Transact SQL :: Script That Creates User Mapping For Network Service
Aug 20, 2015SQL script that creates a User Mapping for NT AUTHORITYNETWORK SERVICE to a database?
View 3 RepliesSQL script that creates a User Mapping for NT AUTHORITYNETWORK SERVICE to a database?
View 3 RepliesI am trying to start ms sql server 2005 express as a network user from originally starting as local system. I cannot start the service.
I have given this network user administrator access to sql express from the sql server surface area configuration "Add New Administrator". I have went into the local users/groups and added this network user to the 3 security groups
SQLServer2005MSSQLServerADHelperUser$SQL1
SQLServer2005MSSQLUser$SQL1$SQLEXPRESS
SQLServer2005MSSQLBrowserUser$SQL1
I receive one alert int he event logs/application
EventID: 26010
The server could not load the certificate it needs to initiate an SSL connection. It returned the following error: 0x8009030d. Check certificates to make sure they are valid.
I receive five errors in the event logs/application
EventID: 26014
Unable to load user specified certificate. The server will not accept a connection. You should verify that the certificate is correctly installed. See "Configuring Certificate for Use by SSL" in Books Online.
EventID: 17182
TDSSNIClient initialization failed with error 0x80092004, status code 0x80
EventID: 17182
TDSSNIClient initialization failed with error 0x80092004, status code 0x1
EventID: 17826
Could not start the network library because of an internal error in the network library. To determine the cause, review the errors immediately prceding this one in the error log.
EventID: 17120
SQL Server could not spawn the FRunCM thread. Check the SQL Server error log and the Windows event logs for information about possible related problems.
I don't recall assigning any sql specific certificates. The reason I'm trying to run this as a network user is because an application on a remote windows server requires it.
After starting the service back running as local system as it was before, I went into the
SQL Server Management Studio Express and edited the properties for this new network user I wish to run the service as. I gave him full access including checking all grants in securables.
I now see a bit of a difference in the event logs with these errors.
EventID: 17058
initerrlog: Could not open the log file 'c:Program FilesMicrosoft SQL ServerMSSQL1MSSQLLOGERRORLOG.' Operating system error =5(Access is denied).
I saw a notification when changing the sql server service's logon that the new network user has been granted the log on locally right.
The second and last new error is
EventID: 17053
UpdateUptimeRegKey: Operating system error 5(Access is denied.) encountered.
I'm using the methods of the Microsoft.SqlServer.Management.Smo namespace within a .NET application to create a backup file from a SQLEXPRESS database. I can then restore the database from that backup device using methods in the same namespace. Here is a snippet from the restore code:
srv = New Server("MYPCSQLEXPRESS")
db = srv.Databases("washmaster")
Dim bdi As New BackupDeviceItem(BackupFileName, DeviceType.File)
Dim recoverymod As RecoveryModel
recoverymod = db.DatabaseOptions.RecoveryModel
rs.NoRecovery = False
rs.Devices.Add(bdi)
rs.Database = "washmaster"
rs.ReplaceDatabase = True
srv.KillAllProcesses("washmaster")
rs.SqlRestore(srv)
This works great as long as I used one of the backup files that I created directly on the disk. However, my application has a utility that allows the user to copy the backup files onto another drive, such as a CD or a thumb drive and when I try to restore from the copy of the backup, I get the following exception:
....Cannot open backup device..[filename]...Operating system error 5(Access is denied.)
The reason I get this error is that the "NETWORK SERVICE" account was removed from the file permissions when the file was copied.
How can I copy a backup to another drive and preserve the "NETWORK SERVICE" account? If I can't do that, is it wise to try to add the account back to the file before using it to restore or is there a better way?
Thanks,
SJonesy
set up asp .net user account on sql server 2005Question:
I've read the instructions in this article: http://www.netomatix.com/Development/aspnetuserpermissions.aspxBut do not know how to do this:You can grant 'Network Service' or 'ASPNET' user accounts permissions to connect to database.Please provide example on how to do this, thanks!
Microsoft recommends that you do not use the Network Service account to run the SQL Server service (see http://msdn2.microsoft.com/en-us/library/ms143504.aspx).
Can anyone tell me what the drawbacks are of doing this?
Hi all, I have to provide user mapping between two databases on the same server so that the tables and content of both the databases can be accessed by each other. I know how to do it using Enterprise Manager, but I have to do it via script as in my asp.net application the databases are created dynamically. If I am not wrong, then "sa" login will be required to execute this script, but no problems as we will be having the "sa" password also. The server is sql server 2005.
Can anybody please let me know how to do it exactly. Its very urgent. Thanx a lot in advance.
I need to get a list of users and databases that a sql login is mapped to. Is there a view or a sp that can get me this information?
View 18 Replies View RelatedIn an event of a system restore from development to production, what would cause the mappings for a database user to be whiped out?
Thank you in advanced for the clarifications.
Al
Hello, I am developping a web application who is connected to SQLServer 2005 via the connection sring as below
<add name="LocalSqlServer" connectionString="Data Source=IBM7;Initial Catalog=Reclamation;Integrated Security=True "
providerName="System.Data.SqlClient" />
I want to know which user (bydefault ) who is connecting to the DB . and how is mapped this user with user in SQL server?
Thanks in advance
Hi all,
I have to provide user mapping between two databases on the same server so that the tables and content of both the databases can be accessed by each other.
I know how to do it using Enterprise Manager, but I have to do it via script as in my asp.net application the databases are created dynamically.
If I am not wrong, then "sa" login will be required to execute this script, but no problems as we will be having the "sa" password also.
Can anybody please let me know how to do it exactly. Its very urgent.
Thanx a lot in advance.
Snehal Bhayani
Hello.
I am attempting to migrate an old third party app from 2000 to 2005 but I have a problem that I hope you can help me with.
To explain,
On 2000, in sysusers of the third party app db I have a username that contains a . This user has an associated server login (that uses SQL Server authentication) of the same name but without the .
so, the database user name is APP1 and the server login is APP1
I checked the SID's between the user and the login and they are the same which would suggest they are mapped to each other , however when I run sp_helplogins the login does not show as mapping to any user. The database user also has a different status, altuid and Isaliased value than any other user in sysusers but I confess to not knowing what the significance of this might be.
As far as I was aware you can't create a database user with a name that contains this invalid character so firstly I'm wondering how it got there. When I look at the databases access tab of the properties through enterprise manager of the APP1 server login, the APP1 user is not displayed. If the SID's between the login and the user match then shouldn't the APP1 user be displayed in the database access list? or have I got the wrong end of the stick here?
Despite all that, it isn't really a problem on 2000 because the app works ok. Now, to migrate it to 2005 I restored a full back up of the 2000 database and now the problem is that when I look in sys.database_principals the APP1 user is not there after I've restored it. It still shows in sysusers however. The main problem is that I cannot map it to a login using sp_change_users_login because I get the following error:
Msg 15291, Level 16, State 1, Procedure sp_change_users_login, Line 108
Terminating this procedure. The User name 'SQSUPD' is absent or invalid.
If anyone can tell me why this user does not show in sys.database_principals or more importantly, give me any pointers on how to resolve thie login mapping it would be much appreciated as I am now stuck!
Thanks
Hi all,
I do understand that it is highly recomended to have aserprate user (perfered a domain user account) for each of the SQL Server service and SQL Agent service.
What is the reason behind that? (Someone told me to not run the service with an account that has a powerul privilegs! - I don't undrstanmd this point can you explain it please?)
What is the diffrent between: 1- Local System account 2 -Network Service account
Thanks in advanced!
CS4Ever
Hi Friends,
I have a small problem in parameter mapping for Execute SQL Task.
I am using a delete statement with 2 conditions.
Followed by another Execute SQL Task which contains commit statement.
delete from tname where c1 = ? and c2 =?
where c1 is number(4) datatype and c2 is of varchar2(20) datatype in oracle.
The connection manager i am using is ORacle OLE DB provider.
I am passing 2 global variables i.e g_v1 of Int32 and g_v2 of String Type.
In the parameter mapping of the Executing SQL task, i am mapping these 2 variables for
c1 and c2 and changed the datatypes inside parameter mapping as Numeric for c1 and Varchar for c2.
I also set the property as ByPassPrepare = True.
When i am executing the package i getting INVALID NUMBER ERROR.
i believe the SSIS is unable to perform the implict datatype converison.
For the next run, i changed the g_v1 varible datatype to Double and also i changed the parameter mapping for c1 as Doble datatype.
This time it is working fine. I can see the Green signal for the 2 SQL Tasks.
But when i connected to Oracle check the count in the table, the data is not getting deleted.
Also,
I set the property RetainSameConnection = TRUE for oracle connection manager.
I am not able to trace this logical error.
The same is working fine in my local machine.
But i am facing the problem when i deployed the same on the client machine.
Is there any problem with parameter mapping?
What should be equialent Datatype for Oracle NUMBER datatype that should be used inside the SSIS package while declaring the global variable and
inside the parameter mapping.
Any thoughts!
2 Questions:
1) I am getting back into SQL more than before, in my new job. I need to find the service pack installed on the clients who have the Client Network Utility installed. I do not remember how to do this.
2) Running 'Select @@VERSION' on the server returns 7.00.1063 but does not indicate the service pack. Does this still mean sp4 has been installed?
I'm trying to ensure we'll all up to date since our dual 700 procs are acting eratic...jumps between 10 - 95% or so.
Server info:
NT Server SP6
SQL 7.0
2GB Ram
2 procs @ 700Mhz
Roughly 80 network connections.
No other programs running on server except Antivirus.
Thank you!
It is simple question, just slipped out of my mind at this time...... how do we change Security Context for 2005 version from network to local system.
thanks,
I am trying to connect to a sql server from my asp.net application via windows authentication using the Network Service account. When I try to create a login for the ComputerNameNetwork Service account I get the following error.
I know I haven't mistyped it because I clicked the check names button and it showed as a valid id.
So what gives?
TITLE: Microsoft SQL Server Management Studio Express
------------------------------
Create failed for Login 'PREMIERDCNetwork Service'. (Microsoft.SqlServer.Express.Smo)
For help, click: http://go.microsoft.com/fwlink?ProdName=Microsoft+SQL+Server&ProdVer=9.00.3042.00&EvtSrc=Microsoft.SqlServer.Management.Smo.ExceptionTemplates.FailedOperationExceptionText&EvtID=Create+Login&LinkId=20476
------------------------------
ADDITIONAL INFORMATION:
An exception occurred while executing a Transact-SQL statement or batch. (Microsoft.SqlServer.Express.ConnectionInfo)
------------------------------
Windows NT user or group 'PREMIERDCNetwork Service' not found. Check the name again. (Microsoft SQL Server, Error: 15401)
For help, click: http://go.microsoft.com/fwlink?ProdName=Microsoft+SQL+Server&ProdVer=09.00.3042&EvtSrc=MSSQLServer&EvtID=15401&LinkId=20476
------------------------------
BUTTONS:
OK
------------------------------
Hello All,
I am installing SQL Server Express from the command line using the following parameters
INSTANCENAME=MSSQLSERVER ADDLOCAL=ALL SECURITYMODE=SQL DISABLENETWORKPROTOCOLS=0 SAPWD=TEST
After the install is done I start the service form the command prompt using
start mssqlserver
I see that the SQL Server service has started under NETWORK SERVICE account!!! when the documentation i Read on MSDN says it starts in Local System account
Can any one explain me the possible reasons
Thanks
Cannot open user default database. Login failed.Login failed for user
'NT AUTHORITYNETWORK SERVICE'. Description:
An unhandled exception occurred during the execution of the current web
request. Please review the stack trace for more information about the error and
where it originated in the code. Exception Details:
System.Data.SqlClient.SqlException: Cannot open user default database. Login
failed.Login failed for user 'NT AUTHORITYNETWORK SERVICE'. I have This Error When i try to log into My online web site, i have no idea how to fix it,one day it was working and the next it wasnt, is there any way to find out what database the default is and if it's either incorrect or not present change the web.config in a way that will make my system work. i have the NT Authority/Network Service in my Server Properties Permissions, its given the type login and is granted Connect SQL by sa i have 3 colder copies of the web site on my server my question is, how would i use of of these to restore the original site configuration is there a way to restore the original configuration to undo whatever it is i've done to break the system ChrisStressed
Okay now this is weird, today the Reporting Services was not running and here are the entries in the event log:
Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7041
Date: 12/12/2007
Time: 9:47:22
User: N/A
Computer: TFS
Description:
The ReportServer service was unable to log on as DOMAINTFSREPORTS with the currently configured password due to the following error:
Logon failure: the user has not been granted the requested logon type at this computer.
Service: ReportServer
Domain and account: DOMAINTFSREPORTS
This service account does not have the necessary user right "Log on as a service."
User Action
Assign "Log on as a service" to the service account on this computer. You can use Local Security Settings (Secpol.msc) to do this. If this computer is a node in a cluster, check that this user right is assigned to the Cluster service account on all nodes in the cluster.
If you have already assigned this user right to the service account, and the user right appears to be removed, a Group Policy object associated with this node might be removing the right. Check with your domain administrator to find out if this is happening.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp
I am the administrator of the machines and I can assure you that no domain policy has changed for a couple of weeks. What should I look for?
My replication is not working. I was able to create a transactional replication successfully. However, when i tried starting the agent on the snapshot, it wouldn't work. I figure that it was because my agent service login is different from that of the subscriber. my publisher and distributor is on local user whereas my subsciber sql services use our global login.
Thank you in advance. Good day!
Using Transact SQL how can I retrieve the network user name by accessing the API apiGetUserName.
I would like to some how create a stored procedure that will retrieve the user name when a user tries to access the data in a table(s).
My Report service account, by default "Network Service" in the config manager.
some of my onsite people my mistakenly changed the SSRS service account to the "Local system".
when I am trying to change it back, Manager is ask to create the dialog box 2(encrypt key) given below...
When try to create the encrypt account , report server is stopped working..I had changed the properties of the reporting services also..
Hi,
I would appreciate any thoughts/ideas on the following use case for the distributed service broker application we plan to migrate from our existing proprietary tcp based message protocol using database tables for reliability.
There are two ssb services running in separate sql server instances, each on a different server machine. For simplicity, let us assume the ssb endpoint names are SSBA, SSBB. SSBB is the Initiator of the Dialog while SSBA is the Target. Now the requirement is that if the underlying network communication between the two ssb endpoints(SSBA and SSBB) is broken or if the critical service SSBB is down, then processing of any incoming message into SSBA's queue from a third service broker service (say SSBEXPR) running within a SqlExpress instance should be delayed until SSBB is alive and network communication between SSBA and SSBB is established. In our existing implementation (wherein SSBA, SSBB and SSBEXPR are windows services) we use a combination of TCP socket disconnects and Heartbeat messages between SSBA and SSBB to determine the health of network connection and that of the SSBB service.
Now my understanding of how the underlying network connection for a ssb dialog works is that if there is no activity on a dialog for a certain amount of time then the underlying network connection is closed. Is there a way to specify the amount of time to say infinite value or something and thus change this behavior? My other question is how can one query the underlying network connection (i.e. a row from sys.dm_broker_connections) associated with a particular conversation? If none of this is possible, then any other patterns/ideas/approach is welcome.
Thanks,
I am running Microsoft SQL Server 2012 SP on a Windows Server 2008 R2 Standard SP1 box. The SQL Server service is running as a simple windows domain user (nothing special, no admin rights, etc.) I am having some issues with using Bulk Insert when the data file is on a network share when using Windows Authentication. What is known is that the SQL Server service account has access to the network resource, which is shown by logging into SQL Server with a SQL account and doing the Bulk Insert. I also have rights to the files on the share, as shown by the fact that I put the files there. My SQL is in the form of:
Bulk Insert [table name] From '[server][share][filename]' With (FirstRow = 2, FormatFile='FormatFile.xml')
Now, when connecting to SQL Server with Windows Authentication and running the Bulk Insert I get the following error:
Msg 4861, Level 16, State 1, Line 2 Cannot bulk load because the file "[server][share][filename]" could not be opened. Operating system error code 5(Access is denied.).
I found this snip at
BULK INSERT (Transact-SQL)Security Account Delegation (Impersonation), which says, in part (emphasis mine):
To resolve this error [4861], use SQL Server Authentication and specify a SQL Server login that uses the security profile of the SQL Server process account, or configure Windows to enable security account delegation. For information about how to enable a user account to be trusted for delegation.
How to Configure the Server to be Trusted for Delegation, and we tried the unconstrained delegation and I rebooted the SQL server, but it still does not work. Later we tried constrained delegation and it still does not work.
I have verified the SPNs:
C:>setspn adsvc_sqlRegistered ServicePrincipalNames for CN=SVC_SQL,OU=Service Accounts,OU=Users,OU=ad domain,DC=ad,DC=local: MSSQLSvc/SQLQA.ad.local:1433 MSSQLSvc/SQLDev.ad.local:1433 MSSQLSvc/SQLQA.ad.local MSSQLSvc/SQLDev.ad.local
I have verified that my SQL connection is TCP and I am getting/using a Kerberos security token.
C:>sqlcmd -S tcp:SQLQA.ad.local,1433 -E1> Select dec.net_transport, dec.auth_scheme From sys.dm_exec_connections As dec Where session_id = @@Spid;2>
gonet_transport auth_scheme------------- -----------TCP KERBEROS(1 rows affected)1>
If I move the source file to a local drive (on the SQL server), all works fine, but I must be able to read from a file share?
I've been trying to workout how, without impersonation, I can allow an application running under the default ASPNET user to access a network resource (SQL Server/ADAM) not on the same physical machine.
It seems that because the ASPNET user is a local user not a domain user I can't setup windows authentication on the network resource. That seems to leave impersonation which MS et al say is unwise.
Have I mised something here?
Regards,
Steve.
Can a SQL Server 2005 Compact Edition database file be deployed on a file share and be accessed by multiple (5-10) concurrent users? This is a current scenario being implemented at several sites using MS Access databases.
Each client would have the SQLce engine installed on it and would only access the database via a managed C# application.
I execute a pretty big sql query which joins multiple tables and I reviewed indexes on all these tables. I am happy with the result when I run the query using SSMS in the server locally i.e., where my SQL Server database is installed. It takes 4 seconds to get around 17000 records. If I run the same query in a network or from my desktop using SSMS i.e., i connect to the above mentioned SQL Server using SSMS, it takes more than 60 seconds. Not sure how to solve this. If someone could help me, it will be of great help.
Thanks.
When i wanna run Application in other computers in network. The following error occurs.
error : System.Data.SqlClient.SqlException: Login failed for user 'Suren-PCGuest'.ConnectionStr = "Data Source=SUREN-PCMSSQLSERVER,1433;Initial Catalog=WorkFlow;Integrated Security=True";
hi all
when my snapshot folder is on a network drive, on which "simple filesharing" is enabled, i can access that folder without typing a user and password and configuring login security settings.
but in fact the network drive on which the snapshot folder will be located will do have a login and password. (when i go to it with windows explorer, i have to enter my login and password).
won't this cause problems for the replication? as i don't see where to enter net network login when i configure the replication via the wizard.
Thanks for help
I currently have the fllowing Stored Procedure. When I pass the the Url of the web service in the parameters, I'm having a sp_OAMethor read response failed error.
I don't know how to pass the parameter as well as the name of the function in the Web Service I'm calling. Maybe I'm all wrong here with this code too?
Thanks for any help.
ALTER PROCEDURE [dbo].[pTAPServiceWeb]
@sUrl varchar(200),
@response varchar(8000) out
AS
DECLARE @obj int
DECLARE @hr int
DECLARE @status int
DECLARE @msg varchar(255)
EXEC @hr = sp_OACreate 'MSXML2.ServerXMLHttp', @obj OUT
IF @hr < 0
BEGIN
RAISERROR('sp_OACreate MSXML2.ServerXMLHttp failed', 16, 1)
RETURN
END
EXEC @hr = sp_OAMethod @obj, 'Open', NULL, 'GET', @sUrl, false
IF @hr < 0
BEGIN
SET @msg = 'sp_OAMethod Open failed'
GOTO err
END
EXEC @hr = sp_OAMethod @obj, 'send'
IF @hr < 0
BEGIN
SET @msg = 'sp_OAMethod Send failed'
GOTO err
END
EXEC @hr = sp_OAGetProperty @obj, 'status', @status OUT
IF @hr < 0
BEGIN
SET @msg = 'sp_OAMethod read status failed'
GOTO err
END
-- IF @status <> 200
-- BEGIN
-- SET @msg = 'sp_OAMethod http status ' + str(@status)
-- GOTO err
-- END
EXEC @hr = sp_OAGetProperty @obj, 'responseText', @response OUT
IF @hr < 0
BEGIN
SET @msg = 'sp_OAMethod read response failed'
GOTO err
END
EXEC @hr = sp_OADestroy @obj
RETURN
err:
EXEC @hr = sp_OADestroy @obj
RAISERROR(@msg, 16, 1)
RETURN
GO
I have data in the below format
Service Numbers start datetime enddate time part number Calc(in hrs (endate - startdate)
223344 2014-05-05 2014-05-07 12345 48
223344 2014-05-05 2014-05-07 56789 48
223355 2014-05-06 2014-05-07 17865 24
223355 2014-05-06 2014-05-07 76543 24
345627 2014-05-09 2014-05-013 76543 72
I want measure like sum of hours of distinct service numbers.I want to use it in a reporting tool.
it means my sum will be 144 and my Average of per time closed will be 144/3 = 48.
How to create a measure like that ?
I'm running into an interesting issue when returning a response from an XML-based web service. The following code returns good values from PRINT
@response
DECLARE @address varchar(50) = '90210'
DECLARE @URL varchar(MAX)
SET @URL = 'https://somewebsite/map.xml?zip=' +
CASE WHEN @Address IS NOT NULL THEN @Address ELSE '' END
SET @URL = REPLACE(@URL, ' ', '+')
[code]...
However, on some calls to the web service, the value returned is longer than 4000 characters. In these instances, it appears as though it breaks the whole thing and returns nothing. However, if I change the @Response parameter to nvarchar(max), it never returns anything, even on responses that are shorter than 4000 characters. what the fundamental difference is here between nvarchar(4000) and nvarchar(max) with respects to how it stores responseText. More importantly, how to get this to return a value even when it exceeds 4,000 characters?
Does anyone know if it is possible (and if yes, how) to create a trigger that creates a folder for every inserted record?
In a specific root folder, I want a subfolder for every record in the table. How does the trigger have to look like to make the folder automatically with every insert of a new record???
thanks!!