Logins, SIDs, and Kerberos from First Principles, Part 7: Is Your Kerberos Still Using RC4?
got your connections onto Kerberos. This part asks an uncomfortable follow-up: encrypted with what? You probably have not thought about Kerberos encryption types recently. That is fair; the protocol mostly just works and has for…
Logins, SIDs, and Kerberos from First Principles, Part 6: SPNs and the Silent NTLM Fallback
The first five parts of this series were about who you are: SIDs, logins, groups. This one is about how you prove it. When a Windows principal connects to SQL Server with integrated authentication, one…
Logins, SIDs, and Kerberos from First Principles, Part 5: Windows Groups and the Invisible Members
Every post in this series so far has dealt with principals you can see: a login row in sys.server_principals with a name and a SID. Windows groups break that comfortable assumption. Grant a group a…
Logins, SIDs, and Kerberos from First Principles, Part 3: Migrating Logins Without Losing Them
Server migrations have a predictable failure mode: the databases restore perfectly, the application connection strings are updated, and then nothing can log in. Or worse, everything can log in but half the database users are…
Logins, SIDs, and Kerberos from First Principles, Part 2: The Vanishing Service Account
Years ago at a previous employer, I wrote a fleet-sweep script that searched every SQL Server instance in the estate for a specific service account, by name and by a known-bad SID. I no longer…