Windows Logins x Windows Groups - identify idinvidual Windows Users?

SQL Server 2008 R2 Security Whitepaper
"Logins can be based on Windows Groups in
addition to being based on Windows Users. Using Windows Logins instead of
Windows Group provides the ability to identify individual Windows Users for
tracking purposes. "
SO... I am part of an AD Domain Group and my login is granted access to SQL via AD Domain Group. I created and dropped a testdb and I see my actions linked to my domain account in the Audit.
So what is not identifiable if logins are added via Groups?!
Thanks

Hello,
Windows Users that have access to a SQL Server instance via a Windows group have their identity lost behind the group anonymity.
The following article may allow you to understand the security issues Windows Groups introduce on SQL Server security model.
http://blogs.msdn.com/b/lcris/archive/2008/08/22/sql-server-windows-groups-default-schemas-and-other-properties.aspx
Hope this helps.
Regards,
Alberto Morillo
SQLCoffee.com

Similar Messages

SQL Windows Authentication with Login of AD Group 'Domain Admins'

Having a bit of a difficulty with Microsoft SQL Server 2012 windows authentication integration...
The server is setup to have Windows authentication used as its means of login authentication. No issues with this other than a strange error that occurs on multiple SQL servers in our domain:
When a login is created for domain group "[domain]\Domain Admins", users within this AD group cannot connect to the SQL server through the Management Studio. The error that SQL server gives is Error 18456, Sate 11, i.e. "Valid login but server
access failure"
However when a different AD group is added as a login (like [domain]\[group]), users from this group can successfully log into SQL server. It seems that adding any other group, even groups from a different domain, grants successful authentication as I would
expect EXCEPT the AD group 'Domain Admins".
Is there some restriction/security feature at play here on this AD group that makes using the 'Domain Admins' group as a login not possible?
Andrew

Yes, this group was removed and readded just yesterday to try to fix the issue.
Here is the output of the command:
class
class_desc
major_id
minor_id
grantee_principal_id
grantor_principal_id
type
permission_name
state
state_desc
105
ENDPOINT
2
0
2
1
CO
CONNECT
G
GRANT
105
ENDPOINT
3
0
2
1
CO
CONNECT
G
GRANT
105
ENDPOINT
4
0
2
1
CO
CONNECT
G
GRANT
105
ENDPOINT
5
0
2
1
CO
CONNECT
G
GRANT

Windows user groups with # character ok?

I wanted to know if a windows user group is used in SQL server 2008R2 which contains a naming convemtion that includes the # character would operate ok within BizTalk databases.
eg. domain\#mg-dd-something
Any help and advice would be greatly appreciated.

But in this context, its the backslash that is the special character. A legal identifier in SQL Server consists of alphanumeric characters + plus the characters _, #, @ and $. Of these $ can never been used initially. @ can only be used initially for variables.
# can be used initially without restrictions except for objects in sys.objecs, where it only can be used for stored procedures and tables and for these have a special meaning. For non-object objects, # can be used freely. Underscore should never been an issue,
as it is commonly used an identifier in many languages.
So this is legal:
create login #nisse@manpower with password ='hult'
Whether you should use it? There is certainly a bigger risk that you run into issues. Not necessarily in SQL Server itself. It could also be with other MS products or third-party software. And not forget people in your organisation who will be confused by
it.
Erland Sommarskog, SQL Server MVP, [email protected]

CF Admin login fails (invalid pw) for Windows User other than the one used to install CF 10

I installed CF 10 on a server running Windows Server 2008 R2 Standard having logged into the server as a Windows user in the administrator group. I set up CF 10 Administrator to use a single password (the default). I can log into CF Admin when authenticating to the server with the same Windows credentials used when installing CF 10 but if I log into the server as another Windows user in the administrator group I cannot log into CF Admin; I get an Invalid Password error. I thought the whole point of the single password was so that anyone who can log into the server could log into CF Admin. It works like that for my CF 8 and CF 9 machines.

It is a new design, based on security issues that arose in previous ColdFusion versions. See, for example, Charlie Arehart's blog for more details.

Hei , i was window user an just switched to ipone 6 , can i merge my contacts group from windows to IOS ? please quide

hei , i was window user an just switched to ipone 6 , can i merge my contacts group from windows to IOS ? please quide

Right, I finally managed to get it sorted out.
iCloud only accept version 3.0 vcards, and the one I was using were version 2.1 so that's why it wasn't picking it up. So the easy way to get that sorted out is, use a gmail account.
I know you don't wanna do it because you think it's too much hassle and stuff, but trust me it only takes 5 minutes and that's it.
1. Create a Gmail Account.
2. Export your Old VCard files to the Gmail Account.
3. Now Import them from Gmail to your PC again.
And, that's it, that's just makes the new imported version in 1 file contains your all contacts in version 3.0. Now you can just upload that on icloud and then sync it with your iphone.
That's what I did and it worked, and I am sure if you wanna replace this file in the Contacts folder under your User Account in Windows and then try to sync Contacts in Tunes, it should work, but as I said, I did it with iCloud and it worked for me. So aye, that's pretty much it. Phewwww..
Been searching for it for the whole day and it took 5 minutes in the end, badass...
Anyway, don't lose hope and always Google for everything!

How to create windows users and groups from Java

Hi,
Can any one please tell me, which Package/API will helps to create windows users and groups from Java.
Thanks,
M.Prem.

You can't do it with pure Java, and it's not in the core API. You'd have to write a native function to do it, using whatever API Windows provides, and then call it with JNI. Or look for a third party native-based Java library that already does that.

Windows user group for BizTalk contains # characters

I wanted to know if a windows user group is used in BizTalk Server 2013 which contains a naming convention that includes the # character would operate ok in BizTalk and SQL. PLease see the example below:
eg. domain\#mg-dd-BizTalk-SSO-Affiliate-Admins
Any help and advice would be greatly appreciated.

Hi Chris,
There are some naming conventions followed while creating the Windows user groups. not a concrete ones..one of them is here.
http://technet.microsoft.com/en-us/library/cc775802(v=ws.10).aspx
When it comes to BizTalk, if I can recollect, one of our clients had Windows user group with a symbol like yours which did work without any issues. But we suggested them to change the user group's name as this could affect some of our automated scripts like
Powershell/C# programs. For which they agreed and changed their Windows user group to ones without any symbols.
Yes, this would work but might fail for any of your automated maintenance scripts. Note: This experience with my client is with BizTalk 2006 and I have tested the case for latest versions.
If this answers your question please mark it accordingly. If this post is helpful, please vote as helpful by clicking the upward arrow mark next to my reply.

How to reset the forgotten Windows user account password

I need Toshiba password reset! How do I reset Toshiba laptop? I would be appreciated if you help me Toshiba password recovery, etc. Well, so frequently to meet these problems in our lives. Today, we together share some ways to reset Toshiba password.
Solution1: Toshiba recovery disks help reset lost password
It only works if we created the recovery disks or CD before we forgot the password. The following listed are the steps to reset disk for Toshiba Windows 7 recovery:
a. Start PC, log on Windows 7 and insert an USB flash drive into the driver.
b. Start -> Control Panel -> User Accounts and Family Safety -> User Accounts -> Create a password reset disk.
c. In welcome screen click Next and select the inserted USB flash drive, click Next.
d. Input the login password in the password field and click Next. When progress indicator shows 100% complete, click Finish to exit. Remove the USB driver from PC.
The method is similar to create a Toshiba recovery CD. Now, the Toshiba Windows 7 password recovery disk is ok. Put it in a safe place for people may use it to reset your password.
Steps to recover password with created Toshiba password reset disk:
e. Click Reset Password in the Windows 7 logon window,
f. Insert the created Toshiba recovery USB disk into the USB driver interface, and click Reset password" to open Password Reset Wizard. Click Next to continue.
g. Choose this USB disk recovery Toshiba from the drop down box. Click Next to continue.
h. Input a new password and re-input it again to confirm. Click Next and then Finish to close the wizard.
Solution2: Reset Toshiba laptop by accounts with administrator rights
If there is default or built-in admin account or other accounts with administrator privileges and rights, we can use it for Toshiba password bypass. Take Toshiba XP recovery as example:
A. Boot system from Safe Mode by pressing F8 when PC stars.
B. Access PC with the available account with administrator rights and privileges.
C. Start - Local Users and Groups lusrmgr.msc in the Search box ENTER - Local Users and Groups - choose Users.
D. Right click the account with unlocked password, select Set Password and then input and confirm the new password.
Solution3: Reset Toshiba password with burned ISO image file
We can burn an .iso image file into a bootable USB disk or CD/DVD and reset the forgotten password easily and quickly. Take one of the most popular Windows password reset tool Ainorsoft Windows Password Recovery as example:
a. Download the program from an accessible PC;
b. Burn its .iso file to a blank CD/DVD or USB disk;
c. Bypass the lost Toshiba password with the burned CD/DVD on the locked PC.
Things will not be tricky if we know the methods for Toshiba password reset once we forgot Toshiba laptop password! Please also remember to share them with your friends!

Thanks for sharing this but you are talking always about Toshiba passwordthis is wrong and I think this could be a little confusing this is a workaround for windows user account password.
As far as I know there are no password set by Toshiba.
The user can set the windows user account password if necessary so this workaround describes how to delete a Windows user account password which is common for all computers with preinstalled Windows OS.
However, thanks for posting ;)

Can't change Window User's Profile Location

I would like to change the Window User's Profile Location. I've followed the instructions on page 85 of User Management Apple's document unsuccussefully.
In the Windows tab of Group Management, I have enter my new SMB sharepoint :
User Profile Path : \\servername\sharename\folder\usershortname
The Window Client's computer is recocgnized by the OD / PDC Leopard server, I can login without any problem, but at the end of the Window XP session's, the profile is still saved at //ODMasterServer/Users/Profiles/.
The strangest is that in XP I perfectly reach \\servername\sharename\folder\ and can write what I want within.
I think that the Leopard PDC doesn't send the correct information to the client for the profile folder path's.
Where can I verify or change it ?
A solution would be to write a login script for the client, any idea of a short script ?

I solve partialy my problem.
I use a Windows Server 2003 with file sharing.
1) Add the server the same way you add an XP client computer in the OD domain.
2) Create a file sharing using the server admin console (DO NOT USE the file sharing on the properties of the file) choosing full access for admin and read/write access for users
3) In the security of the shared directory add the OD admistrator's (be careful domainnamedomainadmin not only domain_admin) and give him full access.
So apparently the PDC and the SMB doesn't work correctly in Leopard Server apart for the file /Users/Profiles.
It works more or less fine.
Now, I want to hide the home's and profil's file to the other users (mac or windows).

Forms Authentication Error: User '' does not have required permissions. Verify that sufficient permissions have been granted and Windows User Account Control (UAC) restrictions have been addressed

I created a custom security extension following the steps listed in the Readme_Security Extension Sample. It works fine if I login as the user that is specified AdminConfiguration section of the rsreportserver.config file but if I
log in as another user, I get this error: User '' does not have required permissions. Verify that sufficient permissions have been granted and Windows User Account Control (UAC) restrictions have been addressed. I've added the user to both System Administrator
and System User roles to try to get it to work but still no luck.
Does anyone know how to fix this?
Thanks.

Hi MetronM,
The issue is due to that user have no permission to access the report server. In report manager, Reporting Services includes predefined roles that we can assign to users and groups to provide immediate access to a report server. Each role defines a collection
of related tasks.
You can refer to the following steps to assign corresponding role to the user.
Open report manager.
Click “Folder Setting” button.
Click “New Role Assignment” icon.
Type the user name and select the corresponding role.
There is an article about Granting Permissions on a Native Mode Report Server, you can refer to it.
http://technet.microsoft.com/en-us/library/ms156014.aspx
Regards,
Alisa Tang
Alisa Tang
TechNet Community Support

Get current logged in Windows user name

Hi
Is it possible to retrieve the current logged in Windows user name into a text field automatically?
Thank you in advance for the help.

Hi,
This is a security issue and you will need a javascript file in the Acrobat folder. This will contain a trusted function allowing access to the login name.
Here is a thread that looked at this:
http://forums.adobe.com/message/2198084#2198084
However read to the end, because if you are Reader Enabling the form (at least through Acrobat) then you may run into problems.
Good luck,
Niall

Creating a windows user in Active Directory

I am trying to create a user in Active Directory that can log on as any other Windows user, but when I try to log into Windows, I get the following error message:
"The local policy of this system does not allow you to logon interactively".
Are there any attributes or objectclass settings that must be set for the user to allow interactive logons?
Thanks in advance!

This has nothing to do with JNDI, the object class or attributes.
I assume that you are trying to logon locally to the domain controller with the new user that you have just created.
By default, the domain controller's policy only allows specific users or members of a group to logon locally at the domain domain controller's console.
Either edit the domain controller'sgroup policy and add your newly created user to the list of users permitted to logon locally, or add the user to a group which has already been granted permission to logon locally.

Windows users doesn't work after migrating from old to new server!

We have done a complete re-install on our XServe with OD. We have about 10 Windows users, and after the installation all their settings and mail are gone. All the "normal" files are there though.
I'm not sure we have done it the right way though: We did a backup from the old server (a bootable copy with Super Duper), then we formatted and installed everything. We made new accounts (with different names if that's good to know) and copied the users home folders to the new location. The Mac clients seem to work good, but all the settings on the Windows clients are gone...
Is there an easier way to this? We still have the workable copy from the old installation. There seems to be some kind of export/import way to do this, but I haven't got a clue how to do that...
Please help!

davidh,
We didn't reintegrate smb.conf, but set the new server up just like the old one. We did however compare these files to see that the vital parts (netlogon, shares and so on, and of course basic settings) were correct.
We also copied the user files and profiles and made them identical on the new server, except for placing them under the new usernames.
Regarding the Local Settings folder, it doesn't exist on the old server, that's one of the weird things. We've checked the profile for a user on the client machine, and it is a roaming profile. That's why we're a bit puzzled as to why the login works and all files are there, but the user preferences and Outlook doesn't work.
I know I've read somewhere that the Local Settings aren't replicated like the other files in a roaming profile, but I haven't finished checking up on that. I wouldn't expect anything else than that Windows takes care of Outlook e-mail for a roaming profile as well though; I mean, the user must be able to read his/her mail from any computer in the domain, what else would the purpose of a roaming profile be?
Except for the weird thing about us not being able to find the user preferences or Outlook files for the client amongst the files on the server, I feel we're missing something; Apparently Windows isn't as straight forward as one would expect (not sure why I did expect anything, come to think of it).
We're going to give it a new go next weekend. Except for doing further research we're thinking of copying /etc/smb.conf and the files in /var/samba and /var/db/samba to the new server, along with exporting and importing the old user accounts to the new server, and then see if everything works as expected.
If so, we'll see if we can change the account names in a nice way, it's really desired to do so.
If not, we really need to do some more research, but if I'm not mistaking, the Samba-related files I just mentioned are the ones that pretty much make up the Windows Services in OS X, isn't that so?
Thanks!

Run Labview as different windows user (for database connectivity)

I have to connect to a corporate remote MSSQL-Database on the network, using the database connectivity toolkit for LabVIEW.
The db-authentification is realized checking the windows user (ads) who acceses the datebase (not a database user / password which is standard in the database vis)
Therefore I have to run LabVIEW as the defined windows user, different than the logged in user on the pc.
Is that possible to realize with LabVIEW?
Other Windows-tools allow to define the windows user/password which "run" an application - how can I do that with LabVIEW?

Hi Zav. There is a windows command 'runas' which _may_ let you do what you want; I haven't
tried what you need to do, but is has worked for other tasks for us. Try 'runas /?' for the switches.
You will have to build your LV program into an executable, then use runas to launch it. Is there
a reason you can't just login to Windows as the required user?
If you can get your db admin to allow dbuser/password authentication that would be a much better
way to go.
Matt

Syncing Windows users with Mac users home folders

Hello,
I have setup my 10.6 XServe to allow Windows user to connect.
The Windows machines log into the server just fine but when they save something to their Documents, Desktop etc... it doesn't show up when they log into a Mac machine and vice versa.
I did find a script on WazMac for a logon vbs but that does not work.
Any help?

Thank you Linc Davis,
I did some investigation on the internet to see the default ACLs on the "users" folder and I noticed that I added a group access. I deleted it and ended up with the correct configuration. I have now each user accessing his own home folder with read and write access to all the folders (desktop, music, video...) and sees the others users' home folder with access denied.
I think I can live with that configuration. Problem solved.

Windows Logins x Windows Groups - identify idinvidual Windows Users?

Similar Messages

Maybe you are looking for