Windows ORA_DBA group

Here is my situation; We are getting ready to put a databse on a customers server which is hooked into their AD. We have proprietary information in this database which we cannot allow them access to. In securing this database i realized that the customer would always be able to add whomever they wanted to the ORA_DBA group, thereby being able to "connect / as sysdba" and then able to change the sys/system password and gain access to all the data. I tested and confimed this. My question is: is it possible to tell Oracle not to allow OS Authentication and require database authentication? Effectively disabling this capability. I have looked through the init parameters and have not found anything. Ideas?
Thanks
Mike

OP,
If anyone can come over to the system and change the files, I don't see any way that this can be enforced that proper authentication is used while logging in. But I would suggest that you search over Pete Finnigan's website at http://www.petefinnigan.com/ . He is one of the best known experts regaring security and I am sure, he would be able to guide you in a better way.
HTH
Aman....

Similar Messages

Creating ora_dba group in Windows vista

Hi,
I have installed Oracle 10g in a Windows vista environment. The Oracle installation guide "http://download.oracle.com/docs/cd/B19306_01/install.102/b14316/intro.htm#i1006491" says that OUI creates the ora_dba group when the oracle s/w is installed. But, the ora_dba group is not created in my system and I also don't have a "local and users group" category in the computer management to create a group either.
The sqlnet.ora file has the parameter SQLNET.AUTHENTICATION_SERVICES= (NTS)
So, I was wondering how would a user be authenticated by the OS as a dba...
and also if anybody knows how to create the ora_dba group plz reply...
ur help is greatly appreciated
Thanks.

The best thing you can do with Vista is download VMware Server and use it to run a Centos 4 or 5 virtual machine. Then you will see Oracle run as she was meant to be run.
Vista is a client operating system. Oracle is intended to be run on servers. Enough said.

Changing from dev to standard edition causes "Could not obtain information about Windows NT group/user error code 0x6e."

Hello,
We recently upgrade our SQL Server 2012 SP1 (64bit) dev edition to standard edition, after we purchased the required licence and it was deployed in production.
Since the edition change, we are now receiving the following error, with some of our jobs, which have an e-mail step in them, which is causing the jobs to fail.
Msg 14661,Level 16, State 1, Procedure sp_send_dbmail, Line 517
Query execution failed: Msg 15404, Level 16, State 19, Server BL-SVR15, Line 1
Could not obtain information about Windows NT group/user 'BLUELIZARD\savaa', error code 0x6e.
Any ideas how to fix this issue? We were also having a similar error, when executing the jobs, but changing the job owner to SA has fixed this issue.
Thanks,
Andy.

Hi,
Which user account you used for SQL Server service, domain account or local account?
If it is domain account, are you able to log in to a machine with it?
Make sure that the password of account is not expired.
Also, grant the user Allowed to Authenticate permission and see how it helps.
Refer to the below article:
http://geeks.ms/blogs/ozonicco/archive/2013/01/14/208266.aspx
Thanks.
Tracy Cai
TechNet Community Support

Import Windows XP Group Policy into Windows 7?

Is it possible to import a Windows XP Group Policy into Windows 7? It seems ZCM will not let you edit the XP policy from Windows 7 even though you can apply the policy to a Windows 7 Workstation and have the policy applied without issue. I'm still researching it, but the search terms return many Active Directory results.
ZCM 10.3.3 on Linux. and eDirectory only.

jcsmith1,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://forums.novell.com/

Looking for "Window Manager\Window Manager Group" SID

Hi. I am trying to find the SID for "Windows Manager\Window Manager Group". If anyone has that, I'd appreciate it. I am trying to build my "base build" Security Template for Server 2012, and I need to assign the default User Rights to that group, as it is
out-of-the-box. Problem is that the GUI does not accept that group name as valid, but I can see that the group is assigned user rights in the Local Security Policy. I typically just use a file ACL to do this (add the ACE and then run
icacls to get the SID), but that group name is not valid within that tool either. My guess if that this new "Windows Manager\Window Manager Group" group is a well-known SID. Thanks.

Ironically the SID is not listed on Microsoft's web page for well know
SIDs. I also noticed that when I dump the local users using powershell, every group and user is listed that I would expect to see, but this one is not in that list. It seems like it should be pretty easy for Microsoft to say what this does and when it can
be safely removed...
I figure one of two possibilities. Either this only matters when a specific feature is installed / active, or it is some remnant from development for a feature or implementation that didn't make it into the release to manufacturing. What ever the case it
would be nice if we could get clarification.

Validating against a Windows NT Group in SQL Server

I am trying to access a SQL Server using a trusted Windows NT group that has been established. I have set up the group in the database's security and assigned it to the appropriate prepared statements but I'm not sure how to access it using Java for authentication of the connection. I can access individual logons with passwords, but it escapes me how to access the group so I dont have to use individual passwords to access the prepared procedures.
I am using JSPs for the front end if that makes a difference in the authentication.

Yes, I am using JDBC-ODBC.
I have gotten further in this problem. Here is where I am now.
I have managed to get the JSP to access the Java application to validate against the SQL Server group, but it is using the login name and password of who signed in to startup Tomcat instead of the person who is accessing the application through the JSP. Therefore, if an autherized person to SQL Server started Tomcat, then everyone can get in otherwise no one can get in.
I am shooting for not requiring the user to sign in to yet another application as they should be able to be authenticated through the trusted NT Domain group.
Is there something I should put in the JSP to pick up their user id to pass it along to the Java application? Should I be going down a different line of logic?

Windows 2012 Group Policy Option missing for Windows 7 Client

Hi there,
We have a deployment with a windows 2012 DC and various Windows 7 clients.
I am trying to set up a group policy on the 2012 DC to configure the Windows 7 clients and basically disable the Aero feature.
The "Do not allow desktop composition" is the one I need to enable and this would sit under Admin Templates > Windows Components > Desktop Windows Manager.
In Windows 2012 Group Policy editor this does not show...does anyone know how I can do this to a remote Windows 7 machine from 2012 DC?
Note if it helps on a windows 7 machine you can also disable the service "Desktop Window Manager Session Manager”
to achieve the same thing BUT when looking through the Group Policy again I can’t seem to find this!!
Thanks for any help,
Steve

> In Windows 2012 Group Policy editor this does not show...does anyone
> know how i can do this to a remote Windows 7 machine from 2012 DC?
Install RSAT and edit on W7. Or copy all W7 admx/adml templates to the
central store.
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Windows manager\Window Manager Group

Hello - Do any one knows what is the purpose of windows manager\Window Manager Group? I cant find it on local windows group nor local accounts.
Im trying to add windows manager\Window Manager Group to security policy but the account cant be looked up
Thank you,
Adnan
ad

I guess my real question is where are you coming up with the windows manager account? There is no account with such a name by default in Windows, so I am guessing it is something that you have added to your environment or something being talked about
in some third party software install. As such, it would be pretty hard for us to explain its purpose.
.:|:.:|:. tim

Window Manager\Window Manager Group

Based on customer requirements we need to set Bypass traverse checking rights for our Server 2012 boxes. In doing so we noticed that there is a user or group named Window Manager\Window Manager Group. I have seen references in other threads to this user
pointing to the SID (S-1-5-90-0), but this is not documented anywhere on Microsoft website that I can find. I used Powershell to list all of the users, and I do not see a user or group on my Server 2012 box that matches this.
Given no response from Microsoft and no documentation, I cannot effectively decide what I should do with this.
It looks kind of shady that we are granting rights to a SID / Account that we cannot see, so I am wondering if this is some remnant for a part of Server 2012 that didn't get deployed when the code was released to manufacturing. Can some please confirm that
it is OK to drop this user or group (not even sure which one it is) from the Bypass Traverse Checking user right?

Hi，
Based on my research,it is not recommended to remove the group ‘Window manager\Windows manager group’ from Bypass traverse checking or Increase a process working set.
• Both the above user rights are utilized in windows 8/2012 for performance impacts.
• The above mentioned group cannot be added manually to any other groups or no user can be a part of it as it does not resolve in object picker. We cannot even add ACLs to this group.
• Due to above reasons, it is not a security breach in your environment.
This group is a virtual group that is present on every Windows 2012 machine. The DWM.EXE that is used to manage he desktop experience runs under the security context of an account under this group and this is used to provide less privilege to the DWM.EXE.
As such this is not documented anywhere in any of public documents. This is a design decision made by the product team which is part of the architecture of the OS. As such the practice is not to remove this group from both the user rights assignment mentioned.
How Bypass traverse checking affects performance:
When you try to access c:\foo\bar\baz\bletch\george.txt, “the rules” say that you need to confirm that the user has traverse access to:
          C:\foo
          C:\foo\bar
          C:\foo\bar\baz
          C:\foo\bar\baz\bletch
If you didn’t have the “bypass traverse checking” privilege, the system would have to open each of these directories in turn and do an access check to make sure you had access to all the intermediate nodes in the path to the file. With bypass traverse
checking, the filesystems skip all those checks and just check to make sure you have your desired access to the file you’re opening.
How increase a process working set affects performance:
This settings controls who can increase the working set of a process when in memory. Working set is the data that is resending in the Ram that is visible to the process. This helps in expanding the memory a process stores in RAM thereby reducing page faults
(paging out memory to virtual memory which will induce delays of copying the memory back to RAM).
Given the above reasons, I strongly recommend you not to remove ‘Windows manager\Windows manager group’ from Bypass traverse checking as well as increase a process working set user rights assignment.
Thanks.

Windows user groups with # character ok?

I wanted to know if a windows user group is used in SQL server 2008R2 which contains a naming convemtion that includes the # character would operate ok within BizTalk databases.
eg. domain\#mg-dd-something
Any help and advice would be greatly appreciated.

But in this context, its the backslash that is the special character. A legal identifier in SQL Server consists of alphanumeric characters + plus the characters _, #, @ and $. Of these $ can never been used initially. @ can only be used initially for variables.
# can be used initially without restrictions except for objects in sys.objecs, where it only can be used for stored procedures and tables and for these have a special meaning. For non-object objects, # can be used freely. Underscore should never been an issue,
as it is commonly used an identifier in many languages.
So this is legal:
create login #nisse@manpower with password ='hult'
Whether you should use it? There is certainly a bigger risk that you run into issues. Not necessarily in SQL Server itself. It could also be with other MS products or third-party software. And not forget people in your organisation who will be confused by
it.
Erland Sommarskog, SQL Server MVP, [email protected]

Update Windows AD Group Graph not appear in Administration Tool in CMC

Hi,
There are objects in CMC--> Public Folder --> Administration Tools
In administration tool, there are two objects
1) Update Windows AD Group Graph
2) Update Windows AD Group Graph and Aliases
these are not in Adminstration Tool folder. When I try to import from other environments, got the message the object is read only.
I also update the object in CCM-->update objects. It does not work.
Has anyone experience the same problem, and fixed it.
My envriorment is
BOE 3.1 SP3
Windows Server 2008
Sql Server 2008
Your help would be much appreciated to solve this issue.
Regards,
Tayyab

I solve this issue by migrating the UpdateADPlugin.en.biar file.
After that it is appeared.

BOXI R2 SP4 (FP 4.1) Windows AD Groups not updating

I just patched my BO XI R2 server to service pack 4 and applied fix pack 4.1. I am having an issue where my Windows AD groups are not updating correctly. When I log into the CMC and go to users, click on an account name and then click on the "Member of" tab, I don't see the Windows AD groups that the user belongs to. However, when I go to "Groups", click on the group name that the user is supposed to belong to and then click on "Users", I see the user's account name/login. Has anyone else seen this problem? I have tried the following:
- remove the user from the Windows AD group using Active Directory Users & Groups and adding them back in
- adding the user into a new Windows AD group and import that AD group
This is currently a pretty big problem for me so if anyone has any insight into how to fix this, I would greatly appreciate it. Thanks so much.
David Tjen
Art.com

Hi Glen,
It is expected that if changes are made in AD (that don't remove a user from all groups) will not be instant on the CMS. When you go to a group and click on the members/users tab. You will be prompted that this query may take some time. This action sends a live query to AD and therefore should be up to date. When you click on a user and try to view the groups for which they are a member this is not a live query but rather accesses a graph that the CMS maintains in memory. This graph is set to refresh every 15 minutes by default so there should at least be a 15 minute delay. Then the time to update the graph can vary as well. If you have 1 groups it should take a few seconds, but if you have 1000's of groups or many nested groups it could take much longer. To initiate this process you can hit update in the CMC\auth\AD or restart the CMS. If you find that this is not how the system is working, then it is best to open a message with support. These cases can be quite involved and usually require considerable CMS tracing and maybe packet scanning to resolve.
Hope this explains things....
Regards,
Tim

Windows 10 Group Policy (.ADMX) Templates now available for download

Windows 10 Group Policy (.ADMX) Templates now available for download Just to let you all know that we have released the Windows 10 Group Policy (.ADMX) templates on our download center as an MSI installer package. These .ADMX templates are released as a separate download package so you can manage group policy for Windows 10 clients more easily. This new package includes additional (.ADMX) templates which are not included in the RTM version of Windows 10. DeliveryOptimization.admxfileservervssagent.admxgamedvr.admxgrouppolicypreferences.admxgrouppolicy-server.admxmmcsnapins2.admxterminalserver-server.admxtextinput.admxuserdatabackup.admxwindowsserver.admxTo download the Windows 10 Group Policy (.ADMX) templates, please visit http://www.microsoft.com/en-us/download/details.aspx?id=48257 To review which settings are new in Windows 10,...
This topic first appeared in the Spiceworks Community

Rubicon Project is the operator of one of the advertising industry’s largest independent real-time trading platforms for digital advertising, and has engineered one of the largest real-time cloud and Big Data computing systems, processing trillions of transactions within milliseconds each month. The company’s pioneering technology created a new model for the advertising industry—similar to what NASDAQ did for stock trading. Rubicon Project’s automated advertising platform is used by more than 500 of the world’s premium publishers to transact with over 100,000 ad brands globally. To meet their expanding communications requirements, Rubicon Project selected 8x8 to provide 8x8 Virtual Office business VoIP, unified communications and mobile solutions to its nine international locations.8x8’s cloud-based telephony solutions enabled Rubicon...

Dreamweaver CS3, file window (panel group) came unattached?

This may be a minor problem, but it's very annoying to me
since I'm accustomed to using a particular layout. Anyway, after
rebooting my computer and starting Dreamweaver, i noticed my files
window (panel group) was not on the screen, whereas it's usually on
the right-hand side and attached beside the code/design view. So I
went up to the the Window menu and put a check by "Files" and it
opened my file window up, but it's not attached like it was before!
instead it just floats over my code/design view, and I don't like
that.
I've looked and looked some more but I can't figure out how
to re-attach it. Can someone here help me? Any assistance is
greatly appreciated!
edited to add - i've tried simply dragging and "redocking"
the panel as shown in the help, but it won't redock or stick
anywhere.

Apologies, I figured out how to fix it. I'm not sure why it
happened to begin with, but anyway... problem solved for now. I was
able to redock it after getting rid of the css panel and just
having the files panel open, unexpanded, then moving it until I saw
the black outline.

Windows user group for BizTalk contains # characters

I wanted to know if a windows user group is used in BizTalk Server 2013 which contains a naming convention that includes the # character would operate ok in BizTalk and SQL. PLease see the example below:
eg. domain\#mg-dd-BizTalk-SSO-Affiliate-Admins
Any help and advice would be greatly appreciated.

Hi Chris,
There are some naming conventions followed while creating the Windows user groups. not a concrete ones..one of them is here.
http://technet.microsoft.com/en-us/library/cc775802(v=ws.10).aspx
When it comes to BizTalk, if I can recollect, one of our clients had Windows user group with a symbol like yours which did work without any issues. But we suggested them to change the user group's name as this could affect some of our automated scripts like
Powershell/C# programs. For which they agreed and changed their Windows user group to ones without any symbols.
Yes, this would work but might fail for any of your automated maintenance scripts. Note: This experience with my client is with BizTalk 2006 and I have tested the case for latest versions.
If this answers your question please mark it accordingly. If this post is helpful, please vote as helpful by clicking the upward arrow mark next to my reply.

Windows ORA_DBA group

Similar Messages

Maybe you are looking for