Re: Should you use local machine groups?

No. Do not map domain groups to local accounts and then map those local
accounts to the SQL Server. Eventually, that mistake will cause you grief.

Grant SQL Server login permission directly to the Domain accounts, and map
them to SQL ROLES. By so doing, you will not be 'bound' to the piece of
hardware. (Think about having a server crash and having to rebuild up on a
new box. Or a parallel upgrade to a new piece of hardware. What where those
LOCAL accounts again?)

--
Arnie Rowland, Ph.D.
Westwood Consulting, Inc

Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous

You can't help someone get up a hill without getting a little closer to the
top yourself.
- H. Norman Schwarzkopf


"James" <James@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:2C154835-14BD-47CC-ADC1-51F27B503143@xxxxxxxxxxxxxxxx
Somewhere in the dim past I remember a Microsot recommendation NOT to map
active directory domain groups directly to SQL logins but rather to map
the
domain group to a machine local group and then to put that local group to
the
SQL.

Is this a valid "best practice" or is it booogus?

Thanks


.

Relevant Pages

  • Re: Sql server 2005 clustered service group
    ... For each clustered service in the instance of SQL Server that you are ... administrator for the names of existing domain groups, ... Note that SQL Server accounts will not be removed from the groups if SQL ... I see with installing SS2005 cluster if forces me to use domain accounts ...
    (microsoft.public.sqlserver.setup)
  • Replacing Workgroup Security with Domain Groups/Acounts - is it possible
    ... We have Database with back end on SQL server and Front end as Access MDB ... with workgroup security setup to restrict editing the forms etc ... Is it possible to do Workgroup type security, but assigned to Domain groups ...
    (microsoft.public.access.security)
  • Re: Sql server 2005 clustered service group
    ... SQL Server MVP ... administrator for the names of existing domain groups, ... Note that SQL Server accounts will not be removed from the groups if SQL ...
    (microsoft.public.sqlserver.setup)
  • Re: Security Model Problems
    ... Step 3 Create two new local groups on the server hosting SQL Server (one for ... Create global domain groups and add appropriate users. ...
    (microsoft.public.sqlserver.security)
  • Re: Role based security
    ... I want to be able to defined the roles in the web config e.g Manager, ... I want to be able to map NT application groups to those roles in the ... able to allocate the NT domain groups in the web config against the ...
    (microsoft.public.dotnet.security)