Logins, SIDs, and Kerberos from First Principles: Series Contents

An eight-part series on SQL Server identity, from the bytes up.

A woman security officer holds a fingerprint badge to a scanner at a castle gate, watched by a three-headed guard dog, with a queue of badge holders behind her.

It explains what a SID is, what happens when a service account is deleted and recreated, how to migrate logins with their SIDs and passwords intact, how to script every permission a principal holds, and how Windows group membership hides who can connect. The last three parts cover SPNs and the fallback from Kerberos to NTLM, RC4 encryption in Kerberos tickets, and a login audit built on Service Broker.

  1. Logins, SIDs, and Kerberos from First Principles, Part 1: What a SID Actually Is
  2. Logins, SIDs, and Kerberos from First Principles, Part 2: The Vanishing Service Account
  3. Logins, SIDs, and Kerberos from First Principles, Part 3: Migrating Logins Without Losing Them
  4. Logins, SIDs, and Kerberos from First Principles, Part 4: Scripting Every Permission a Principal Holds
  5. Logins, SIDs, and Kerberos from First Principles, Part 5: Windows Groups and the Invisible Members
  6. Logins, SIDs, and Kerberos from First Principles, Part 6: SPNs and the Silent NTLM Fallback
  7. Logins, SIDs, and Kerberos from First Principles, Part 7: Is Your Kerberos Still Using RC4?
  8. Logins, SIDs, and Kerberos from First Principles, Part 8: Auditing Logins with Service Broker

Questions or corrections are welcome on Bluesky or LinkedIn. See all series on this blog.