sql-login-syncer: Copy SQL Server Logins Without Losing SIDs or Passwords
The spent three posts building up to a practical conclusion: SQL Server maps database users to logins by SID, not by name, and any login you recreate from scratch gets a new SID. showed the…
Logins, SIDs, and Kerberos from First Principles, Part 5: Windows Groups and the Invisible Members
Every post in this series so far has dealt with principals you can see: a login row in sys.server_principals with a name and a SID. Windows groups break that comfortable assumption. Grant a group a…
Logins, SIDs, and Kerberos from First Principles, Part 3: Migrating Logins Without Losing Them
Server migrations have a predictable failure mode: the databases restore perfectly, the application connection strings are updated, and then nothing can log in. Or worse, everything can log in but half the database users are…
Logins, SIDs, and Kerberos from First Principles, Part 2: The Vanishing Service Account
Years ago at a previous employer, I wrote a fleet-sweep script that searched every SQL Server instance in the estate for a specific service account, by name and by a known-bad SID. I no longer…
Logins, SIDs, and Kerberos from First Principles, Part 1: What a SID Actually Is
Ask SQL Server who you are and it will answer with a name. Ask it to make a decision about you, though, and it uses something else entirely: a security identifier, or SID. Names are…
Detecting Locked or Expired Logins
SQL Server logins can be configured to use password policies enforced by Windows. These policies include determining when passwords expire, how many invalid passwords can be entered before lock-out, etc. The T-SQL code in this…