Hi Folks,
We have some inhouse applications developed using microsoft technologies
like C#.net,asp.net and sql server 2000 and we have third party applicatio
ns
using sql server 2000.
In all our sql servers we configured as below.
we created domain level user accounts(service accounts) like SA_Server1.
we made that SA_server1 as member of local administrator group on the
server where SQLserver2000 software got installed.
we are using SA_server1 account to run mssqlserver service (windows
service).
All our proudction sql server are windows clusters with 2 nodes.
we have mixed mode authentication. And all users in Builtin/Administrators
group are sql users.
Using that domain level service account (SA_Server1) credentials,we can
login to that particualr sql server locally to check everything is working
fine.
Everything is working fine.
Recently Sarbanes-Oxley Audit conducted in our company.
One of the questions they asked is as given below.
1.why Interactive log-in is turned ON for that mssqlservice accounts? (for
SA_Server1) ?
They don't want any one to login to that server locally using that domain
account credentials.
2.Why builtin/administrators are part of sql users?
How can we prevent anyone logging in to that sql server locally using that
service account credentials?
we will be giving that credentials for the 2,3 administrative people only.
But we don't want them also to login to that server locally using service
account credentials.
They should login to that server using their own windows accounts.
How can we turn OFF that interactive log-on?
is it in group policy or local policy or Active directory member profile?
What are the best security practices for sql server 2000 configuration
mainly with service accounts?
Any kind of help is greatly appreciated.
--KumarDeny Logon locally right to the account used to start sql server services is
recommended to prevent someone from using sql server service account to logi
n
to the sql server.
Hope this hepls
"Kumar" wrote:
> Hi Folks,
> We have some inhouse applications developed using microsoft technologies
> like C#.net,asp.net and sql server 2000 and we have third party applicat
ions
> using sql server 2000.
> In all our sql servers we configured as below.
> we created domain level user accounts(service accounts) like SA_Server1.
> we made that SA_server1 as member of local administrator group on the
> server where SQLserver2000 software got installed.
> we are using SA_server1 account to run mssqlserver service (windows
> service).
> All our proudction sql server are windows clusters with 2 nodes.
> we have mixed mode authentication. And all users in Builtin/Administrators
> group are sql users.
> Using that domain level service account (SA_Server1) credentials,we can
> login to that particualr sql server locally to check everything is working
> fine.
> Everything is working fine.
>
> Recently Sarbanes-Oxley Audit conducted in our company.
> One of the questions they asked is as given below.
> 1.why Interactive log-in is turned ON for that mssqlservice accounts? (fo
r
> SA_Server1) ?
> They don't want any one to login to that server locally using that doma
in
> account credentials.
> 2.Why builtin/administrators are part of sql users?
>
> How can we prevent anyone logging in to that sql server locally using that
> service account credentials?
> we will be giving that credentials for the 2,3 administrative people only
.
> But we don't want them also to login to that server locally using service
> account credentials.
> They should login to that server using their own windows accounts.
>
> How can we turn OFF that interactive log-on?
> is it in group policy or local policy or Active directory member profile
?
>
> What are the best security practices for sql server 2000 configuration
> mainly with service accounts?
>
>
> Any kind of help is greatly appreciated.
>
> --Kumar
>
Showing posts with label developed. Show all posts
Showing posts with label developed. Show all posts
Wednesday, March 28, 2012
MSSQ server service (widnows service) account configuration --
Hi Folks,
We have some inhouse applications developed using microsoft technologies
like C#.net,asp.net and sql server 2000 and we have third party applications
using sql server 2000.
In all our sql servers we configured as below.
we created domain level user accounts(service accounts) like SA_Server1.
we made that SA_server1 as member of local administrator group on the
server where SQLserver2000 software got installed.
we are using SA_server1 account to run mssqlserver service (windows
service).
All our proudction sql server are windows clusters with 2 nodes.
we have mixed mode authentication. And all users in Builtin/Administrators
group are sql users.
Using that domain level service account (SA_Server1) credentials,we can
login to that particualr sql server locally to check everything is working
fine.
Everything is working fine.
Recently Sarbanes-Oxley Audit conducted in our company.
One of the questions they asked is as given below.
1.why Interactive log-in is turned ON for that mssqlservice accounts? (for
SA_Server1) ?
They don't want any one to login to that server locally using that domain
account credentials.
2.Why builtin/administrators are part of sql users?
How can we prevent anyone logging in to that sql server locally using that
service account credentials?
we will be giving that credentials for the 2,3 administrative people only.
But we don't want them also to login to that server locally using service
account credentials.
They should login to that server using their own windows accounts.
How can we turn OFF that interactive log-on?
is it in group policy or local policy or Active directory member profile?
What are the best security practices for sql server 2000 configuration
mainly with service accounts?
Any kind of help is greatly appreciated.
--KumarDeny Logon locally right to the account used to start sql server services is
recommended to prevent someone from using sql server service account to login
to the sql server.
Hope this hepls
"Kumar" wrote:
> Hi Folks,
> We have some inhouse applications developed using microsoft technologies
> like C#.net,asp.net and sql server 2000 and we have third party applications
> using sql server 2000.
> In all our sql servers we configured as below.
> we created domain level user accounts(service accounts) like SA_Server1.
> we made that SA_server1 as member of local administrator group on the
> server where SQLserver2000 software got installed.
> we are using SA_server1 account to run mssqlserver service (windows
> service).
> All our proudction sql server are windows clusters with 2 nodes.
> we have mixed mode authentication. And all users in Builtin/Administrators
> group are sql users.
> Using that domain level service account (SA_Server1) credentials,we can
> login to that particualr sql server locally to check everything is working
> fine.
> Everything is working fine.
>
> Recently Sarbanes-Oxley Audit conducted in our company.
> One of the questions they asked is as given below.
> 1.why Interactive log-in is turned ON for that mssqlservice accounts? (for
> SA_Server1) ?
> They don't want any one to login to that server locally using that domain
> account credentials.
> 2.Why builtin/administrators are part of sql users?
>
> How can we prevent anyone logging in to that sql server locally using that
> service account credentials?
> we will be giving that credentials for the 2,3 administrative people only.
> But we don't want them also to login to that server locally using service
> account credentials.
> They should login to that server using their own windows accounts.
>
> How can we turn OFF that interactive log-on?
> is it in group policy or local policy or Active directory member profile?
>
> What are the best security practices for sql server 2000 configuration
> mainly with service accounts?
>
>
> Any kind of help is greatly appreciated.
>
> --Kumar
>
We have some inhouse applications developed using microsoft technologies
like C#.net,asp.net and sql server 2000 and we have third party applications
using sql server 2000.
In all our sql servers we configured as below.
we created domain level user accounts(service accounts) like SA_Server1.
we made that SA_server1 as member of local administrator group on the
server where SQLserver2000 software got installed.
we are using SA_server1 account to run mssqlserver service (windows
service).
All our proudction sql server are windows clusters with 2 nodes.
we have mixed mode authentication. And all users in Builtin/Administrators
group are sql users.
Using that domain level service account (SA_Server1) credentials,we can
login to that particualr sql server locally to check everything is working
fine.
Everything is working fine.
Recently Sarbanes-Oxley Audit conducted in our company.
One of the questions they asked is as given below.
1.why Interactive log-in is turned ON for that mssqlservice accounts? (for
SA_Server1) ?
They don't want any one to login to that server locally using that domain
account credentials.
2.Why builtin/administrators are part of sql users?
How can we prevent anyone logging in to that sql server locally using that
service account credentials?
we will be giving that credentials for the 2,3 administrative people only.
But we don't want them also to login to that server locally using service
account credentials.
They should login to that server using their own windows accounts.
How can we turn OFF that interactive log-on?
is it in group policy or local policy or Active directory member profile?
What are the best security practices for sql server 2000 configuration
mainly with service accounts?
Any kind of help is greatly appreciated.
--KumarDeny Logon locally right to the account used to start sql server services is
recommended to prevent someone from using sql server service account to login
to the sql server.
Hope this hepls
"Kumar" wrote:
> Hi Folks,
> We have some inhouse applications developed using microsoft technologies
> like C#.net,asp.net and sql server 2000 and we have third party applications
> using sql server 2000.
> In all our sql servers we configured as below.
> we created domain level user accounts(service accounts) like SA_Server1.
> we made that SA_server1 as member of local administrator group on the
> server where SQLserver2000 software got installed.
> we are using SA_server1 account to run mssqlserver service (windows
> service).
> All our proudction sql server are windows clusters with 2 nodes.
> we have mixed mode authentication. And all users in Builtin/Administrators
> group are sql users.
> Using that domain level service account (SA_Server1) credentials,we can
> login to that particualr sql server locally to check everything is working
> fine.
> Everything is working fine.
>
> Recently Sarbanes-Oxley Audit conducted in our company.
> One of the questions they asked is as given below.
> 1.why Interactive log-in is turned ON for that mssqlservice accounts? (for
> SA_Server1) ?
> They don't want any one to login to that server locally using that domain
> account credentials.
> 2.Why builtin/administrators are part of sql users?
>
> How can we prevent anyone logging in to that sql server locally using that
> service account credentials?
> we will be giving that credentials for the 2,3 administrative people only.
> But we don't want them also to login to that server locally using service
> account credentials.
> They should login to that server using their own windows accounts.
>
> How can we turn OFF that interactive log-on?
> is it in group policy or local policy or Active directory member profile?
>
> What are the best security practices for sql server 2000 configuration
> mainly with service accounts?
>
>
> Any kind of help is greatly appreciated.
>
> --Kumar
>
Monday, March 26, 2012
MSRepl_Commands
Hi everyone
has anyone come across / developed a way of transforming the commands
in MSRepl_Commands so that, for instance, and Update becomes a Delete
or Insert?
thanks in adveance for abny assists!
Are you requiring an explanation of how this occurs in replication?
If so, this is referred to as a deferred update - see
http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/q302/3/41.ASP&NoWebContent=1
Cheers,
Paul Ibison SQL Server MVP, www.replicationanswers.com .
|||MS_replcommands is a queue. You can modify this queue to delete commands.
Modifying them is difficult as they are in binary. Your best bet is to
ensure that your updates are not replaced by an insert delete pair.
Please refer to the following kb articles for more information.
http://support.microsoft.com/default.aspx/kb/302341
and
http://support.microsoft.com/kb/238254
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"RedCamel" <RichardJGilbert@.hotmail.com> wrote in message
news:1163426512.098950.159840@.m73g2000cwd.googlegr oups.com...
> Hi everyone
> has anyone come across / developed a way of transforming the commands
> in MSRepl_Commands so that, for instance, and Update becomes a Delete
> or Insert?
> thanks in adveance for abny assists!
>
has anyone come across / developed a way of transforming the commands
in MSRepl_Commands so that, for instance, and Update becomes a Delete
or Insert?
thanks in adveance for abny assists!
Are you requiring an explanation of how this occurs in replication?
If so, this is referred to as a deferred update - see
http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/q302/3/41.ASP&NoWebContent=1
Cheers,
Paul Ibison SQL Server MVP, www.replicationanswers.com .
|||MS_replcommands is a queue. You can modify this queue to delete commands.
Modifying them is difficult as they are in binary. Your best bet is to
ensure that your updates are not replaced by an insert delete pair.
Please refer to the following kb articles for more information.
http://support.microsoft.com/default.aspx/kb/302341
and
http://support.microsoft.com/kb/238254
Hilary Cotter
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"RedCamel" <RichardJGilbert@.hotmail.com> wrote in message
news:1163426512.098950.159840@.m73g2000cwd.googlegr oups.com...
> Hi everyone
> has anyone come across / developed a way of transforming the commands
> in MSRepl_Commands so that, for instance, and Update becomes a Delete
> or Insert?
> thanks in adveance for abny assists!
>
Friday, March 9, 2012
MSDTC, Active Diretory, DAO, And Transactions
If this is in the wrong forum, my apologies.
Here is the situation. We have a .Net application that someconsultants developed several years ago. They made use of DAO fordatabase access, using some inbuilt classes like ContextUtil to get atransation environment.
Until last weekend, the envorinment was:
Web application on IIS5 / Windows 2000 Advanced Server
Database on SQL2000 on Windows 2000 Advanced Server
We switched over to a new database server environment - a cluster oftwo Windows 2003 servers wth SQL Server 2000. This requiredActive Directory to be set up on the two database server machines.
Everything worked but this particular application - where it goes toupdate the database. It appears (but since I haven't yet beenable to rebuild the .Net solution) that the error - "Object referencenot set to an instance of object." is in fact a spurious error causedwhen the transation tries to roll back.
I have spent about 10 hours on this, and have come to the conclusionthat the fact I have MSDTC involved on a database server that is in anAD domain, while the web server that is issuing the transaction isoutside that domain is the cause of the problem. Now, I don'twant to put AD on the IIS 5 web server - we are migrating this to a newWin2k3/IIS6 server in 5 or 6 weeks time.
Any suggestions? If I have to, I can move the database for thisparticular app back to the non-clustered Windows 2000 server (which isalso outside the AD domain).
Thanks for your indulgance.
Microsoft requirement and good practice is a database Server is just a member server, it should not have anything to do with AD users. If your application is using DAO(data Access object) which was obselete in 1998 you may need MSDTC, the error could be you have not properly configured distributed transaction in SQL Server. Run a search for distributed transaction in the BOL(books online). The advice keep your application from none database users and AD. Hope this helps.
Here is the situation. We have a .Net application that someconsultants developed several years ago. They made use of DAO fordatabase access, using some inbuilt classes like ContextUtil to get atransation environment.
Until last weekend, the envorinment was:
Web application on IIS5 / Windows 2000 Advanced Server
Database on SQL2000 on Windows 2000 Advanced Server
We switched over to a new database server environment - a cluster oftwo Windows 2003 servers wth SQL Server 2000. This requiredActive Directory to be set up on the two database server machines.
Everything worked but this particular application - where it goes toupdate the database. It appears (but since I haven't yet beenable to rebuild the .Net solution) that the error - "Object referencenot set to an instance of object." is in fact a spurious error causedwhen the transation tries to roll back.
I have spent about 10 hours on this, and have come to the conclusionthat the fact I have MSDTC involved on a database server that is in anAD domain, while the web server that is issuing the transaction isoutside that domain is the cause of the problem. Now, I don'twant to put AD on the IIS 5 web server - we are migrating this to a newWin2k3/IIS6 server in 5 or 6 weeks time.
Any suggestions? If I have to, I can move the database for thisparticular app back to the non-clustered Windows 2000 server (which isalso outside the AD domain).
Thanks for your indulgance.
Microsoft requirement and good practice is a database Server is just a member server, it should not have anything to do with AD users. If your application is using DAO(data Access object) which was obselete in 1998 you may need MSDTC, the error could be you have not properly configured distributed transaction in SQL Server. Run a search for distributed transaction in the BOL(books online). The advice keep your application from none database users and AD. Hope this helps.
Subscribe to:
Posts (Atom)