Logins, SIDs, and Kerberos from First Principles, Part 5: Windows Groups and the Invisible Members
Every post in this series so far has dealt with principals you can see: a login row in sys.server_principals with a name and a SID. Windows groups break that comfortable assumption. Grant a group a…
Logins, SIDs, and Kerberos from First Principles, Part 3: Migrating Logins Without Losing Them
Server migrations have a predictable failure mode: the databases restore perfectly, the application connection strings are updated, and then nothing can log in. Or worse, everything can log in but half the database users are…
Logins, SIDs, and Kerberos from First Principles, Part 2: The Vanishing Service Account
Years ago at a previous employer, I wrote a fleet-sweep script that searched every SQL Server instance in the estate for a specific service account, by name and by a known-bad SID. I no longer…
Logins, SIDs, and Kerberos from First Principles, Part 1: What a SID Actually Is
Ask SQL Server who you are and it will answer with a name. Ask it to make a decision about you, though, and it uses something else entirely: a security identifier, or SID. Names are…
Backup & Recovery from First Principles, Part 11: The Keys Nobody Backs Up – SMK, DMK, and a War Story
ended the series with a rule: key material is a third artifact class beside data backups and log backups, and it needs its own backup. That post demonstrated the certificate side. This bonus part climbs…