Authentication Modes

I am trying to install and configure Office Server Extensions on our web server, but when I configure them and put the information about the discussion server and press next it bombs on me. I already created the database and gave it a user name and password. I tried to look up the error message and found only one that seemed like it was close. Our SQL server is set up with SQL Server and Windows authentication mode. The fix for the error I found says that I thought edit SQL Server Registration properties and change under Connection from Windows Authentication to Use SQL Server authentication. I want to try this and see if this fix works to configure the OSEs correctly. My question is can I change SQL server to Use SQL server authentication without any problems with the other databases or will someone logging into the server be blocked from access the database they need? ThanksAccording to the info you provided, your server is already configured to handle SQL Server Authentication. There is no conflct in haveing both athentication modes active at the same time.

Authentication

I just wonder my office server setup:
In EM:
1) Right click the instance, select 'Edit SQL Server Registration
properties...'
2) The 'Use Windows authentication' radio button is selected
3) Right click to select the instance, select 'Properties'
4) Security tab
5) 'SQL Server and Windows' authentication radio button is selected
6) Then I created a SQL Server login, eg. username is 'Alan', password is
also 'Alan'
So is this SQL Server 'Windows only' or 'SQL Server and Windows'
authentication ?it's still 'windows authentication only'. your sql login is created/valid
but it will not allow you to connect to sqlserver.
-oj
"Alan" <alanpltseNOSPAM@.yahoo.com.au> wrote in message
news:eYzuHORkGHA.3512@.TK2MSFTNGP03.phx.gbl...
>I just wonder my office server setup:
> In EM:
> 1) Right click the instance, select 'Edit SQL Server Registration
> properties...'
> 2) The 'Use Windows authentication' radio button is selected
> 3) Right click to select the instance, select 'Properties'
> 4) Security tab
> 5) 'SQL Server and Windows' authentication radio button is selected
> 6) Then I created a SQL Server login, eg. username is 'Alan', password is
> also 'Alan'
> So is this SQL Server 'Windows only' or 'SQL Server and Windows'
> authentication ?
>
>|||Its mixed mode authentication enabled.
You have registered server using windows authentication but you can
connect also using sql server login.
Regards
Amish Shah
oj wrote:
> it's still 'windows authentication only'. your sql login is created/valid
> but it will not allow you to connect to sqlserver.
>
> --
> -oj
>
> "Alan" <alanpltseNOSPAM@.yahoo.com.au> wrote in message
> news:eYzuHORkGHA.3512@.TK2MSFTNGP03.phx.gbl...
> >I just wonder my office server setup:
> >
> > In EM:
> > 1) Right click the instance, select 'Edit SQL Server Registration
> > properties...'
> > 2) The 'Use Windows authentication' radio button is selected
> > 3) Right click to select the instance, select 'Properties'
> > 4) Security tab
> > 5) 'SQL Server and Windows' authentication radio button is selected
> > 6) Then I created a SQL Server login, eg. username is 'Alan', password is
> > also 'Alan'
> >
> > So is this SQL Server 'Windows only' or 'SQL Server and Windows'
> > authentication ?
> >
> >
> >|||Alan wrote:
> I just wonder my office server setup:
> In EM:
> 1) Right click the instance, select 'Edit SQL Server Registration
> properties...'
> 2) The 'Use Windows authentication' radio button is selected
> 3) Right click to select the instance, select 'Properties'
> 4) Security tab
> 5) 'SQL Server and Windows' authentication radio button is selected
> 6) Then I created a SQL Server login, eg. username is 'Alan', password is
> also 'Alan'
> So is this SQL Server 'Windows only' or 'SQL Server and Windows'
> authentication ?
>
>
The authentication mode specified in the Registration properties has
nothing to do with the authentication mode that the server is using, it
only tells Enterprise Manager what sort of authentication method to use
when connecting to the server.
In your case, your SERVER is setup for mixed-mode authentication,
meaning it will accept either Windows credentials, or a valid SQL
login/password combo.
When you connect to it using your current Enterprise Manager
registration, EM is passing your current Windows login credentials to
the server, your SQL login "Alan" isn't being used at all. You can
confirm this by looking at the sysprocesses table after connecting from
EM, you'll see your spid, along with the login name that you're
connected with.|||my bad (should have read your post carefully before answering)...>> 5) 'SQL
Server and Windows' authentication radio button is selected<<
means the server is setup for mixed mode. Under this mode, you can connect
to sqlserver with either windows acct or sql login.
If you have properly created "alan" sql login, you should be able to connect
to sqlserver with that acct. The easiest way to test is to open Query
Analyzer (from Tools menu) and use "alan" as the credential.
--
-oj
"oj" <nospam_ojngo@.home.com> wrote in message
news:u$4pxhRkGHA.1204@.TK2MSFTNGP02.phx.gbl...
> it's still 'windows authentication only'. your sql login is created/valid
> but it will not allow you to connect to sqlserver.
>
> --
> -oj
>
> "Alan" <alanpltseNOSPAM@.yahoo.com.au> wrote in message
> news:eYzuHORkGHA.3512@.TK2MSFTNGP03.phx.gbl...
>>I just wonder my office server setup:
>> In EM:
>> 1) Right click the instance, select 'Edit SQL Server Registration
>> properties...'
>> 2) The 'Use Windows authentication' radio button is selected
>> 3) Right click to select the instance, select 'Properties'
>> 4) Security tab
>> 5) 'SQL Server and Windows' authentication radio button is selected
>> 6) Then I created a SQL Server login, eg. username is 'Alan', password is
>> also 'Alan'
>> So is this SQL Server 'Windows only' or 'SQL Server and Windows'
>> authentication ?
>>
>|||So in 'registration properties' determines what mode is using to connect
when opening the 'EM' to connection SQL Server ?
Only the 'Properties' determine how the login connect the server ?
"Tracy McKibben" <tracy@.realsqlguy.com> wrote in message
news:%23tqJ3YUkGHA.5036@.TK2MSFTNGP04.phx.gbl...
> Alan wrote:
>> I just wonder my office server setup:
>> In EM:
>> 1) Right click the instance, select 'Edit SQL Server Registration
>> properties...'
>> 2) The 'Use Windows authentication' radio button is selected
>> 3) Right click to select the instance, select 'Properties'
>> 4) Security tab
>> 5) 'SQL Server and Windows' authentication radio button is selected
>> 6) Then I created a SQL Server login, eg. username is 'Alan', password is
>> also 'Alan'
>> So is this SQL Server 'Windows only' or 'SQL Server and Windows'
>> authentication ?
>>
> The authentication mode specified in the Registration properties has
> nothing to do with the authentication mode that the server is using, it
> only tells Enterprise Manager what sort of authentication method to use
> when connecting to the server.
> In your case, your SERVER is setup for mixed-mode authentication, meaning
> it will accept either Windows credentials, or a valid SQL login/password
> combo.
> When you connect to it using your current Enterprise Manager registration,
> EM is passing your current Windows login credentials to the server, your
> SQL login "Alan" isn't being used at all. You can confirm this by looking
> at the sysprocesses table after connecting from EM, you'll see your spid,
> along with the login name that you're connected with.|||Alan T wrote:
> So in 'registration properties' determines what mode is using to connect
> when opening the 'EM' to connection SQL Server ?
> Only the 'Properties' determine how the login connect the server ?
>
Correct
Tracy McKibben
MCDBA
http://www.realsqlguy.comsql

Attempt to catch error using @@ERROR in SQL 2000 is failing

We have a stored procedure that calculates the floor nr for users at our company campus using their office location. The calculation is done by a function that returns an integer. Unfortunately, not all users enter their information correctly so the function sometimes raises an error. Below is the code of that stored procedure.

UPDATE PERSONS

SET FLOORNR = dbo.FloorNR(OFFICELOCATION)

WHERE OFFICELOCATION IS NOT NULL

IF(@.@.ERROR <> 0 OR @.@.ROWCOUNT = 0)

BEGIN

RAISERROR ('Failed to calculate the floor number', 16, 1 ) with nowait

END

However, when the function dbo.FloorNR fails, it doesn't raise our error, but it seems to raise the error that comes from dbo.FloorNR.

How can we catch errors that come from dbo.FloorNr so that we can raise our own error? Our company still uses SQL 2000, so we cannot use the SQL 2005 try/catch option.

Is it possible for you to try to handle some of those situations inside of the function and have it not return any values in the case of an error?|||We already handle a number of situations inside the functions. But once every week a user finds a new way to enter his office location and our procedure stops responding. At the moment, we have no way of controlling the input by our users, but we don't want to keep on expanding the procedure. In fact, we just want users to enter their office location in a standard way. We will change the application which handles that, but that change is still some months away. Untill then, we just want the catch any errors and log them.

Attaching DB & Security

Hi,
I want to prevent others from attaching my database, is it possible? Imagine
that the administrator at customer's office stops SQL Server Service and
copies our DB. How can I protect it?
Any help is appreciated.
Leila
Leila
Remove them from sysadmin server role . If they aren't remove them from
dbcreator server role
"Leila" <Leilas@.hotpop.com> wrote in message
news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
> Hi,
> I want to prevent others from attaching my database, is it possible?
> Imagine
> that the administrator at customer's office stops SQL Server Service and
> copies our DB. How can I protect it?
> Any help is appreciated.
> Leila
>
>
|||I do not think you can prevent them from doing that if they have full
control to their OWN computer ( and the SQL Server on that computer ).
"Leila" <Leilas@.hotpop.com> wrote in message
news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
> Hi,
> I want to prevent others from attaching my database, is it possible?
> Imagine
> that the administrator at customer's office stops SQL Server Service and
> copies our DB. How can I protect it?
> Any help is appreciated.
> Leila
>
>
|||That won't work because admin of windows can stop sql server and copy mdf
and ldf files(even if he doesn't have any login in sql server)
"Uri Dimant" <urid@.iscar.co.il> wrote in message
news:OcVtQjaAHHA.3560@.TK2MSFTNGP03.phx.gbl...
> Leila
> Remove them from sysadmin server role . If they aren't remove them from
> dbcreator server role
>
> "Leila" <Leilas@.hotpop.com> wrote in message
> news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
>
|||"Leila" <Leilas@.hotpop.com> wrote in message
news:OC9nkAdAHHA.1556@.TK2MSFTNGP03.phx.gbl...
> That won't work because admin of windows can stop sql server and copy mdf
> and ldf files(even if he doesn't have any login in sql server)
Quite honestly, at this point if you can't trust them, you've got other
issues.

>
> "Uri Dimant" <urid@.iscar.co.il> wrote in message
> news:OcVtQjaAHHA.3560@.TK2MSFTNGP03.phx.gbl...
>
|||Correct...you really can't. What are you trying to protect
though? If it's an intellectual property type of thing and
these are your customers, licensing/legal agreements is
probably what you'd want to focus on.
-Sue
On Mon, 6 Nov 2006 21:49:26 +0330, "Leila"
<Leilas@.hotpop.com> wrote:

>That won't work because admin of windows can stop sql server and copy mdf
>and ldf files(even if he doesn't have any login in sql server)
>
>"Uri Dimant" <urid@.iscar.co.il> wrote in message
>news:OcVtQjaAHHA.3560@.TK2MSFTNGP03.phx.gbl...
>
|||Leila
How many admins do you have at your shop? There are server fixed roles that
you add those people , not all of them should be members of sysadmin server
role
http://vyaskn.tripod.com/sql_server_security_best_practices.htm --security
best practices
"Leila" <Leilas@.hotpop.com> wrote in message
news:%23iljU%23kAHHA.1196@.TK2MSFTNGP03.phx.gbl...
>I don't agree! When a person becomes admin, only his skills are proved to
>the boss, not other things. Why should we trust him when there are
>sensitive data? Why is it advised to remove built-in administrators account
>from sql server logins? Why you can set a password for backup set? These
>prove that you cannot trust to all admins!
>
> "Greg D. Moore (Strider)" <mooregr_deleteth1s@.greenms.com> wrote in
> message
> news:ONHpg0gAHHA.996@.TK2MSFTNGP02.phx.gbl...
>
>
|||They are not member of sysadmin! The security threat is outside of sql
server, the windows admins!
"Uri Dimant" <urid@.iscar.co.il> wrote in message
news:OpSWIKlAHHA.4496@.TK2MSFTNGP02.phx.gbl...
> Leila
> How many admins do you have at your shop? There are server fixed roles
> that you add those people , not all of them should be members of sysadmin
> server role
> ttp://vyaskn.tripod.com/sql_server_security_best_practices.htm --security
> best practices
>
> "Leila" <Leilas@.hotpop.com> wrote in message
> news:%23iljU%23kAHHA.1196@.TK2MSFTNGP03.phx.gbl...
>
|||The machine admins can always get access to your data, especially if they
also have physical access to the machine. They can debug the process, they
can dump the memory, they can install key loggers, they can patch the
server, and so on. The only way to really protect your data against them is
to not give it to them in clear. Encrypt it before you pass it to the server
and decrypt it after you get it back. However, this is probably not
something that you can afford to do. So, you'll have to rely instead on
auditing, so if an admin does something bad, you can at least collect some
proof of what they did and use it to get legal compensation for the damages
caused by the data theft. You can also use other measures, to make getting
at the data harder, but you have to keep in mind that all these measures
would only slow down an attacker; you cannot build an impenetrable barrier
against the guy that can do whatever he wants with the physical machine. You
could use, for example, encryption, so a machine admin would have to find a
way to get at the keys to decrypt the data, and this would slow him down,
but it wouldn't necessarily stop him. So, the right question to ask is not
how you can stop machine administrators from getting the data, but how can
you deter them from doing so.
Some suggestions for deterring access:
- Have an auditing policy in place - verify audit trails and investigate
suspicious activity.
- Encrypt your sensitive data
- If possible, have administrators work without physical access to the
machine and have a different person perform the physical maintenance of the
machine
Thanks
Laurentiu Cristofor [MSFT]
Software Development Engineer
SQL Server Engine
http://blogs.msdn.com/lcris/
This posting is provided "AS IS" with no warranties, and confers no rights.
"Leila" <Leilas@.hotpop.com> wrote in message
news:eTwSvulAHHA.4024@.TK2MSFTNGP04.phx.gbl...
> They are not member of sysadmin! The security threat is outside of sql
> server, the windows admins!
>
> "Uri Dimant" <urid@.iscar.co.il> wrote in message
> news:OpSWIKlAHHA.4496@.TK2MSFTNGP02.phx.gbl...
>
|||"Leila" <Leilas@.hotpop.com> wrote in message
news:%23iljU%23kAHHA.1196@.TK2MSFTNGP03.phx.gbl...
>I don't agree! When a person becomes admin, only his skills are proved to
>the boss, not other things. Why should we trust him when there are
>sensitive data?
Because you gave him the job. Quite honestly if the only criteria you set
is skill then I would argue that's a mistake.

> Why is it advised to remove built-in administrators account from sql
> server logins? Why you can set a password for backup set? These prove that
> you cannot trust to all admins!
>
> "Greg D. Moore (Strider)" <mooregr_deleteth1s@.greenms.com> wrote in
> message
> news:ONHpg0gAHHA.996@.TK2MSFTNGP02.phx.gbl...
>
>

Attaching DB & Security

Hi,
I want to prevent others from attaching my database, is it possible? Imagine
that the administrator at customer's office stops SQL Server Service and
copies our DB. How can I protect it?
Any help is appreciated.
LeilaLeila
Remove them from sysadmin server role . If they aren't remove them from
dbcreator server role
"Leila" <Leilas@.hotpop.com> wrote in message
news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
> Hi,
> I want to prevent others from attaching my database, is it possible?
> Imagine
> that the administrator at customer's office stops SQL Server Service and
> copies our DB. How can I protect it?
> Any help is appreciated.
> Leila
>
>|||I do not think you can prevent them from doing that if they have full
control to their OWN computer ( and the SQL Server on that computer ).
"Leila" <Leilas@.hotpop.com> wrote in message
news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
> Hi,
> I want to prevent others from attaching my database, is it possible?
> Imagine
> that the administrator at customer's office stops SQL Server Service and
> copies our DB. How can I protect it?
> Any help is appreciated.
> Leila
>
>|||That won't work because admin of windows can stop sql server and copy mdf
and ldf files(even if he doesn't have any login in sql server)
"Uri Dimant" <urid@.iscar.co.il> wrote in message
news:OcVtQjaAHHA.3560@.TK2MSFTNGP03.phx.gbl...
> Leila
> Remove them from sysadmin server role . If they aren't remove them from
> dbcreator server role
>
> "Leila" <Leilas@.hotpop.com> wrote in message
> news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
>> Hi,
>> I want to prevent others from attaching my database, is it possible?
>> Imagine
>> that the administrator at customer's office stops SQL Server Service and
>> copies our DB. How can I protect it?
>> Any help is appreciated.
>> Leila
>>
>|||"Leila" <Leilas@.hotpop.com> wrote in message
news:OC9nkAdAHHA.1556@.TK2MSFTNGP03.phx.gbl...
> That won't work because admin of windows can stop sql server and copy mdf
> and ldf files(even if he doesn't have any login in sql server)
Quite honestly, at this point if you can't trust them, you've got other
issues.
>
> "Uri Dimant" <urid@.iscar.co.il> wrote in message
> news:OcVtQjaAHHA.3560@.TK2MSFTNGP03.phx.gbl...
>> Leila
>> Remove them from sysadmin server role . If they aren't remove them from
>> dbcreator server role
>>
>> "Leila" <Leilas@.hotpop.com> wrote in message
>> news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
>> Hi,
>> I want to prevent others from attaching my database, is it possible?
>> Imagine
>> that the administrator at customer's office stops SQL Server Service and
>> copies our DB. How can I protect it?
>> Any help is appreciated.
>> Leila
>>
>>
>|||Correct...you really can't. What are you trying to protect
though? If it's an intellectual property type of thing and
these are your customers, licensing/legal agreements is
probably what you'd want to focus on.
-Sue
On Mon, 6 Nov 2006 21:49:26 +0330, "Leila"
<Leilas@.hotpop.com> wrote:
>That won't work because admin of windows can stop sql server and copy mdf
>and ldf files(even if he doesn't have any login in sql server)
>
>"Uri Dimant" <urid@.iscar.co.il> wrote in message
>news:OcVtQjaAHHA.3560@.TK2MSFTNGP03.phx.gbl...
>> Leila
>> Remove them from sysadmin server role . If they aren't remove them from
>> dbcreator server role
>>
>> "Leila" <Leilas@.hotpop.com> wrote in message
>> news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
>> Hi,
>> I want to prevent others from attaching my database, is it possible?
>> Imagine
>> that the administrator at customer's office stops SQL Server Service and
>> copies our DB. How can I protect it?
>> Any help is appreciated.
>> Leila
>>
>>
>|||I don't agree! When a person becomes admin, only his skills are proved to
the boss, not other things. Why should we trust him when there are sensitive
data? Why is it advised to remove built-in administrators account from sql
server logins? Why you can set a password for backup set? These prove that
you cannot trust to all admins!
"Greg D. Moore (Strider)" <mooregr_deleteth1s@.greenms.com> wrote in message
news:ONHpg0gAHHA.996@.TK2MSFTNGP02.phx.gbl...
> "Leila" <Leilas@.hotpop.com> wrote in message
> news:OC9nkAdAHHA.1556@.TK2MSFTNGP03.phx.gbl...
>> That won't work because admin of windows can stop sql server and copy mdf
>> and ldf files(even if he doesn't have any login in sql server)
> Quite honestly, at this point if you can't trust them, you've got other
> issues.
>
>>
>> "Uri Dimant" <urid@.iscar.co.il> wrote in message
>> news:OcVtQjaAHHA.3560@.TK2MSFTNGP03.phx.gbl...
>> Leila
>> Remove them from sysadmin server role . If they aren't remove them from
>> dbcreator server role
>>
>> "Leila" <Leilas@.hotpop.com> wrote in message
>> news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
>> Hi,
>> I want to prevent others from attaching my database, is it possible?
>> Imagine
>> that the administrator at customer's office stops SQL Server Service
>> and
>> copies our DB. How can I protect it?
>> Any help is appreciated.
>> Leila
>>
>>
>>
>|||Leila
How many admins do you have at your shop? There are server fixed roles that
you add those people , not all of them should be members of sysadmin server
role
http://vyaskn.tripod.com/sql_server_security_best_practices.htm --security
best practices
"Leila" <Leilas@.hotpop.com> wrote in message
news:%23iljU%23kAHHA.1196@.TK2MSFTNGP03.phx.gbl...
>I don't agree! When a person becomes admin, only his skills are proved to
>the boss, not other things. Why should we trust him when there are
>sensitive data? Why is it advised to remove built-in administrators account
>from sql server logins? Why you can set a password for backup set? These
>prove that you cannot trust to all admins!
>
> "Greg D. Moore (Strider)" <mooregr_deleteth1s@.greenms.com> wrote in
> message
> news:ONHpg0gAHHA.996@.TK2MSFTNGP02.phx.gbl...
>> "Leila" <Leilas@.hotpop.com> wrote in message
>> news:OC9nkAdAHHA.1556@.TK2MSFTNGP03.phx.gbl...
>> That won't work because admin of windows can stop sql server and copy
>> mdf
>> and ldf files(even if he doesn't have any login in sql server)
>> Quite honestly, at this point if you can't trust them, you've got other
>> issues.
>>
>>
>> "Uri Dimant" <urid@.iscar.co.il> wrote in message
>> news:OcVtQjaAHHA.3560@.TK2MSFTNGP03.phx.gbl...
>> Leila
>> Remove them from sysadmin server role . If they aren't remove them from
>> dbcreator server role
>>
>> "Leila" <Leilas@.hotpop.com> wrote in message
>> news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
>> Hi,
>> I want to prevent others from attaching my database, is it possible?
>> Imagine
>> that the administrator at customer's office stops SQL Server Service
>> and
>> copies our DB. How can I protect it?
>> Any help is appreciated.
>> Leila
>>
>>
>>
>>
>
>|||They are not member of sysadmin! The security threat is outside of sql
server, the windows admins!
"Uri Dimant" <urid@.iscar.co.il> wrote in message
news:OpSWIKlAHHA.4496@.TK2MSFTNGP02.phx.gbl...
> Leila
> How many admins do you have at your shop? There are server fixed roles
> that you add those people , not all of them should be members of sysadmin
> server role
> ttp://vyaskn.tripod.com/sql_server_security_best_practices.htm --security
> best practices
>
> "Leila" <Leilas@.hotpop.com> wrote in message
> news:%23iljU%23kAHHA.1196@.TK2MSFTNGP03.phx.gbl...
>>I don't agree! When a person becomes admin, only his skills are proved to
>>the boss, not other things. Why should we trust him when there are
>>sensitive data? Why is it advised to remove built-in administrators
>>account from sql server logins? Why you can set a password for backup set?
>>These prove that you cannot trust to all admins!
>>
>> "Greg D. Moore (Strider)" <mooregr_deleteth1s@.greenms.com> wrote in
>> message
>> news:ONHpg0gAHHA.996@.TK2MSFTNGP02.phx.gbl...
>> "Leila" <Leilas@.hotpop.com> wrote in message
>> news:OC9nkAdAHHA.1556@.TK2MSFTNGP03.phx.gbl...
>> That won't work because admin of windows can stop sql server and copy
>> mdf
>> and ldf files(even if he doesn't have any login in sql server)
>> Quite honestly, at this point if you can't trust them, you've got other
>> issues.
>>
>>
>> "Uri Dimant" <urid@.iscar.co.il> wrote in message
>> news:OcVtQjaAHHA.3560@.TK2MSFTNGP03.phx.gbl...
>> Leila
>> Remove them from sysadmin server role . If they aren't remove them
>> from
>> dbcreator server role
>>
>> "Leila" <Leilas@.hotpop.com> wrote in message
>> news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
>> Hi,
>> I want to prevent others from attaching my database, is it possible?
>> Imagine
>> that the administrator at customer's office stops SQL Server Service
>> and
>> copies our DB. How can I protect it?
>> Any help is appreciated.
>> Leila
>>
>>
>>
>>
>>
>>
>|||The machine admins can always get access to your data, especially if they
also have physical access to the machine. They can debug the process, they
can dump the memory, they can install key loggers, they can patch the
server, and so on. The only way to really protect your data against them is
to not give it to them in clear. Encrypt it before you pass it to the server
and decrypt it after you get it back. However, this is probably not
something that you can afford to do. So, you'll have to rely instead on
auditing, so if an admin does something bad, you can at least collect some
proof of what they did and use it to get legal compensation for the damages
caused by the data theft. You can also use other measures, to make getting
at the data harder, but you have to keep in mind that all these measures
would only slow down an attacker; you cannot build an impenetrable barrier
against the guy that can do whatever he wants with the physical machine. You
could use, for example, encryption, so a machine admin would have to find a
way to get at the keys to decrypt the data, and this would slow him down,
but it wouldn't necessarily stop him. So, the right question to ask is not
how you can stop machine administrators from getting the data, but how can
you deter them from doing so.
Some suggestions for deterring access:
- Have an auditing policy in place - verify audit trails and investigate
suspicious activity.
- Encrypt your sensitive data
- If possible, have administrators work without physical access to the
machine and have a different person perform the physical maintenance of the
machine
Thanks
--
Laurentiu Cristofor [MSFT]
Software Development Engineer
SQL Server Engine
http://blogs.msdn.com/lcris/
This posting is provided "AS IS" with no warranties, and confers no rights.
"Leila" <Leilas@.hotpop.com> wrote in message
news:eTwSvulAHHA.4024@.TK2MSFTNGP04.phx.gbl...
> They are not member of sysadmin! The security threat is outside of sql
> server, the windows admins!
>
> "Uri Dimant" <urid@.iscar.co.il> wrote in message
> news:OpSWIKlAHHA.4496@.TK2MSFTNGP02.phx.gbl...
>> Leila
>> How many admins do you have at your shop? There are server fixed roles
>> that you add those people , not all of them should be members of sysadmin
>> server role
>>
>> tp://vyaskn.tripod.com/sql_server_security_best_practices.htm --security
>> best practices
>>
>> "Leila" <Leilas@.hotpop.com> wrote in message
>> news:%23iljU%23kAHHA.1196@.TK2MSFTNGP03.phx.gbl...
>>I don't agree! When a person becomes admin, only his skills are proved to
>>the boss, not other things. Why should we trust him when there are
>>sensitive data? Why is it advised to remove built-in administrators
>>account from sql server logins? Why you can set a password for backup
>>set? These prove that you cannot trust to all admins!
>>
>> "Greg D. Moore (Strider)" <mooregr_deleteth1s@.greenms.com> wrote in
>> message
>> news:ONHpg0gAHHA.996@.TK2MSFTNGP02.phx.gbl...
>> "Leila" <Leilas@.hotpop.com> wrote in message
>> news:OC9nkAdAHHA.1556@.TK2MSFTNGP03.phx.gbl...
>> That won't work because admin of windows can stop sql server and copy
>> mdf
>> and ldf files(even if he doesn't have any login in sql server)
>> Quite honestly, at this point if you can't trust them, you've got other
>> issues.
>>
>>
>> "Uri Dimant" <urid@.iscar.co.il> wrote in message
>> news:OcVtQjaAHHA.3560@.TK2MSFTNGP03.phx.gbl...
>> Leila
>> Remove them from sysadmin server role . If they aren't remove them
>> from
>> dbcreator server role
>>
>> "Leila" <Leilas@.hotpop.com> wrote in message
>> news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
>>> Hi,
>>> I want to prevent others from attaching my database, is it possible?
>>> Imagine
>>> that the administrator at customer's office stops SQL Server Service
>>> and
>>> copies our DB. How can I protect it?
>>> Any help is appreciated.
>>> Leila
>>>
>>>
>>>
>>
>>
>>
>>
>>
>|||"Leila" <Leilas@.hotpop.com> wrote in message
news:%23iljU%23kAHHA.1196@.TK2MSFTNGP03.phx.gbl...
>I don't agree! When a person becomes admin, only his skills are proved to
>the boss, not other things. Why should we trust him when there are
>sensitive data?
Because you gave him the job. Quite honestly if the only criteria you set
is skill then I would argue that's a mistake.
> Why is it advised to remove built-in administrators account from sql
> server logins? Why you can set a password for backup set? These prove that
> you cannot trust to all admins!
>
> "Greg D. Moore (Strider)" <mooregr_deleteth1s@.greenms.com> wrote in
> message
> news:ONHpg0gAHHA.996@.TK2MSFTNGP02.phx.gbl...
>> "Leila" <Leilas@.hotpop.com> wrote in message
>> news:OC9nkAdAHHA.1556@.TK2MSFTNGP03.phx.gbl...
>> That won't work because admin of windows can stop sql server and copy
>> mdf
>> and ldf files(even if he doesn't have any login in sql server)
>> Quite honestly, at this point if you can't trust them, you've got other
>> issues.
>>
>>
>> "Uri Dimant" <urid@.iscar.co.il> wrote in message
>> news:OcVtQjaAHHA.3560@.TK2MSFTNGP03.phx.gbl...
>> Leila
>> Remove them from sysadmin server role . If they aren't remove them from
>> dbcreator server role
>>
>> "Leila" <Leilas@.hotpop.com> wrote in message
>> news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
>> Hi,
>> I want to prevent others from attaching my database, is it possible?
>> Imagine
>> that the administrator at customer's office stops SQL Server Service
>> and
>> copies our DB. How can I protect it?
>> Any help is appreciated.
>> Leila
>>
>>
>>
>>
>
>|||Why is a person becoming a network administrator in a system that has
'sensitive' data without a criminal background check?
Why is it that the network admins are not trusted?
ANYONE that has physical access to the SQL Server and/or backups CAN
eventually 'hack' the databases -UNLESS very stringent and expensive*
security is put into place.
*expensive -Most often requires a SQL Server Security specialist to come in
and help. May require changes to current applications and programming
procedures.
--
Arnie Rowland, Ph.D.
Westwood Consulting, Inc
Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous
You can't help someone get up a hill without getting a little closer to the
top yourself.
- H. Norman Schwarzkopf
"Leila" <Leilas@.hotpop.com> wrote in message
news:%23iljU%23kAHHA.1196@.TK2MSFTNGP03.phx.gbl...
>I don't agree! When a person becomes admin, only his skills are proved to
>the boss, not other things. Why should we trust him when there are
>sensitive data? Why is it advised to remove built-in administrators account
>from sql server logins? Why you can set a password for backup set? These
>prove that you cannot trust to all admins!
>
> "Greg D. Moore (Strider)" <mooregr_deleteth1s@.greenms.com> wrote in
> message
> news:ONHpg0gAHHA.996@.TK2MSFTNGP02.phx.gbl...
>> "Leila" <Leilas@.hotpop.com> wrote in message
>> news:OC9nkAdAHHA.1556@.TK2MSFTNGP03.phx.gbl...
>> That won't work because admin of windows can stop sql server and copy
>> mdf
>> and ldf files(even if he doesn't have any login in sql server)
>> Quite honestly, at this point if you can't trust them, you've got other
>> issues.
>>
>>
>> "Uri Dimant" <urid@.iscar.co.il> wrote in message
>> news:OcVtQjaAHHA.3560@.TK2MSFTNGP03.phx.gbl...
>> Leila
>> Remove them from sysadmin server role . If they aren't remove them from
>> dbcreator server role
>>
>> "Leila" <Leilas@.hotpop.com> wrote in message
>> news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
>> Hi,
>> I want to prevent others from attaching my database, is it possible?
>> Imagine
>> that the administrator at customer's office stops SQL Server Service
>> and
>> copies our DB. How can I protect it?
>> Any help is appreciated.
>> Leila
>>
>>
>>
>>
>
>|||I am not aware of any password protection backup native in SQL Server yet.
May be, it would be something to submit to sqlwish@.microsoft.com?
Although, if the concern is about protecting the contents of the database,
you may consider encryption, which it will require some extra steps (create
symmetric/asymmetric keys, etc.)
You can read about it at
http://www.microsoft.com/technet/itshowcase/content/sqldatsec.mspx "Improving
Data Security by Using SQL Server 2005, a Technical White Paper"
"Leila" wrote:
> I don't agree! When a person becomes admin, only his skills are proved to
> the boss, not other things. Why should we trust him when there are sensitive
> data? Why is it advised to remove built-in administrators account from sql
> server logins? Why you can set a password for backup set? These prove that
> you cannot trust to all admins!
>
> "Greg D. Moore (Strider)" <mooregr_deleteth1s@.greenms.com> wrote in message
> news:ONHpg0gAHHA.996@.TK2MSFTNGP02.phx.gbl...
> >
> > "Leila" <Leilas@.hotpop.com> wrote in message
> > news:OC9nkAdAHHA.1556@.TK2MSFTNGP03.phx.gbl...
> >> That won't work because admin of windows can stop sql server and copy mdf
> >> and ldf files(even if he doesn't have any login in sql server)
> >
> > Quite honestly, at this point if you can't trust them, you've got other
> > issues.
> >
> >
> >>
> >>
> >> "Uri Dimant" <urid@.iscar.co.il> wrote in message
> >> news:OcVtQjaAHHA.3560@.TK2MSFTNGP03.phx.gbl...
> >> Leila
> >>
> >> Remove them from sysadmin server role . If they aren't remove them from
> >> dbcreator server role
> >>
> >>
> >>
> >> "Leila" <Leilas@.hotpop.com> wrote in message
> >> news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
> >> Hi,
> >> I want to prevent others from attaching my database, is it possible?
> >> Imagine
> >> that the administrator at customer's office stops SQL Server Service
> >> and
> >> copies our DB. How can I protect it?
> >> Any help is appreciated.
> >> Leila
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >
> >
>
>

Attaching DB & Security

Hi,
I want to prevent others from attaching my database, is it possible? Imagine
that the administrator at customer's office stops SQL Server Service and
copies our DB. How can I protect it?
Any help is appreciated.
LeilaLeila
Remove them from sysadmin server role . If they aren't remove them from
dbcreator server role
"Leila" <Leilas@.hotpop.com> wrote in message
news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
> Hi,
> I want to prevent others from attaching my database, is it possible?
> Imagine
> that the administrator at customer's office stops SQL Server Service and
> copies our DB. How can I protect it?
> Any help is appreciated.
> Leila
>
>|||I do not think you can prevent them from doing that if they have full
control to their OWN computer ( and the SQL Server on that computer ).
"Leila" <Leilas@.hotpop.com> wrote in message
news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
> Hi,
> I want to prevent others from attaching my database, is it possible?
> Imagine
> that the administrator at customer's office stops SQL Server Service and
> copies our DB. How can I protect it?
> Any help is appreciated.
> Leila
>
>|||That won't work because admin of windows can stop sql server and copy mdf
and ldf files(even if he doesn't have any login in sql server)
"Uri Dimant" <urid@.iscar.co.il> wrote in message
news:OcVtQjaAHHA.3560@.TK2MSFTNGP03.phx.gbl...
> Leila
> Remove them from sysadmin server role . If they aren't remove them from
> dbcreator server role
>
> "Leila" <Leilas@.hotpop.com> wrote in message
> news:OB355eaAHHA.4592@.TK2MSFTNGP03.phx.gbl...
>|||"Leila" <Leilas@.hotpop.com> wrote in message
news:OC9nkAdAHHA.1556@.TK2MSFTNGP03.phx.gbl...
> That won't work because admin of windows can stop sql server and copy mdf
> and ldf files(even if he doesn't have any login in sql server)
Quite honestly, at this point if you can't trust them, you've got other
issues.

>
> "Uri Dimant" <urid@.iscar.co.il> wrote in message
> news:OcVtQjaAHHA.3560@.TK2MSFTNGP03.phx.gbl...
>|||Correct...you really can't. What are you trying to protect
though? If it's an intellectual property type of thing and
these are your customers, licensing/legal agreements is
probably what you'd want to focus on.
-Sue
On Mon, 6 Nov 2006 21:49:26 +0330, "Leila"
<Leilas@.hotpop.com> wrote:

>That won't work because admin of windows can stop sql server and copy mdf
>and ldf files(even if he doesn't have any login in sql server)
>
>"Uri Dimant" <urid@.iscar.co.il> wrote in message
>news:OcVtQjaAHHA.3560@.TK2MSFTNGP03.phx.gbl...
>|||I don't agree! When a person becomes admin, only his skills are proved to
the boss, not other things. Why should we trust him when there are sensitive
data? Why is it advised to remove built-in administrators account from sql
server logins? Why you can set a password for backup set? These prove that
you cannot trust to all admins!
"Greg D. Moore (Strider)" <mooregr_deleteth1s@.greenms.com> wrote in message
news:ONHpg0gAHHA.996@.TK2MSFTNGP02.phx.gbl...
> "Leila" <Leilas@.hotpop.com> wrote in message
> news:OC9nkAdAHHA.1556@.TK2MSFTNGP03.phx.gbl...
> Quite honestly, at this point if you can't trust them, you've got other
> issues.
>
>|||Leila
How many admins do you have at your shop? There are server fixed roles that
you add those people , not all of them should be members of sysadmin server
role
http://vyaskn.tripod.com/sql_server...t_practices.htm --sec
urity
best practices
"Leila" <Leilas@.hotpop.com> wrote in message
news:%23iljU%23kAHHA.1196@.TK2MSFTNGP03.phx.gbl...
>I don't agree! When a person becomes admin, only his skills are proved to
>the boss, not other things. Why should we trust him when there are
>sensitive data? Why is it advised to remove built-in administrators account
>from sql server logins? Why you can set a password for backup set? These
>prove that you cannot trust to all admins!
>
> "Greg D. Moore (Strider)" <mooregr_deleteth1s@.greenms.com> wrote in
> message
> news:ONHpg0gAHHA.996@.TK2MSFTNGP02.phx.gbl...
>
>|||They are not member of sysadmin! The security threat is outside of sql
server, the windows admins!
"Uri Dimant" <urid@.iscar.co.il> wrote in message
news:OpSWIKlAHHA.4496@.TK2MSFTNGP02.phx.gbl...
> Leila
> How many admins do you have at your shop? There are server fixed roles
> that you add those people , not all of them should be members of sysadmin
> server role
> ttp://vyaskn.tripod.com/sql_server_security_best_practices.htm --se
curity
> best practices
>
> "Leila" <Leilas@.hotpop.com> wrote in message
> news:%23iljU%23kAHHA.1196@.TK2MSFTNGP03.phx.gbl...
>|||The machine admins can always get access to your data, especially if they
also have physical access to the machine. They can debug the process, they
can dump the memory, they can install key loggers, they can patch the
server, and so on. The only way to really protect your data against them is
to not give it to them in clear. Encrypt it before you pass it to the server
and decrypt it after you get it back. However, this is probably not
something that you can afford to do. So, you'll have to rely instead on
auditing, so if an admin does something bad, you can at least collect some
proof of what they did and use it to get legal compensation for the damages
caused by the data theft. You can also use other measures, to make getting
at the data harder, but you have to keep in mind that all these measures
would only slow down an attacker; you cannot build an impenetrable barrier
against the guy that can do whatever he wants with the physical machine. You
could use, for example, encryption, so a machine admin would have to find a
way to get at the keys to decrypt the data, and this would slow him down,
but it wouldn't necessarily stop him. So, the right question to ask is not
how you can stop machine administrators from getting the data, but how can
you deter them from doing so.
Some suggestions for deterring access:
- Have an auditing policy in place - verify audit trails and investigate
suspicious activity.
- Encrypt your sensitive data
- If possible, have administrators work without physical access to the
machine and have a different person perform the physical maintenance of the
machine
Thanks
Laurentiu Cristofor [MSFT]
Software Development Engineer
SQL Server Engine
http://blogs.msdn.com/lcris/
This posting is provided "AS IS" with no warranties, and confers no rights.
"Leila" <Leilas@.hotpop.com> wrote in message
news:eTwSvulAHHA.4024@.TK2MSFTNGP04.phx.gbl...
> They are not member of sysadmin! The security threat is outside of sql
> server, the windows admins!
>
> "Uri Dimant" <urid@.iscar.co.il> wrote in message
> news:OpSWIKlAHHA.4496@.TK2MSFTNGP02.phx.gbl...
>

Attach/Embed Office Document

I have an immediate need to include (attach/embed) an Office document (Word, Excel or PP) in a report generated by Reporting Services.
Can anyone point me to an example of this being done?
Can it be done at all?
Does anyone have some thoughts on how I could do it on my own if there isn't a known solution already?
Best regards,
Ryan
--= Posted using GrabIt =--
--= Binary Usenet downloading made easy =--
-= Get GrabIt for free from http://www.shemes.com/ =-
Hi
Try posting this to microsoft.public.sqlserver.reportingsvcs
John
"Ryan Pedersen" <rpedersen@.gensx.com> wrote in message
news:AfYTe.20513$FO3.2337@.bignews3.bellsouth.net.. .
>I have an immediate need to include (attach/embed) an Office document
>(Word, Excel or PP) in a report generated by Reporting Services.
> Can anyone point me to an example of this being done?
> Can it be done at all?
> Does anyone have some thoughts on how I could do it on my own if there
> isn't a known solution already?
> Best regards,
> Ryan
>
> --= Posted using GrabIt =--
> --= Binary Usenet downloading made easy =--
> -= Get GrabIt for free from http://www.shemes.com/ =-
>

Attach/Embed Office Document

I have an immediate need to include (attach/embed) an Office document (Word,
Excel or PP) in a report generated by Reporting Services.
Can anyone point me to an example of this being done?
Can it be done at all?
Does anyone have some thoughts on how I could do it on my own if there isn't
a known solution already?
Best regards,
Ryan
--= Posted using GrabIt =--
--= Binary Usenet downloading made easy =--
-= Get GrabIt for free from http://www.shemes.com/ =-Hi
Try posting this to microsoft.public.sqlserver.reportingsvcs
John
"Ryan Pedersen" <rpedersen@.gensx.com> wrote in message
news:AfYTe.20513$FO3.2337@.bignews3.bellsouth.net...
>I have an immediate need to include (attach/embed) an Office document
>(Word, Excel or PP) in a report generated by Reporting Services.
> Can anyone point me to an example of this being done?
> Can it be done at all?
> Does anyone have some thoughts on how I could do it on my own if there
> isn't a known solution already?
> Best regards,
> Ryan
>
> --= Posted using GrabIt =--
> --= Binary Usenet downloading made easy =--
> -= Get GrabIt for free from http://www.shemes.com/ =-
>

Attach/Embed Office Document

I have an immediate need to include (attach/embed) an Office document (Word, Excel or PP) in a report generated by Reporting Services.
Can anyone point me to an example of this being done?
Can it be done at all?
Does anyone have some thoughts on how I could do it on my own if there isn't a known solution already?
Best regards,
Ryan
--= Posted using GrabIt =--
--= Binary Usenet downloading made easy =--
-= Get GrabIt for free from http://www.shemes.com/ =-Hi
Try posting this to microsoft.public.sqlserver.reportingsvcs
John
"Ryan Pedersen" <rpedersen@.gensx.com> wrote in message
news:AfYTe.20513$FO3.2337@.bignews3.bellsouth.net...
>I have an immediate need to include (attach/embed) an Office document
>(Word, Excel or PP) in a report generated by Reporting Services.
> Can anyone point me to an example of this being done?
> Can it be done at all?
> Does anyone have some thoughts on how I could do it on my own if there
> isn't a known solution already?
> Best regards,
> Ryan
>
> --= Posted using GrabIt =--
> --= Binary Usenet downloading made easy =--
> -= Get GrabIt for free from http://www.shemes.com/ =-
>

Attach or append an Office document to a report

I have an immediate need to embed or attach an Office document (Word, Excel and Power Point) into or to a report.
Say that I have 5 rows of data and each row has a physical file that I want to include in the report just like you would an image.
Can someone point me in the right direction? Is this even possible?
Thanks,
Ryan Pedersen
--= Posted using GrabIt =--
--= Binary Usenet downloading made easy =--
-= Get GrabIt for free from http://www.shemes.com/ =-The closest you can get is to add a "Jump to URL" navigation action and
generate a URL that points to the Office documents. The target location of
the documents can be a network share, or you can just directly upload the
Office documents as resources on the report server and then generate a URL
that points back to the report server virtual directory and uses RS URL
access to identify the resource stored in the report server database.
-- Robert
This posting is provided "AS IS" with no warranties, and confers no rights.
"Ryan Pedersen" <rpedersen@.gensx.com> wrote in message
news:%23L%23qmELtFHA.1252@.TK2MSFTNGP09.phx.gbl...
>I have an immediate need to embed or attach an Office document (Word, Excel
>and Power Point) into or to a report.
> Say that I have 5 rows of data and each row has a physical file that I
> want to include in the report just like you would an image.
> Can someone point me in the right direction? Is this even possible?
> Thanks,
> Ryan Pedersen
>
> --= Posted using GrabIt =--
> --= Binary Usenet downloading made easy =--
> -= Get GrabIt for free from http://www.shemes.com/ =-
>