RE: Keeping Domain & SQL Access In Sync

From: Mike Epprecht (SQL MVP) (mike_at_epprecht.net)
Date: 07/19/05

  • Next message: BBFrost: "Re: Visual Studio gives direct dbo access to Sql Server 2000 ??? <<Update>>" 
    Date: Tue, 19 Jul 2005 08:41:03 -0700

    Hi

    Why don't you rather use Domain Groups?
    Give a domain group the correct access, and add the user to the group. A
    user can be in multiple groups and when the NT accounts gets added or
    removed, there is no maintenance from the DBA side.

    Regards
    --------------------------------
    Mike Epprecht, Microsoft SQL Server MVP
    Zurich, Switzerland

    MVP Program: http://www.microsoft.com/mvp

    Blog: http://www.msmvps.com/epprecht/

    "Colette" wrote:

    > Does anyone know of a sample script I could get access to that would
    > automatically compare disabled/deleted domain accounts to the SQL Security
    > Logins and keep them "in sync" without any interaction from the SQL
    > administrator? We're wanting to eliminate the need of sending manual
    > notifications to the SQL administrator of terminated employees and running
    > the sp_denylogin. Instead, we want to just create a script that would go out
    > to all of our SQL servers and automatically remove accounts no longer active
    > in the domain itself. Does Active Directory provide any tools to do this?
    >
    > Any help would be greatly appreciated.
    >
    > Thanks.
    >
    > Colette

  • Next message: BBFrost: "Re: Visual Studio gives direct dbo access to Sql Server 2000 ??? <<Update>>"

    Relevant Pages

    • Re: Domain Groups For Clustering Service ???? SQL Server 2005
      ... You need to manually add the service accounts you specify during setup into ... services then just add that to each of the 3 domain groups you create. ... Jasper Smith (SQL Server MVP) ...
      (microsoft.public.sqlserver.clustering)
    • Re: Domain Groups For Clustering Service ???? SQL Server 2005
      ... I made three domain groups named as SQLUsers,AgentUsers,FTUsers ... and then put the Service Account named as SQLService and administrator ... > Jasper Smith (SQL Server MVP) ... >> add accounts to the domain groups. ...
      (microsoft.public.sqlserver.clustering)
    • Re: Sql server 2005 clustered service group
      ... administrator for the names of existing domain groups, ... The account under which SQL Server Setup is running must have privileges to ... Note that SQL Server accounts will not be removed from the groups if SQL ... I see with installing SS2005 cluster if forces me to use domain accounts ...
      (microsoft.public.sqlserver.setup)
    • Re: Sql server 2005 clustered service group
      ... For each clustered service in the instance of SQL Server that you are ... administrator for the names of existing domain groups, ... Note that SQL Server accounts will not be removed from the groups if SQL ... I see with installing SS2005 cluster if forces me to use domain accounts ...
      (microsoft.public.sqlserver.setup)
    • Replacing Workgroup Security with Domain Groups/Acounts - is it possible
      ... We have Database with back end on SQL server and Front end as Access MDB ... with workgroup security setup to restrict editing the forms etc ... Is it possible to do Workgroup type security, but assigned to Domain groups ...
      (microsoft.public.access.security)