Logins, SIDs, and Kerberos from First Principles, Part 3: Migrating Logins Without Losing Them
Server migrations have a predictable failure mode: the databases restore perfectly, the application connection strings are updated, and then nothing can log in. Or worse, everything can log in but half the database users are…
Logins, SIDs, and Kerberos from First Principles, Part 2: The Vanishing Service Account
Years ago at a previous employer, I wrote a fleet-sweep script that searched every SQL Server instance in the estate for a specific service account, by name and by a known-bad SID. I no longer…
Logins, SIDs, and Kerberos from First Principles, Part 1: What a SID Actually Is
Ask SQL Server who you are and it will answer with a name. Ask it to make a decision about you, though, and it uses something else entirely: a security identifier, or SID. Names are…
Is Your SQL Server Using RC4 for Kerberos? Here’s How to Find Out
You probably haven’t thought about Kerberos encryption types recently. That’s fair; the protocol mostly “just works” and has for decades. But CVE-2026-20833 changed the calculus. Microsoft disclosed a Kerberos information disclosure vulnerability in January 2026…
Inspecting SQL Server TLS Certificates Without Credentials
If you’ve ever needed to check the TLS certificate on a SQL Server instance – whether it’s expired, misconfigured, missing SANs, or just plain self-signed – you’ve probably had to connect with SSMS, run some…
Detecting Locked or Expired Logins
SQL Server logins can be configured to use password policies enforced by Windows. These policies include determining when passwords expire, how many invalid passwords can be entered before lock-out, etc. The T-SQL code in this…