I want to grant only a login who is under an active directory user group to view server state in sql server. How can i do it?
122955
I would like to use integrated security with my internal application which is all on a domain.  Unfortunately, I've never been able to get this to work well.  I would like to assign an entire Exchange (Active Directory) Group a role in SQL Server for read/write access to certain tables.  That way I wouldn't have to create an operator whenever someone is hired or delete an operator whenever someone is fired.  Is this possible?  What steps would I take to do this?
110710
I have a windows 7 user who belongs to admin group. I want to execute sc command that requires admin privileges. I DON'T want to open an elevated cmd, want to be able to simply Win+R->Enter command, enter password and that's all. I tried the runas command, but it doesn't seem to work:  &gt;runas /user:me "cmd"   and it asks for a password, and then the command is executed with normal privileges. I know I could use /user:administrator but I don't know the admin pass and I think the admin user (me) should work.
18713
When looking at the properties of a particular login, it's possible to see a list of users mapped to that login:   I profiled SQL Server Management Studio (SSMS) and I see that SSMS connects to every database one at a time and retrieves information from sys.database_permissions  Is it possible to write a single query that retrieves the user mapping information shown above or am I forced to use a cursor or sp_MSforeachdb or something like that?
56096
What is the best way to manage user accounts for Windows servers in a DMZ? We are expanding our web presence and adding several IIS servers to our DMZ. I would prefer not to manage a bunch of local accounts or, on the other hand, expose our internal Active Directory servers directly to the DMZ either. Is there a standard approach to this problem?
54874
My question is, if you create a new domain user account for each of the SQL Server processes, what permissions should be set for each account? Or does the SQL configuration manager actually take care of this, and I just had an unforeseen issue?  I quite often have to setup Microsoft SQL Server and wondered if anyone can provide advice on configuring the accounts the services should run as. IMO this has been vaguely documented by Microsoft, while they point you in the right direction I have never been able to find any concrete examples.  To summarize what I've seen so far:  For simple deployments\development environments it is OK to use the virtual account defaults the installer uses: e.g. NT SERVICE\MSSQLSERVER  Avoid using the SYSTEM account, this is not secure.  For production and in domain environments it's recommended to use either a Managed Service Account, or create a domain user account (not an admin) for each service. Allegedly if you use a domain account at installation time the installer will set any required permissions for you.  If changing the service account on an existing install from a virtual account to a domain account the recommendation is to use the SQL Server configuration manager to set the new service accounts. Allegedly this will set any required permissions for you.  I just tried changing the service account in an existing install to a domain account and it would give me a logon failure until I granted the account log on as service permission, which contradicts the part where the SQL Server configuration manager will set any required permissions. (Although I'm not sure if a GPO may have interfered with setting this local security policy)  Microsoft does provide a list of the permissions that the SQL Server Setup grants .  But it's not clear to me if that is something I should be doing manually for the user I create to run the service as, or whether using the SQL config manager should automatically set these permissions.  SQL Server 2014, Domain Controller is on Windows Server 2008 R2.
110884
I have a MySQL Community database on a remote server and I am trying to get Microsoft Access to read data from it. This data is sensitive. The problem is, MySQL doesn't care about the username that I give it in the .DSN file. It lets me read the ENTIRE database no matter what! How do I get it to actually check the username that I give it in the .DSN file?  edit: I'm not a DBA, I'm some intern who is over his head. Please don't assume that I know anything about anything  :)
95996
My manager is requesting to know when was the last time a number of reports were last ran to see if they are getting used. He requested info from our vendor and the vendor if coming to me for SA level permission to dig through the relative SQL Server.   Obviously, I won't be doing that but I would like to know is there a way to track the last time a specific query has been executed?  This database resides on an old SQL Server 2008 R2 install so I am sure my options are limited if not non-existent especially since he wants to look back as far as 18 months.   Just figured I would ask in case there might be at least a partial way to go back in history and track this information.
107244
How can I validate a username and password against Active Directory? I simply want to check if a username and password are correct.
87529
How can I limit the number of active logins per user?  I've seen this on various servers before, and I was wondering how I could set this up myself.  Perhaps in those cases, this was accomplished by limiting the number of active SSH logins per user?  And I guess that would be the way to go.  How would I set this up?
96445
I've recently used our company's spare laptop (that has a general user set up) while mine was being repaired. I've checked the "Remember password" option in SQL Server Management Studio when logging in to the database.   I need to clear the login and password information that I have used to prevent the next person that will use the laptop from using my login names and passwords. How can I do this?
48355
I've working LDAP authentication with the following setup   AuthName            "whatever"  AuthType            Basic  AuthBasicProvider   ldap  AuthLDAPUrl         "ldap://server/OU=SBSUsers,OU=Users,OU=MyBusiness,DC=company,DC=local?sAMAccountName?sub?(objectClass=*)"  Require ldap-group  CN=MySpecificGroup,OU=Security Groups,OU=MyBusiness,DC=company,DC=local   This works, however I've to put all users I want to authenticate into MySpecificGroup. But on LDAP server I've configured that MySpecificGroup also contains the group MyOtherGroup with another list of users.  But those users in MyOtherGroup are not authenticated, I've to manually add them all to MySpecificGroup and basically can't use the nested grouping. I'm using Windows SBS 2003.  Is there a way to configure Apache LDAP to do this? Or is there a problem with possible infinite recursion and thus not allowed?
21459
So my setup:   Services are shared between all hosts (CPU/RAM/Disk/Services). Hosts are split into two main groups: "Production" and "Development". We have two contact groups: "Production" and "Development".   Lets say my development SQL server runs low on RAM, I want it to only alert those in  "Development" contact group (this service is of course assigned to a host in the "Development" host group, using the shared RAM monitoring service).  I'm pretty much stumped on this... I can't configure it at the service level (they're shared there), and I can't seem to get escalations to do it for me either...   Do I need to use service groups along with escalations and bite the bullet on building that list? Or am I missing something stupidly simple?  I'm using Centreon for configuration if that helps.
79359
For a security audit,I need to identify all super users and log every activity performed. Best approach for this?  By "super user" I mean sysadmin, serveradmin, securityadmin, processadmin, and dbcreator.
77874
I'm kinda newbie in this Windows 2008 Server R2 configuration stuff, so I would appreciate any help regards the issue I'm facing.  After a Windows 2008 Server R2 clean install I created a couple of local user accounts and joined them to the administrators group, I tested them and I was able to log on with each one.  Then I installed Active Diectory role (DNS role implied) and runned DCPromo. The domain was created and promoted succesfully and I was able to log on into the domain from a client machine.  The issue began when I realized that I was no longer able to log on locally into the server (meaning LOCALMACHINE\localusername). I looked into domain user accounts and noticed that the local user accounts I created previously were now part of the domain. I consider a bad thing not being able to log on locally anymore, so in a shot to fix it I stopped the Active Directory service... my bad! Now I'm sort of locked up, I can't log either locally or as part of the domain.  Can someone please shed some light in this? What did I miss in the process? I tried googling but could find any straight forward solution or explanation. What concept I'm not catching?How can I promote a server to PDC and still be able to log on locally?  Thanks in advanced.
9642
I have set of users with root access.I want to know list of users who are all created by currently logged in user.  From below structure if user1 login to system , how to list user's like user11,user12.who are all created by user1.  RootUser  user1(Root Access)   user11(normal user created by User1) user12(normal user created by User1)  user2(Root Access) user21(normal user created by User2) user22(normal user created by User2)
18291
I have two servers (both servers are on Windows OS):   Server_A running Oracle 12c Server_B running SQL Server 2014   I want these servers to be able to see each other, so I can SELECT anything I want in Server_A from Server_B and vice versa.  I only want the ability to run SELECT queries (not INSERT, UPDATE, DELETE or any DDL queries), and also if possible to EXECUTE procedures.  What options or technologies we have for achieving this issue and which one is better?    Tell me if any software I have to install or any configuration have to be set on each of servers. I appreciate explaining the instructions step by step.
46253
In our AD 2003 domain each user gets local admin permissions on their computer.  Everyone else can login with their domain account as normal user.  Right now this means going to the desktop and manually adding the user as a local administrator.  Is there any way to automate this process through logon scripts or GPOs?  I have found ways to use a gpo to make everyone who logs in to a computer a local admin, but really only want to give it to the primary user (or in some cases users) of the computer.  I've also seen methods that required adding a group for each computer...but really dont want to clutter AD like that.  I do have a list mapping each user to each computer name.  If it matters the desktops are a mix of xp and win7.