Logins, SIDs, and Kerberos from First Principles, Part 8: Auditing Logins with Service Broker
The series so far has answered who can connect ( showed even that requires asking Windows) and how they prove it ( and ). The closing question is who actually does. Group-based access means the…
Logins, SIDs, and Kerberos from First Principles, Part 7: Is Your Kerberos Still Using RC4?
got your connections onto Kerberos. This part asks an uncomfortable follow-up: encrypted with what? You probably have not thought about Kerberos encryption types recently. That is fair; the protocol mostly just works and has for…
Logins, SIDs, and Kerberos from First Principles, Part 6: SPNs and the Silent NTLM Fallback
The first five parts of this series were about who you are: SIDs, logins, groups. This one is about how you prove it. When a Windows principal connects to SQL Server with integrated authentication, one…
Logins, SIDs, and Kerberos from First Principles, Part 5: Windows Groups and the Invisible Members
Every post in this series so far has dealt with principals you can see: a login row in sys.server_principals with a name and a SID. Windows groups break that comfortable assumption. Grant a group a…
Logins, SIDs, and Kerberos from First Principles, Part 3: Migrating Logins Without Losing Them
Server migrations have a predictable failure mode: the databases restore perfectly, the application connection strings are updated, and then nothing can log in. Or worse, everything can log in but half the database users are…