Skip to main content

Training on the T's - SQL Server Security Easy Button Q&A

On October 7, 2014, I spoke for Pragmatic Works' Training on the T's webinar series. 
Here's the rest of the questions I didn't get to answer. 

Q: Where can I get the slide deck and presentation?
A: Orlando SQL Saturday , Tampa SQL Saturday , Jacksonville SQL Saturday

Q: All of our database tables are under the dbo schema. How can I set up programmers to be able to modify stored procedures but not give them the dbo schema permission with which they can modify tables?
A: I think the only possible way to do this is to split the stored procedures and tables into different schema. I do not see a way in the permission models to grant permission to modify stored procedures without also granting the same permission to modify tables.  Granting ALTER ON OBJECT gives access to multiple object types in the database. See longtime SQL Server MVP Erland Sommarskog's comment here on this question. See the next question for additional information. 

Q: Where i can get the SQL Server permissions PDF?
A. Google "sql server permissions poster" or go to this link.

Q: Good morning, Where I can find the current session recording? I missed half of the beginning part.
A: Consider yourself lucky. You missed most of my 'ums' in the first half. ;-)
You can find it here.

Q: Would you recommend using this security script along with C2 auditing?
A: Yes, but I would recommend using the Common Criteria Compliance option instead. C2 audit mode is deprecated and will be removed from a future version of SQL Server.

Q: The password vault you keep referring to is the windows credential manager found under user accounts in control panel?
A. No, it's called the Cyber-Ark Enterprise Password Vault

Q:You mentioned a couple of names of people we should know and I missed the name of the first guy.

Q: How does the DBA sign out a user id with sysadmin rights?
A: In our environment, they log in to Cyber-Ark and provide a valid change or incident ticket.

I apologize for too many 'ums' and completely forgetting to use Zoomit while reviewing the script.
Thank you for attending! 

Comments

Popular posts from this blog

Modifying Endpoint URLs on Availability Group Replicas

I recently had to modify the Endpoint URLs on our SQL Server Availability Group replicas.  The reason for this blog post is that I could not answer the following questions: Do I need to suspend data movement prior to making this change?  Would this change require a restart of the database instance? I spent enough time searching on my own to no avail that I tossed the question to the #sqlhelp hashtag on Twitter and Slack but didn't get an answer prior to executing the change request. After reading the relevant documentation, I think it's probably a good idea to suspend data movement for this change. The T-SQL is straightforward.  USE MASTER GO ALTER AVAILABILITY GROUP [AG1]  MODIFY REPLICA ON 'SQL2012-1' WITH (ENDPOINT_URL = 'TCP://10.10.10.1:5022'); ALTER AVAILABILITY GROUP [AG1]  MODIFY REPLICA ON 'SQL2012-2' WITH (ENDPOINT_URL = 'TCP://10.10.10.2:5022'); ALTER AVAILABILITY GROUP [AG2]  MODIFY REPLICA ON 'SQL2012-1

PASS Summit 2012 - Gone to the mountain and returned wiser

http://t.co/pmhsJ3rr I began my conference schedule by attending Allen White's pre-con "Automating SQL Server with PowerShell". Allen starts by telling everyone in attendance “We all can learn something from each other.  We all know something that someone else doesn't.” I thought this was a great intro and inspiration to the attendees to participate in the PASS Community. Later in the day while answering a question, Allen tells us he is not a PowerShell expert.  Which kind of surprises me.  He says he’s just figured out how to use PowerShell with SQL Server. I think he is being a bit too humble.   Afterwards, I talk to Allen about a script I’m working on and he points me in a direction that hopefully will help me finish it. All in all, it was e xcellent day of training on using PowerShell with SQL Server. As the main conference began, I tweeted about how tight the seating was in some of the rooms on the first day of the main conference.   After the Sum

PowerShell: Quick SQL Server Version Check

I have to keep track of our SQL Server version inventory.  The goal is to reduce the SQL Server 2000 population as fast as possible. The following PowerShell script will produce a csv file containing the database server name and the version of SQL Server it's running. 1: ## Get SQL Version installed on multiple servers ## 2: ## ./sqlver.ps1 3: $start = get-date 4: write-host "Start: " $start 5:   6: [reflection.assembly]::LoadWithPartialName("Microsoft.SqlServer.Smo") | out-null 7:   8: $FilePath = "C:\Output" 9: $OutFile = Join-Path -path $FilePath -childPath ("SQLVersions_" + (get-date).toString('yyyyMMdd_hhmmtt') + ".log") 10:   11: # Version inventory 12: @(foreach ($svr in get-content "C:\Input\AllLOBServers.txt") 13: { 14: $s = New-Object "Microsoft.SqlServer.Management.Smo.Server" $svr 15: $s | select Name, Version 16:   17: }) | export-csv -noType $OutFile 18:   1