Problem In Using Linked-servers While Running MSSQLService Under Low-priv. User Account
Apr 24, 2007
Hi.
While hardening a ms-sql2000 , I faced with a problem and I`m completely lost !
few days of reading and google searchs didn't gave me any hint...
Here's the scenario :
Ms-sql is connected to Oracle , through "MS OLE DB provider for Oracle" .
By default MS-SQL runs as SYSTEM , but even if we change it to a "local admin"
account , everything works fine .
The problem is that it's not wise to let sqlservice to run under privilaged accounts such
as system or a member of 'local administrators' . So I tried a normal local user on the
host running sql . I fixed every related problem appearing because of using a limited user
account and ms-sql works fine in all aspects but one !
While using normal-user account , sql-server fails to load linked-servers and this error
pops up in enterprise-manager :
"OLE/DB Provider 'MSDAORA' IDBInitialize::Initialize returned 0x80004005:
The provider did not give any information about the error."
I've tried much to find root of this error ( including any comments from related KB articles... ) but no luck . My guess is that , using OLE requires administrative privileges on host , and as I'm running SqlService with normal user, it fails to use OLE. So I should give requried permissions to the user running SqlService . But the problem is that I've no idea where/how I should do that. I've already tried some registry/file permissions but non of them helped me.
Some where I red that using ODBC instead of OLE may help , but that seems fail too !
*Note that I'm almost sure it`s a problem OUT of circle of ms-sql , meaning any modifications should apply OUT of ms-sql , because simply giving local administrative privileges to the user, fix the problem.
I've run into a problem attempting to change my service account on the clustered servers from an administrative account to a non-privileged account under SQL Server 2005 Enterprise Edition. When I change the login properties in Configuration Manager I get the following error:
"The user already belongs to this group"
I'm then prevented from making any changes to the service account. I don't know what I'm supposed to do at this point to resolve the problem, so any assistance will be greatly appreciated.
Greetings:I am trying to conceive what risks might be created by runningmultiple SQL servers within a domain under a single domain account, asopposed to 1) running under the local service account or 2) multipledomain service accounts.In this case, all the SQL servers are SQL2000 running on Win2003. Theservice account is assigned only to the "Domain Users" group.We do use linked server calls, and I have played and suceeded gettingKereberos up to avoid double hop issues when using Windows Auth. Infact, this is one of the reasons that sparked the question in my mind-- in all the MS Kerebos SQL<->SQL examples, the SQL servers run undera unique service account.As an aside, most of the servers are "line of business" servers, butHR runs under a unique server with more sensitive information. I don'treally think that merits a seperate service account, but again, Icould well be missing something.I mostly looking for food for thought, but concrete examples ofgotchas would be appreciated.Thanks all.d.
VS2005Hi If I run the below code (this simply connects to SQL Server and returns the user name the connection is made under): Dim Connection As New SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings("LocalSqlServer").ToString)
Dim AttCommand As New SqlCommand("SELECT System_USER", Connection)
Connection.Open() Dim AttendanceReader As SqlDataReader = AttCommand.ExecuteReader
AttendanceReader.Read()
Debug.Print(AttendanceReader.Item(0).ToString)I get: MyDomainpootle.flump Which is the account I am running on the dev machine. I expected ASP.Net to run as ASPNET irrespective of the currently logged in account. Am I plain wrong? Do I need to change something in IIS? Do I need to change something in ASP.Net? Any help greatly appreciated Thanks
Hi everybody. Need help with secuity 1. SQLAgent servive = domainMy_local_admin 2. Job created Ownner: domainSQLDBA step1 exec sp_Who2 step2 Run DTS a)Connect to ANOTHER_SQL_SERVER USING windows authentication b) truncate table xxx
3. Run daily every 1 hr
1. Who will run job, domainMy_local_admin or domainSQLDBA ? 2. What account will be used to connect to ANOTHER_SQL_SERVER in step2
Our system is MS SQL Server v7 and NT 4. We have a stored procedure that exec's xp_cmdshell to run an external program located on the server. When a user who has 'sa' rights runs this stored procedure it works fine. When a 'non-sa' user (via the "BuiltinUsers" NT account) runs it, xp_cmdshell produces the following error:
Msg 50001, Level 1, State 50001 xpsql.c: Error 1385 from LogonUser on line 476
Is there an NT security or SQL Server setting I've overlooked that can be changed to allow non-sa users to xp_cmdshell programs?
n.b. The BuiltinUsers account does already have execute permission on the xp_cmdshell procedure.
I have several databases on my server with sophisticated security setups - they say ...
I wish to add another database for audit purposes and allow full access to everyone for INSERT/UPDATE. Is there a quick way to do this without building out extensive security logins etc. ?
I have an webapplication and I want to let the app check the privileges of the user logged in. with that info the app must show some functions of the system and hide others.
I want to know if somenthing like this is possible and how I can do It
PS. MySQL has a table with users, tables and the privileges those users had on that table and you could just use a select statement to shwo them. (Is something like this also possible in SQL server 2k)
Using SQL Server 2005 with SP1, I have successfully managed to schedule jobs to run SSIS packages. They connect to another SQLServer 2000 box, using SQLOLEDB connection manager, to extract data and import it into SQL 2005. The protection level for the packages is Server storage so that the job is run under the SQL Agent account. This is a specific domain account so that it can access other servers.
However, using the same setup for a scheduled job to to run an SSIS package which connects to another SQL Server 2000 box with connection manager SQL OLEDB, I get the following error message:
The AcquireConnection method call to the connection manager "xxx" failed with error code 0xC0202009.
As the both the successful and failed jobs seem to have been set up in the same way with the same protection levels and are both run under a domain sql agent account, is there anything else I should be checking that I don't know about?
can anybody tell me about Linked Servers and their uses and how to add a linked server to my Sql Server 2005. any help on this would be highly appreciated.
I have been trying to Link two sql servers on two different machines over the Internet without any luck. Can someone point me to information about doing this with good examples?
I currently have a main SQL Server which had a column on the majority of the tables. This column also had a check contraint on it. I dropped the column and the constraint and I now get the following message when trying to query the tables through a linked server 'OLE DB provider 'SQLOLEDB' supplied inconsistent metadata. An extra column was supplied during execution that was not found at compile time.'.
Hi All, I have successfully linked a server and had SQL queries running OK for a few weeks, but today I get the following message....
"OLE DB provider 'SQLOLEDB' supplied inconsistent metadata. An extra column was supplied during execution that was not found at compile time." (Server: Msg 7353, Level 16, State 1, Line 1)
I've dropped the link and recreated it but I still get the same error message. Can anyone help???
I have a DTS package that requires me to link 2 servers and query both in order to get my set of records that I want to Transform. My query runs fine in QA. I copy and paste it into the SQL Query window of the transformation. I click Preview and all that happens is a quick flicker of the DTS window. When I go to Transformations, there are no source columns.
Here is a copy of my code that I'm trying to use: ------------------------------------------------------- declare@start_dteas datetime, @end_dteas datetime
SELECTT70.* FROM CRMDEV02.MDCORE.DBO.T70_MD_UNIVERSE_RELATIONSHIP_M A NGT AS T70 JOIN #RUNS ONT70.RUN_ID = #RUNS.RUN_ID
DROP TABLE #RUNS ------------------------------------------------------ Is there an issue with Linked Servers and DTS? Any help would be greatly appreciated.
Hi Gurus, I am looking for literature to find out Pros and Cons of Using DTS Verses Linked Servers in SQL 7.0.
My requirement can be done by either DTS or Linked servers. But I would like to know more about resorce utilisation of these tecniques before making a decission.
When I create linked server using integrated security and <they will be impersonated> option I get this: Server: Msg 18456, Level 14, State 1, Line 1 Login failed for user '' MS Technet says that SQL Server 7 doesn't allow double hops and to use mappings to standard security login to work around. @#%%~~@@#@#&^%@# Impersonating to version 6.5 works fine. Is there any way to link servers using ONLY integrated security? Any help would be much appreciated. Thanks
I have setup a linked Informix server in SQL7.0 and I am trying to create a simple View with the following SQL statement
SELECT doc_code FROM FOURSITE.foursite.informix.watdoc WHERE (order_no = [PV01963B ])
I am getting the following error:
--------------------------- SQL Server Enterprise Manager --------------------------- [Microsoft][ODBC SQL Server Driver][SQL Server]Invalid use of schema and/or catalog for OLE DB provider 'MSDASQL'. A four-part name was supplied, but the provider does not expose the necessary interfaces to use a catalog and/or schema. --------------------------- OK Help ---------------------------
Hi. I'm working with SQL Server 7.0 and I've been reading about the linked server option. My question is, if it's possible to link a server with a SQLBase database 7.01.
I have download some drivers to my computer, the odbc driver for sqlbase and the sqlbase ole db driver as well, but when I try to add a new linked server in the enterprise, in the provider name option I can not see any provider name addressing to Centura or Sql base driver.
Has anybody an idea how to make this connection then? or the right way for doing it??
Thanks for any help can be offered. Regards, Elvia. :)
I have two 7.0 servers and I want to run a distributed query.
I did sp_addlinkedserver to link server B to server A and I did sp_addlinkedsrvlogin for a specific login. After adding login when I try to access a table on server B it says login failed
All the logins are NT authenticated (in both the servers, So both servers have same logins.)
Hi all I try to configure Linked Servers from the query analyze , and have some troubles. My steps are : 1. from the enterprise mennenger , add 2 new servers : srv1 , srv2 (both SQL7) 2. from the query analyzer of srv1.master: "sp_addlinkedserver 'srv2'" 3. from the query analyzer of srv1.master: "sp_addlinkedsrvlogin 'srv2',false,null,'sa','myPass'" 4. select * from srv2.pubs.srv2Table 5. I get the next error :"error 6 : Specified SQL srever not found."
This is my problem I have a Server A and Server B. There is a master table in Table A. I link Server A and Server B. When I look in Under Linked Server tables of B I can only C tables in Server A not the Server B 's Tables. Dpn't know what is happening. Could SOmebody help
