

May 10, 2001

Guys,
I have problem in adding the user. The domain name "scs" that I am logged on a machine with user name "rao", But I am not able this user to SQL Server as scs/rao, it gives that the not found.

Your suggestions greatly appreciated.

Rao

View 3 Replies View Related

Domain Name

Jun 13, 2007

Hi All,

I am in the process of installing SQL Server 2005. Under Service Account I am selecting the domain user account option. It asks for the username, password and the domain name. How can I find out what the domain name is?

Thanks.

View 1 Replies View Related

Specify Domain Name

Jan 26, 2004

In mssql-ds.xml, we have attribute <datasources>
and in
<connection- url>jdbc:microsoft:sqlserver://localhost:1433;DatabaseName=DEV01</connection-url>

I also have a domain name "test" in which i have a table "loginTest", how do i specify domain name in <connection-url>

-Thanx

View 1 Replies View Related

Domain

Jun 18, 2008

How do I get the domain name of a sql server 2005 instance please?
Thanks

View 3 Replies View Related

Log On Outside The Domain

Nov 7, 2007

A while back I asked this in the SQL security forum, but did not receive any replies. I feel that this is a fairly basic, common question, so I am posting it here in the hopes that this forum has higher traffic and that someone here will know the answer.

I am trying to connect as follows:

Server: Windows 2003, SQL 2005, on a domain
Client: Windows 2008 Beta, not on any domain

I created an account with the same user name as the domain user on the client machine. And then I logged in as that user and went to Manage Network Password. I entered the correct domain credentials. Verified that this worked for file shares. However, SQL does not appear to be recognizing this and it tells me:

Login failed for user ''. The user is not associated with a trusted SQL Server connection.


I have verified that this domain account is working properly with SQL when the client is also on the domain.

Q: How can I get this Windows authentication scenario to work where the client is not on the domain and the SQL server is on the domain?


(Note: A similar case that can also occur frequently is that the server and client are on different domains.)

View 3 Replies View Related

Change Domain Within SQL

Mar 30, 2000

1. How could I change the Domain within SQL Server.
2. When the NT Server changed to a new domain, Does the SQL server change also? Could someone help me. Thank you.

View 2 Replies View Related

Run SQL As Domain User

Sep 10, 2002

SQL2K SP2 on Win2K Server in single native-mode domain

I'm trying to change MSSQLServer and SQLServerAgent to run under a domain account instead of LocalSystem. SQL is not running on the DC. I get Error 22042:xp_SetSQLSecurity() returned error -2147023564, 'No mapping between account names and security ID's was done'.

The SQL machine is part of the domain. I'm logged in as a Domain Admin.

What is the problem?

View 2 Replies View Related

Domain Confusion?

Feb 24, 2002

I can map to a domain to the server where I have a sql Server database from my machine which is in another domin.
However, I cannot register the sql server with enterprise manager from the same machine. I am assuming that it is not a permission problem since I could not get the registration to work logging on as SA or with windows authorization. What should be looked at?

View 1 Replies View Related

Migration To New Domain

Jul 25, 2012

We have a network setup with two domain controllers, DC1 and DC2, working independently from eachother along with a DBserver1 that runs a BCM database and is a member of DC1. For certain reasons we would like to demote the DBserver1 and join it on the domain of DC2. What are the steps required in order to properly move a BCM Database running on SQL2005 to a new domain, where the security data lies in the active directory of DC1?

View 1 Replies View Related

IIS And DB Server On Different Domain.

Mar 15, 2004

Hi,

I have a IIS server on "A" Domain. My application is hosted on on a machine which is under that domain.

I have a DB server, SQL server 2000 on B Domain. The server is a named instance of SQL Server 2000. I have a default SQL Server 7.0 on that same machine.

For the application i am trying to connect from the IIS to database server, but i am unable to connect to the named instance, but i can connect to the default 7.0 instance.

The connection string used for the application is as follows:
oConn.open "Driver={SQL
Server};Server=server_nameinstance_name;Database= db_name;uid=user_name;pwd=password;"

I am getting SQL Server does not exists error messege on page...

Please help, me if any one knows how to connect to the database server which is on different domain and is a named instance using the connection string in ASP page..

Please help, this is urgent.


Regards
Jay

View 13 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved