SQL Server Security Hardening utility

Hi All,
Is there a list of items performed by this utility?
Thanks!
-JT-

Hi,
Take a look..
http://www.cisco.com/en/US/docs/voice_ip_comm/cust_contact/contact_center/ipcc_enterprise/ippcenterprise9_0_1/reference/guide/CCMP_BK_I3E02C25_00_icm-security-best-practices-guide_chapter_0111.html#CCMP_RF_SCDB90DA_00
http://www.cisco.com/en/US/docs/voice_ip_comm/cust_contact/contact_center/ipcc_enterprise/ippcenterprise9_0_1/reference/guide/CCMP_BK_I3E02C25_00_icm-security-best-practices-guide_chapter_0111.pdf

Similar Messages

About SCCM 2012 Primary sites sql server security logins

Hi, guys!
I've got some issue or some misunderstanding....In primary site's sql security logins there were same accounts as on CAS sql.....(We've got about ten primary servers)....two days ago someone (i'm going to find out that guy....damned...) from branch administrators
cleared up security list logins on one of primary server and left only two accounts....one of them it is primary site server installation account, second account - there is SCCM all hierarchy administrators group....
Most of that....that somebody got lower site server installation account role from sysadmin to public....
Am I right thinking in that way - all sql server security logins on all primary sites in one hierarchy must be identical....it explains by SQL replication.......?????
How can i get back sql security logins list on that sccm server to normal way....became after installing primary site server....??? need help......

Hi,
Primary sites do not always have the same security logins.
You need to add NT... accounts, sa etc into security logins. These accounts were added during SQL installation.
All site system computer accounts (such as MP, DP) and primary site computer account also need to be added.
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Sql server security patch

Hi team,
what are the main difference in sql server patch and sql serve security patch ?
what is the sql server security patch and how to apply the security patch.

Hello,
For SQL Server we have SP = Service Packs and CU = Cummulative Update; both are Kind of "patches" and there is no difference if a security issue or a bug is fixed with. Both are depolyed as an installation program to apply it to a SQL Server instance.
Olaf Helper
[ Blog] [ Xing] [ MVP]

Microsoft (R) SQL Server Execute Package Utility Version 10.50.2500.0 for 64-bit Copyright (C) Microsoft Corporation 2010. All rights reserved. Argument "Data connector" for option "connection" is not valid. The command line parameters are invalid.

sql server:- 2008 r2 stardard edition
os:- 64
Package is password procted.
following is command line in ssis package .
/FILE "E:\PostgressToSql_IPMS\PostgressToSql_IPMS\PostgressToSql.dtsx"
/DECRYPT /CONNECTION "Server.user";"\"Data Source=server;
User ID=user;Provider=SQLOLEDB.1;Persist Security Info=True;
Application Name=SSIS-Package-{DD33AC67-4A45-40D6-AF70-4BBD421931C1}BPOSQLDB01\BPOSQLDB01.log4BPO;
Auto Translate=False;\"" /CONNECTION "server.conn 1";
"\"Data Source=server;User ID=log4BPO;Initial Catalog=edb1;
Provider=SQLOLEDB.1;Persist Security Info=True;Auto Translate=False;
Application Name=SSIS-Package-{665E3825-6AFC-4DD3-ABC8-50B5F0F18EEB}server.conn 1;
\"" /CHECKPOINTING OFF /REPORTING E
Need change something? Seperate configuaration file required ?

Hi Dinesh,
Based on my research, the issue is caused by you are running a SSIS package with a connection manager that has a space-character in the connection name.
To work around this issue, please refer to the following two suggestions:
Rename the connection manager in THE package to not include certain special characters (spaces, dashes). Note that the connection manager name can be changed without having to edit any property of the connection string itself.
Escape quote the connection name, such that
/CONNECTION "server.conn 1";"..."
becomes
/CONNECTION "\"server.conn 1\"";"..."
The following similar issue is for your reference:
https://connect.microsoft.com/SQLServer/feedback/details/510869/dtexec-commandline-fails-when-connection-is-passed-to-commandline-and-connection-name-contains-a-space
Thanks,
Katherine Xiong
Katherine Xiong
TechNet Community Support

SQL SERVER SECURITY Update KB2977321 and KB2716436 Error Code 1642

I had gone through some of the related question that has been shared over here but since for me there was a definite Error Pop up stating
SQL SERVER SET UP FAILER "NT Service Unable to start MSSQLSERVER" but i noticed that after each of the update the version had changed and the database is running normally, just want to confirm if the updates are working fine or some
other measures has to be taken.
I Ran the discovery report and it shows the latest version
Can i take this as a successfull installation and no issues will occur?
Please suggest.

I have pulled this from the Setup Bootstrap log. IN the Administrative log in the event viewer there is nothing helpful.
2015-03-31 15:07:22 Slp: Sco: Attempting to open service handle for service MSSQLSERVER
2015-03-31 15:07:22 Slp: Invoking QueryServiceStatusEx Win32 API
2015-03-31 15:07:22 Slp: Sco: Attempting to close service handle for service MSSQLSERVER
2015-03-31 15:07:22 Slp: Sco: Attempting to close SC Manager
2015-03-31 15:07:22 Slp: Sco: Returning service process id 5644
2015-03-31 15:07:22 Slp: Waiting for nt event Global\sqlserverRecComplete to be created
2015-03-31 15:07:22 Slp: Waiting for nt event Global\sqlserverRecComplete or sql process handle to be signaled
2015-03-31 15:07:22 Slp: Error: Failed to start the following NT service after patch action: MSSQLSERVER
2015-03-31 15:07:22 Slp: Sleeping 10 seconds before retrying NT service start request
2015-03-31 15:07:32 Slp: Sco: Attempting to start service MSSQLSERVER
2015-03-31 15:07:32 Slp: Sco: Attempting to start service MSSQLSERVER, start parameters
2015-03-31 15:07:32 Slp: Sco: Attempting to start service MSSQLSERVER
2015-03-31 15:07:32 Slp: Sco: Attempting to open SC Manager
2015-03-31 15:07:32 Slp: Sco: Attempting to open service handle for service MSSQLSERVER
2015-03-31 15:07:32 Slp: Sco: Service MSSQLSERVER already running or pending start
2015-03-31 15:07:32 Slp: Sco: Attempting to close service handle for service MSSQLSERVER
2015-03-31 15:07:32 Slp: Sco: Attempting to close SC Manager
2015-03-31 15:07:32 Slp: Waiting for the following Sql NT service to indicate successful startup: MSSQLSERVER
2015-03-31 15:07:32 Slp: Sco: Attempting to get service process id for service MSSQLSERVER
2015-03-31 15:07:32 Slp: Sco: Attempting to open SC Manager
2015-03-31 15:07:32 Slp: Sco: Attempting to open service handle for service MSSQLSERVER
2015-03-31 15:07:32 Slp: Invoking QueryServiceStatusEx Win32 API
2015-03-31 15:07:32 Slp: Sco: Attempting to close service handle for service MSSQLSERVER
2015-03-31 15:07:32 Slp: Sco: Attempting to close SC Manager
2015-03-31 15:07:32 Slp: Sco: Returning service process id 5644
2015-03-31 15:07:32 Slp: Waiting for nt event Global\sqlserverRecComplete to be created
2015-03-31 15:07:32 Slp: Waiting for nt event Global\sqlserverRecComplete or sql process handle to be signaled
2015-03-31 15:07:32 Slp: Error: Failed to start the following NT service after patch action: MSSQLSERVER
2015-03-31 15:07:32 Slp: Error: Action "StartPatchedServices" threw an exception during execution.
2015-03-31 15:07:32 Slp: Microsoft.SqlServer.Setup.Chainer.Workflow.ActionExecutionException: The NT service 'MSSQLSERVER' could not be started. ---> Microsoft.SqlServer.Chainer.Infrastructure.ChainerInvalidOperationException: The NT service 'MSSQLSERVER'
could not be started.
2015-03-31 15:07:32 Slp:    at Microsoft.SqlServer.Configuration.SetupExtension.StartPatchedServicesAction.ExecuteAction(String actionId)
2015-03-31 15:07:32 Slp:    at Microsoft.SqlServer.Chainer.Infrastructure.Action.Execute(String actionId, TextWriter errorStream)
2015-03-31 15:07:32 Slp:    at Microsoft.SqlServer.Setup.Chainer.Workflow.ActionInvocation.InvokeAction(WorkflowObject metabase, TextWriter statusStream)
2015-03-31 15:07:32 Slp:    at Microsoft.SqlServer.Setup.Chainer.Workflow.PendingActions.InvokeActions(WorkflowObject metaDb, TextWriter loggingStream)
2015-03-31 15:07:32 Slp:    --- End of inner exception stack trace ---
2015-03-31 15:07:32 Slp:    at Microsoft.SqlServer.Setup.Chainer.Workflow.PendingActions.InvokeActions(WorkflowObject metaDb, TextWriter loggingStream)
2015-03-31 15:07:36 Slp: Received request to add the following file to Watson reporting: C:\Users\imchenatadmin\AppData\Local\Temp\2\tmp4C5D.tmp
2015-03-31 15:07:36 Slp: The following is an exception stack listing the exceptions in outermost to innermost order
2015-03-31 15:07:36 Slp: Inner exceptions are being indented
2015-03-31 15:07:36 Slp:
2015-03-31 15:07:36 Slp: Exception type: Microsoft.SqlServer.Chainer.Infrastructure.ChainerInvalidOperationException
2015-03-31 15:07:36 Slp:     Message:
2015-03-31 15:07:36 Slp:         The NT service 'MSSQLSERVER' could not be started.
2015-03-31 15:07:36 Slp:     Stack:
2015-03-31 15:07:36 Slp:         at Microsoft.SqlServer.Configuration.SetupExtension.StartPatchedServicesAction.ExecuteAction(String actionId)
2015-03-31 15:07:36 Slp:         at Microsoft.SqlServer.Chainer.Infrastructure.Action.Execute(String actionId, TextWriter errorStream)
2015-03-31 15:07:36 Slp:         at Microsoft.SqlServer.Setup.Chainer.Workflow.ActionInvocation.InvokeAction(WorkflowObject metabase, TextWriter statusStream)
2015-03-31 15:07:36 Slp:         at Microsoft.SqlServer.Setup.Chainer.Workflow.PendingActions.InvokeActions(WorkflowObject metaDb, TextWriter loggingStream)
2015-03-31 15:07:36 Slp: Watson Bucket 1
Original Parameter Values
2015-03-31 15:07:36 Slp: Parameter 0 : SQL2008@RTM@KB2977321
2015-03-31 15:07:36 Slp: Parameter 1 : Microsoft.SqlServer.Configuration.SetupExtension.StartPatchedServicesAction.ExecuteAction
2015-03-31 15:07:36 Slp: Parameter 2 : Microsoft.SqlServer.Configuration.SetupExtension.StartPatchedServicesAction.ExecuteAction
2015-03-31 15:07:36 Slp: Parameter 3 : Microsoft.SqlServer.Chainer.Infrastructure.ChainerInvalidOperationException@1202@1
2015-03-31 15:07:36 Slp: Parameter 4 : Microsoft.SqlServer.Chainer.Infrastructure.ChainerInvalidOperationException@1202@1
2015-03-31 15:07:36 Slp: Parameter 5 : StartPatchedServices
2015-03-31 15:07:36 Slp:
Final Parameter Values
2015-03-31 15:07:36 Slp: Parameter 0 : SQL2008@RTM@KB2977321
2015-03-31 15:07:36 Slp: Parameter 1 : 0x0EE19F0D
2015-03-31 15:07:36 Slp: Parameter 2 : 0x0EE19F0D
2015-03-31 15:07:36 Slp: Parameter 3 : 0xF762992B@1202@1
2015-03-31 15:07:36 Slp: Parameter 4 : 0xF762992B@1202@1
2015-03-31 15:07:36 Slp: Parameter 5 : StartPatchedServices
2015-03-31 15:07:37 Slp: Sco: Attempting to write hklm registry key SOFTWARE\Microsoft\Microsoft SQL Server to file C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Log\20150331_145638\MSSQLSERVER\Registry_SOFTWARE_Microsoft_Microsoft SQL Server.reg_
2015-03-31 15:07:37 Slp: Sco: Attempting to write hklm registry key SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall to file C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Log\20150331_145638\MSSQLSERVER\Registry_SOFTWARE_Microsoft_Windows_CurrentVersion_Uninstall.reg_
2015-03-31 15:07:37 Slp: Sco: Attempting to write hklm registry key SOFTWARE\Microsoft\MSSQLServer to file C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Log\20150331_145638\MSSQLSERVER\Registry_SOFTWARE_Microsoft_MSSQLServer.reg_
2015-03-31 15:07:37 Slp: Sco: Attempting to write hklm registry key SOFTWARE\Wow6432Node\Microsoft\Microsoft SQL Server to file C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Log\20150331_145638\MSSQLSERVER\Registry_SOFTWARE_Wow6432Node_Microsoft_Microsoft
SQL Server.reg_
2015-03-31 15:07:37 Slp: Sco: Attempting to write hklm registry key SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall to file C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Log\20150331_145638\MSSQLSERVER\Registry_SOFTWARE_Wow6432Node_Microsoft_Windows_CurrentVersion_Uninstall.reg_
2015-03-31 15:07:37 Slp: Sco: Attempting to write hklm registry key SOFTWARE\Wow6432Node\Microsoft\MSSQLServer to file C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Log\20150331_145638\MSSQLSERVER\Registry_SOFTWARE_Wow6432Node_Microsoft_MSSQLServer.reg_
2015-03-31 15:07:40 Slp: The NT service 'MSSQLSERVER' could not be started.
2015-03-31 15:07:40 Slp: Watson bucket for exception based failure has been created
2015-03-31 15:07:40 Slp: Sco: Attempting to create base registry key HKEY_LOCAL_MACHINE, machine
2015-03-31 15:07:40 Slp: Sco: Attempting to open registry subkey
2015-03-31 15:07:40 Slp: Sco: Attempting to open registry subkey Software\Microsoft\PCHealth\ErrorReporting\DW\Installed
2015-03-31 15:07:40 Slp: Sco: Attempting to get registry value DW0201
2015-03-31 15:07:40 Slp: Submitted 1 of 1 failures to the Watson data repository
2015-03-31 15:07:43 Slp:
2015-03-31 15:07:43 Slp: ----------------------------------------------------------------------
2015-03-31 15:07:43 Slp:
2015-03-31 15:07:43 Slp: Error result: -2068709375
2015-03-31 15:07:43 Slp: Result facility code: 1202
2015-03-31 15:07:43 Slp: Result error code: 1

How to change SQL Server security groups name after server rename?

A Windows 2003 server has been renamed from LAMDAMIRROR1A to LAMDAMIRROR2A and the following
sql has been run in SQL Server 2008 R2 on the server :
exec sp_dropserver 'LAMDAMIRROR1A'
exec sp_addserver 'LAMDAMIRROR2A','local'
However, although everything appears ok, the 5 Windows 2003 Groups (automatically created by
the SQL 2008 R2 Install) still contain 'LAMDAMIRROR1A' in their name. Does this matter ? Can the Windows Groups be just renamed (right click , rename) or will this cause problems ?
The Windows Groups are :
SQLServer2005SQLBrowserUser$LAMDAMIRROR1A
SQLServerDTSUser$LAMDAMIRROR1A
SQLServerMSSQLServerADHelperUser$LAMDAMIRROR1A
SQLServerMSSQLUser$LAMDAMIRROR1A
SQLServerSQLAgentUser$LAMDAMIRROR1A
There are also Registry entries containing the old 'LAMDAMIRROR1A' name. Does this matter ?
Should this be changed ?
eg.
My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\100\Machines\OriginalMachineName.
My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\Services\Report Server\GroupPrefix.
My Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\printers\Microsoft XPS
DocumentWriter\DsSpooler\serverName.
etc

Hi,
If you have executed the sp_dropserver and sp_addserver in SQL Server 2008 R2, we need to verify if you renamed the SQL Server instance successfully. You can select information from @@SERVERNAME or sys.servers to verify if the renaming operation is completely
successful in SQL Server Management Studio (SSMS). If yes, whether you change the registry entries containing the old 'LAMDAMIRROR1A' name or not, there’s no impact on SQL Server Services. For more details, please review this article:
How to: Rename a Computer that Hosts a Stand-Alone Instance of SQL Server.
In addition, if you must rename the windows groups, you can just right-click the group in Computer Management/System Tools/Local Users and Groups/Groups and rename it, or you can create new groups with new names, for more details, please review this article:
Manage Local Groups. If there are some issues regards the Windows, you can post the question in the Windows Server forums at
http://social.technet.microsoft.com/Forums/windowsserver/en-US/home?category=windowsserver . It is appropriate and more experts will assist you.
Thanks
Lydia Zhang

SQL Server Security Logins vs. Databases Security Users

Why isn't all security needs done just in logins? When migrating databases, the Logins are not brought over when restoring a backup. It does not make sense. Could it not be done all just in the Security > Logins area or why not? That COULD be designed to track users and rights on various databases rather than a thing owned by each database....
Thanks for your time.
Gib

Understand
the below points first
Login are being used to access the server (Server level)
Database users are being used to access the database.(Database level)
Why
isn't all security needs done just in logins?
Just Imagine the below things:
I want give the permission to user to take backup for specific databases in this case we will give databasedb_backupoperator
role. Is this possible with server role to take backup for specific databases
I want give the permission to user to run the BULK INSERT statement on databases in this case we
will give bulkadmin server role. Is this possible with database role to run the BULK INSERT statement on databases
Thanks-Vanchan
Please click the Mark as Answer button if a post solves your problem!

What range TCP/IP Port should be give to default or named instance of sql server for security purpose to sql server ?

Hi
i am following technet article for Configure SQL Server security for SharePoint 2013 environments
https://technet.microsoft.com/en-us/library/ff607733?f=255&MSPPError=-2147217396
i want to change default TCPIP port from 1433 to which ports to change is securable for sql server
i mean in what range
for example can i change to 1500 or 2000 or 1450 etc .
if i assign like these portnos it will not affect to other ports in windows server 2012?
adil

I agree with Erland. (Always a good idea.) Changing the port doesn't help much to prevent attacks. If you decide to do that see Configure a Server to Listen on a Specific TCP Port (SQL Server Configuration Manager)
http://msdn.microsoft.com/library/ms177440.aspx. Note
"When selecting a port number, consult
http://www.iana.org/assignments/port-numbers for a list of port numbers that are assigned to specific applications."
It's important that you pick a number that isn't used by some other application.
Rick Byham, Microsoft, SQL Server Books Online, Implies no warranty

Excel Import Fails in SQL Server Agent Job but not when executed in BIDS

We have a SQL Server agent job that has ran successfully for the past 6 months. It started failing about a week ago. I don't believe anyone installed anything on the server. The proxy account used to run the job is an admin on the server.
I've tried everything I can think of or that I found on searches. I even changed the connection manager from an Excel source to using an Microsoft office 12.0 Access Database Engine OLEDB connection and it still runs in BIDs and not as an agent job.
I also setup my LANID as a proxy account to see if the job would run (checking security) -- and it fails with the same error.   I also made sure the path is
\\server\share rather than a drive letter. Any ideas?
The package is executed in 32 bit mode. The package still runs fine in BIDS (where BIDs is opened on the server) but fails in the SQL Agent job with:
Executed as user: xxxxxx\xxxxxx. Microsoft (R) SQL Server Execute Package Utility Version 11.0.2100.60 for 32-bit Copyright (C) Microsoft Corporation. All rights reserved.    Started: 9:00:00 AM Error: 2014-12-01 09:00:02.46
Code: 0xC0202009     Source: xxxxxx Connection manager "Excel Connection Manager"     Description: SSIS Error Code DTS_E_OLEDBERROR. An OLE DB error has occurred. Error code: 0x80004005. An OLE
DB record is available. Source: "Microsoft Access Database Engine" Hresult: 0x80004005 Description: "External table is not in the expected format.". End Error Error: 2014-12-01 09:00:02.65
Code: 0xC020801C     Source: Load File to Staging Excel Source [43]     Description: SSIS Error Code DTS_E_CANNOTACQUIRECONNECTIONFROMCONNECTIONMANAGER. The AcquireConnection method call to the connection manager
"Excel Connection Manager" failed with error code 0xC0202009. There may be error messages posted before this with more information on why the AcquireConnection method call failed. End Error Error: 2014-12-01 09:00:02.77
Code: 0xC0047017     Source: Load File to Staging SSIS.Pipeline     Description: Excel Source failed validation and returned error code 0xC020801C. End Error Error: 2014-12-01 09:00:02.90
Code: 0xC004700C     Source: Load File to Staging SSIS.Pipeline     Description: One or more component failed validation. End Error Error: 2014-12-01 09:00:03.02     Code: 0xC0024107
Source: Load File to Staging      Description: There were errors during task validation. End Error DTExec: The package execution returned DTSER_FAILURE (1). Started: 9:00:00 AM Finished: 9:00:03 AM
Elapsed: 2.761 seconds. The package execution failed. The step failed.

I logged on to the server with the account that the SQL Agent runs under and ran the following from a command
line to execute the package:
"D:\Program Files (x86)\Microsoft SQL Server\110\DTS\Binn\DTEXEC.exe" /FILE
"\"K:\SSIS\xxxxxx\xxxxx.dtsx\"" /CHECKPOINTING OFF
/REPORTING EWCDI /X86
I wanted to see if it was a security issue with the agent account account - but
this ran fine.
I then updated the SQL Agent job to use an operating system command instead
of a SSIS package on the job step. This fails...
The issue is definately with the SQL Server Agent

Scheduling SSIS packages through SQL Server Agent

Hello All! I have an SSIS question for BPC 7.5 installations across multiple servers. I have been rebuilding all my DTS packages over to SSIS and trying to learn this more dynamic environment. Currently I have saved a copy of all my rebuilt packages from BIDS (on web server) to the MSDB located on the SQL server. I can manually run packages from Integration Services and load data successfully. When I try to schedule packages based on the packages stored in MSDB, I get failures. The errors initially suggested I was passing over a NULL password, so I adjusted the protection level of the package to ServerStorage, as opposed to the default setting.
Now I have the following error when I schedule and run it:
Message
Executed as user: AMERICREDIT\svcbpc_ssis_dev. Microsoft (R) SQL Server Execute Package Utility Version 10.0.2531.0 for 64-bit Copyright (C) Microsoft Corp 1984-2005. All rights reserved. Started: 11:48:00 AM Error: 2011-02-28 11:48:02.05 Code: 0xC0010018 Source: Convert Task 2008 Description: Failed to load task "Convert Task 2008", type "OSoft.Services.Application.DataMgr.Task.SSISConvert, OSoftTaskConvert2008, Version=7.0.112.0, Culture=neutral, PublicKeyToken=bf6c37fa78f5a648". The contact information for this task is "". End Error Error: 2011-02-28 11:48:02.06 Code: 0xC0010018 Source: DumpLoad Task 2008 Description: Failed to load task "DumpLoad Task 2008", type "OSoft.Services.Application.DataMgr.Task.SSISTaskDumpLoad, OSoftTaskDumpLoad2008, Version=7.0.112.0, Culture=neutral, PublicKeyToken=bf6c37fa78f5a648". The contact information for this task is "". End Error Error: 2011-02-28 11:48:02.13 Code: 0xC0010026 Source: Convert Task 2008 Description: The task has failed to load. The contact information for this task is "". End Error Error: 2011-02-28 11:48:02.13 Code: 0xC0024107 Source: Convert Task 2008 Description: There were errors during task validation. End Error Error: 2011-02-28 11:48:02.13 Code: 0xC0010025 Source: Z6_VW_STAT_APLN_CURR Description: The package cannot execute because it contains tasks that failed to load. End Error DTExec: The package execution returned DTSER_FAILURE (1). Started: 11:48:00 AM Finished: 11:48:02 AM Elapsed: 1.406 seconds. The package execution failed. The step failed.
It appears I cannot execute any of the BPC custom tasks in the SSIS packages. Any recommendations?

Thanks, James, your point is well taken. Originally we were importing packages into the file system, but had the same results when scheduling.
Below is the message received when I schedule a package located in the stored package file system from my web server:
Executed as user: AMERICREDIT\svcbpc_ssis_dev. Microsoft (R) SQL Server Execute Package Utility Version 10.0.2531.0 for 64-bit Copyright (C) Microsoft Corp 1984-2005. All rights reserved. Started: 10:36:00 AM Error: 2011-03-01 10:36:02.56 Code: 0xC0010018 Source: Convert Task 2008 Description: Failed to load task "Convert Task 2008", type "OSoft.Services.Application.DataMgr.Task.SSISConvert, OSoftTaskConvert2008, Version=7.0.112.0, Culture=neutral, PublicKeyToken=bf6c37fa78f5a648". The contact information for this task is "". End Error Error: 2011-03-01 10:36:02.58 Code: 0xC0010018 Source: DumpLoad Task 2008 Description: Failed to load task "DumpLoad Task 2008", type "OSoft.Services.Application.DataMgr.Task.SSISTaskDumpLoad, OSoftTaskDumpLoad2008, Version=7.0.112.0, Culture=neutral, PublicKeyToken=bf6c37fa78f5a648". The contact information for this task is "". End Error Error: 2011-03-01 10:36:02.62 Code: 0xC0010026 Source: Convert Task 2008 Description: The task has failed to load. The contact information for this task is "". End Error Error: 2011-03-01 10:36:02.62 Code: 0xC0024107 Source: Convert Task 2008 Description: There were errors during task validation. End Error Error: 2011-03-01 10:36:02.62 Code: 0xC0010025 Source: Z6_VW_STAT_APLN_CURR Description: The package cannot execute because it contains tasks that failed to load. End Error DTExec: The package execution returned DTSER_FAILURE (1). Started: 10:36:00 AM Finished: 10:36:02 AM Elapsed: 1.954 seconds. The package execution failed. The step failed.
Could this be a security thing? If so, what would my security need to be set up from the package level?

SSIS package give an error if execute through SQL server agent

I have created a SSIS package in BIDS 2012. If i execute this package through sql server agent it gives the below error:
Executed as user: NT Service\SQLSERVERAGENT. Microsoft (R) SQL Server Execute Package Utility Version 11.0.2100.60 for 64-bit Copyright (C) Microsoft Corporation. All rights reserved. Started: 11:19:47 AM Error: 2015-01-20
11:19:47.83 Code: 0xC0016016 Source: Sub_Hadoop_aggregation Description: Failed to decrypt protected XML node "DTS:Password" with error 0x8009000B "Key not valid for use in specified state.".
You may not be authorized to access this information. This error occurs when there is a cryptographic error. Verify that the correct key is available. End Error Error: 2015-01-20 11:19:47.94 Code: 0xC0016016 Source:
Sub_Hadoop_aggregation Description: Failed to decrypt protected XML node "DTS:Password" with error 0x8009000B "Key not valid for use in specified state.". You may not be authorized to access this information. This error
occurs when there is a cryptographic error. Verify that the correct key is available. End Error Error: 2015-01-20 11:19:48.04 Code: 0xC0016016 Source: Sub_Hadoop_aggregation Description: Failed to
decrypt protected XML node "DTS:Password" with error 0x8009000B "Key not valid for use in specified state.". You may not be authorized to access this information. This error occurs when there is a cryptographic error. Verify that the correct
key is available. End Error Error: 2015-01-20 11:19:48.92 Code: 0xC00291EC Source: alter_keys Execute SQL Task Description: Failed to acquire connection "mstr_warehouse". Connection may not be
configured correctly or you may not have the right permissions on this connection. End Error DTExec: The package execution returned DTSER_FAILURE (1). Started: 11:19:47 AM Finished: 11:19:48 AM Elapsed: 1.42 seconds.
The package execution failed. The step failed.
so i have change some properties in our package like protectionlevel change from encrypted to dontsavesensitive. After that i have created configuration file for the package and use that configuration file. It executes the package through sql server agent
smoothly.
Thanks
Azhar Khan

Hi selfdestruct80,
According to your description, you created SSIS package and it works fine. But you got the error message when the SSIS package was called from a SQL Server Agent job.
According to my knowledge, the package may not run in the following scenarios:
The current user cannot decrypt secrets from the package.
A SQL Server connection that uses integrated security fails because the current user does not have the required permissions.
File access fails because the current user does not have the required permissions to write to the file share that the connection manager accesses.
A registry-based SSIS package configuration uses the HKEY_CURRENT_USER registry keys. The HKEY_CURRENT_USER registry keys are user-specific.
A task or a connection manager requires that the current user account has correct permissions.
According to the error message, the SSIS Package ProtectionLevel property to EncryptSensitiveWithPassword as ArthurZ mentioned. To solve the problem, you need to go to Command Line tab, manually specify the paassword in SQL Agent Job with the command like below:
/FILE "\"C:\Users\xxxx\Documents\SQL Server Management Studio\SSIS\Package.dtsx\"" /DECRYPT somepassword /CHECKPOINTING OFF /REPORTING E
If you have any more questions, please feel free to ask.
Thanks,
Wendy Fu
Wendy Fu
TechNet Community Support

Getting an error running an SSIS package from SQL server agent

This is the first time I'm running an SSIS package in SQL server agent.
I'm running a SQL server agent job and getting this error message:
Am I using the correct options? (options list below)
Message
Executed as user: SITEX\stxdatasqlexec. Microsoft (R) SQL Server Execute Package Utility Version 10.50.1600.1 for 32-bit Copyright (C) Microsoft Corporation 2010. All rights reserved.    Started: 1:42:00 PM Error: 2014-04-17
13:42:01.01     Code: 0xC0011007     Source: {B72BF421-785A-44EC-9570-D2A40B046CA7}      Description: Unable to load the package as XML because of package does not have a valid XML format. A
specific XML parser error will be posted. End Error Error: 2014-04-17 13:42:01.02     Code: 0xC0011002     Source: {B72BF421-785A-44EC-9570-D2A40B046CA7}      Description: Failed
to open package file "C:\Users\halexandrovich\Documents\Nbr_Rolls_base.dtsx" due to error 0x80070003 "The system cannot find the path specified.". This happens when loading a package and the file cannot be opened or loaded correctly
into the XML document. This can be the result of either providing an incorrect file name was specified when calling LoadPackage or the XML file was specified and has an incorrect format. End Error Could not load package "C:\Users\halexandrovich\Documents\Nbr_Rolls_base.dtsx"
because of error 0xC0011002. Description: Failed to open package file "C:\Users\halexandrovich\Documents\Nbr_Rolls_base.dtsx" due to error 0x80070003 "The system cannot find the path specified.". This happens when loading a
package and the file cannot be opened or loaded correctly into the XML document. This can be the result of either providing an incorrect file name was specified when calling LoadPackage or the XML file was specified and has an incorrect format. Source:
{B72BF421-785A-44EC-9570-D2A40B046CA7} Started: 1:42:00 PM Finished: 1:42:01 PM Elapsed: 0.047 seconds. The package could not be found. The step failed.
Here are the options I'm using:
package source - file system
data source destination = my SQL server db
execution option - use 32 bit runtime
command line entry:
- /FILE "C:\Users\halexandrovich\Documents\Nbr_Rolls_base.dtsx" /CONNECTION DestinationConnectionOLEDB;"\"Data Source=esxdspr-sql01.sitex.com;Initial Catalog=SuesTbls;Provider=SQLNCLI10;Integrated Security=SSPI;Auto Translate=false;\""
/CONNECTION SourceConnectionFlatFile;"\\sitex.com\dfs\Production\SFTPData\LPSEFTProcess\FromAADFS\Rpt_Nbr_Rollsperbatch_20140331_20_0.txt"
/X86 /CHECKPOINTING OFF /REPORTING E
I checked the filename so it must be the XML format it's complaining about.

Thank you, pituach.
I tried running the package using just my c drive without partition, C:\Nbr_Rolls.dtsx, but still getting the same
error. I do not see any option on this site to post my package. I know it's not the path that's the issue. Our support desk already fixed that because I was getting a different message before.
Message
Executed as user: SITEX\stxdatasqlexec. Microsoft (R) SQL Server Execute Package Utility Version 10.50.1600.1 for 32-bit Copyright (C) Microsoft Corporation 2010. All rights reserved.    Started: 11:23:00 AM Error: 2014-04-18
11:23:00.44     Code: 0xC0011007     Source: {2BEE62EB-DD08-4867-9F5C-660167964650}      Description: Unable to load the package as XML because of package does not have a valid XML format. A
specific XML parser error will be posted. End Error Error: 2014-04-18 11:23:00.45     Code: 0xC0011002     Source: {2BEE62EB-DD08-4867-9F5C-660167964650}      Description: Failed
to open package file "C:\Nbr_Rolls.dtsx" due to error 0x800C0006 "The system cannot locate the object specified.". This happens when loading a package and the file cannot be opened or loaded correctly into the XML document. This can be the result of
either providing an incorrect file name was specified when calling LoadPackage or the XML file was specified and has an incorrect format. End Error Could not load package "C:\Nbr_Rolls.dtsx" because of error 0xC0011002. Description: Failed
to open package file "C:\Nbr_Rolls.dtsx" due to error 0x800C0006 "The system cannot locate the object specified.". This happens when loading a package and the file cannot be opened or loaded correctly into the XML document. This can be the result of
either providing an incorrect file name was specified when calling LoadPackage or the XML file was specified and has an incorrect format. Source: {2BEE62EB-DD08-4867-9F5C-660167964650} Started: 11:23:00 AM Finished: 11:23:00 AM
Elapsed: 0.125 seconds. The package could not be found. The step failed.

Running SSIS 2005 in SQL Server Job Agent 2012

Hi Guys,
I'm trying to create a job in SQL 2012 that calls an SSIS 2005 package, however i'm getting some issue. I researched the issue a bit and got this link . The given link suggested to use dtexec as SQL 2012 try to convert it in the memory.
I used the dtexec but I'm still getting an issue.
"Executed as user: NT Service\SQLSERVERAGENT. Microsoft (R) SQL Server Execute Package Utility Version 9.00.1399.06 for 32-bit Copyright (C) Microsoft Corp 1984-2005. All rights reserved. Started: 4:11:19 PM Error:
2015-04-13 16:11:26.24 Code: 0xC0012024 Source: OTH Market Exist? Description: The task "OTH Market Exist?" cannot run on this edition of Integration Services. It requires a higher level edition. End
Error Error: 2015-04-13 16:11:26.24 Code: 0xC0012024 Source: Arcticle CSV Exist? Description: The task "Arcticle CSV Exist?"
cannot run on this edition of Integration Services. It requires a higher level edition. End Error Error: 2015-04-13 16:11:26.24 Code: 0xC0012024 Source: BV Market Exist? Description:
The task "BV Market Exist?" cannot run on this edition of Integration Services. It requires a higher level edition. End Error Error: 2015-04-13 16:11:26.51 Code: 0xC002F210 Source: No Input
Files Email Execute SQL Task Description: Executing the query "DECLARE @result int; EXEC @result = security.dbo.spSendEmail
@Subject='[GFK Import & Export] - All Input Files Are Missing',
@Message ='Processing has been stopped due to missing input files',
@ToID =25, @ccID =0,
@Attachment =''" failed with the following error: "Database 'security' does not exist. Make sure that the name is entered correctly.". Possible failure reasons: Problems with the query, "ResultSet" property not set correctly,
It seems that I do need to upgrade my packages to run in SQL 2012 unless if there's another way without upgrading it that would be great.
I just want to get the confirmation if possible or not
Many thanks guys.

Hi Vaibhav,
I created 2 jobs. the first job calls a simple package that execute a single SQL. It ran
successfully when I execute the said job using this command
DTEXEC /FILE "\"C:\TFS\WDSHE SSIS Packages from DTS\GFK_Test_package.dtsx\"" /DECRYPT stud10 /CHECKPOINTING OFF /REPORTING E
2nd Job, calls a complex package which contains several execute process tasks. this job fails with the error mentioned at the top.
Now, I modified the simple package in the first job and add an Execute Process Task.
I'm started to get an issue
Message
Executed as user: NT Service\SQLSERVERAGENT. Microsoft (R) SQL Server Execute Package Utility Version 9.00.1399.06 for 32-bit Copyright (C) Microsoft Corp 1984-2005. All rights reserved. Started: 4:51:57 PM Error: 2015-04-13
16:52:01.32 Code: 0xC0012024 Source: Unzip BV ZIP Description: The task "Unzip BV ZIP" cannot run on this edition of Integration Services. It requires a higher level edition. End Error DTExec:
The package execution returned DTSER_FAILURE (1). Started: 4:51:57 PM Finished: 4:52:01 PM Elapsed: 4.212 seconds. Process Exit Code 1. The step failed.
Have you had a similar issues before?
I will try to install the SSIS service and see how I go. thanks for the link

Need some sort of SQL Server error log parser?

I have over 100 MSSQL instances - ranging from SQL2000 - SQL2012.
Currently, I'm querying using EXEC SP_ERRORLOG to read the log files. With the querying method, I cannot always be on top of things as I like. And frankly, I just check once a day for a period of 24 hours or so.
I'm wondering if there's an utility / software / solutions out there that does the following:
1) constantly monitors the error logs of all instances
2) present the log files in an orderly manner for each instances as needed.
3) email out a group of people for certain error / severity / state number.
Putting this in SQL Server Security because I'm mainly interested in errors like 18456 Login failed either from reboot or actual login failed.
Thanks

You can try that using Powershell
srvr.txt should contain a list of servers, I would prefer same SQL version.
Save the content to ReadingErrorlog.PS1
param
[String] $infile,
[DateTime] $date,
[int] $last,
[String] $OutFile
function getUNCPath($infile)
$qualifier = Split-Path $infile -qualifier
$drive = $qualifier.substring(0,1)
$noqualifier = Split-Path $infile -noQualifier
"$drive`$$noqualifier"
$srvr=get-content c:\DBAScripts\srvr.txt
foreach($svr in $srvr)
$UNC=getUNCPath($infile)
$readbuffer=get-content -path \\$svr\$UNC -encoding unicode | select-object -last $last
$i=0
[Datetime] $date
[String] $Outbuffer
$outbuffer=""
foreach($line in $readbuffer)
$i++;
$mydate=$line.substring(0,22)
Write-host $Mydate
if ($line -ne "")
if($mydate -ge $date)
if ($line -like "*Error:*")
write-output "$i: $line"
$outbuffer=$outbuffer+$line
add-content -path $outfile -value $outbuffer
sample call
PS:\>.\ReadingErrorlog.PS1 "f:\Program Files\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Log\errorlog"
"2012-05-01 12:00:00.00"
10 c:\DBAScripts\output.txt
You may need to re-work on the code here and there.
--Prashanth

Sql server grants access to specific login to database.

i have created website for intranet and hosted it on server. for that i needed to create login "IIS APPPOOL\hi" in sql server 2008 for my application
to access my "reportdb" database. "IIS APPPOOL\hi" has sysadmin and public server roles in sql server 2008. And i have default login"sa" same
as "IIS APPPOOL\hi". these are working correctly. Now I want these two logins to access"reportdb" for all
operations in database and remaining all logins should be denied to access"reportdb". My Sql Server 2008 is having mixed mode (windows authentication and Sql authentication). plz help me

I think what Tauseef is requesting is to keep access for the 2 sysadmins & deny access to everyone else, correct?
As Uri mentioned, by being part of sysadmin role, “IIS APPPOOL\hi” & “sa” would have access to everything in the server, and nobody else should have access to the DB unless explicitly being granted access.
If you would really deny anyone else access to the database, you can potentially deny connect to public, and only sysadmins (who override permissions) would be able to connect; although I would strongly recommend against such practice.
Something else I would like to recommend against is the usage of sysadmin for what may not be a DBA role (IIS appPool). Following the least-privilege principle, I would recommend having a non-administrator user for applications that has enough capabilities
to perform the tasks needed.
The main risk is that a SQL injection (SQLi) bug in your application would lead to a complete compromise of your SQL server.
If there are app tasks that would require elevated permissions, I would recommend encapsulating the logic in a stored procedure and either use impersonation or digital signatures to accomplish a controlled elevation of privileges instead. If you have any
question on this topic I will be glad to assist.
I hope this information helps,
-Raul Garcia
SQL Server Security
This posting is provided "AS IS" with no warranties, and confers no rights.

SQL Server Security Hardening utility

Similar Messages

Maybe you are looking for