sql-login-syncer: Copy SQL Server Logins Without Losing SIDs or Passwords
The spent three posts building up to a practical conclusion: SQL Server maps database users to logins by SID, not by name, and any login you recreate from scratch gets a new SID. showed the…
Logins, SIDs, and Kerberos from First Principles, Part 8: Auditing Logins with Service Broker
The series so far has answered who can connect ( showed even that requires asking Windows) and how they prove it ( and ). The closing question is who actually does. Group-based access means the…
Logins, SIDs, and Kerberos from First Principles, Part 7: Is Your Kerberos Still Using RC4?
got your connections onto Kerberos. This part asks an uncomfortable follow-up: encrypted with what? You probably have not thought about Kerberos encryption types recently. That is fair; the protocol mostly just works and has for…
Logins, SIDs, and Kerberos from First Principles, Part 6: SPNs and the Silent NTLM Fallback
The first five parts of this series were about who you are: SIDs, logins, groups. This one is about how you prove it. When a Windows principal connects to SQL Server with integrated authentication, one…
Logins, SIDs, and Kerberos from First Principles, Part 5: Windows Groups and the Invisible Members
Every post in this series so far has dealt with principals you can see: a login row in sys.server_principals with a name and a SID. Windows groups break that comfortable assumption. Grant a group a…