In this post, I am sharing the option of changing the Authentication Mode of SQL Server from the Windows Registry.

Most of the DBAs are always trying to manage database server from the outside like Windows Powershell, Windows Registry, Shell Command prompt.

Here also, I am sharing Windows Registry path for changing the SQL Authentication Mode.

Registry Path:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL13.DBRND\MSSQLServer

There are two types of authentication modes, “Windows Authentication mode” and “SQL Server and Windows Authentication mode (Mix mode)”.

In the above path, you have to change “LoginMode” parameter. 1 = Windows Authentication mode, 2 = Mix mode.

Check the below screenshot:

In this post, I am sharing a T-SQL script to identify a current SQL Server Authentication Mode.
You can use SERVERPROPERTY to find this details of SQL Server.

Why is this important?

In my previous organization, we have 23 different SQL Server Instances, and we set policies to allow System admin using only Windows Authentication mode.
The reason is security, and Windows Active Directory is more secure than SQL Server database user authentication.

Simply, we want to check the authentication mode of all the SQL Server Instances, so I found below script which I am sharing here.

Use Master
GO

SELECT 
	CASE SERVERPROPERTY('IsIntegratedSecurityOnly')
	WHEN 0 THEN 'Mixed Mode - Authentication Mode (Both SQL Server and Windows Authentication)'
	WHEN 1 THEN 'Only Windows Authentication Mode.' 
END AS SQL_Server_Authentication_Mode
GO

What do you know about the Change Data Capture (CDC)?

Change Data Capture (CDC) is used to track the changed data caused by common DML operations (INSERT/UPDATE/DEKLETE). The capture process reads the transaction log to pull out the data change information and then load the information into the associated change table.

How to disable change data capture (CDC) on a table?

USE Your_Database_Name
GO
EXEC sys.sp_cdc_disable_table
@source_schema = N'dbo',
@source_name = N'YourTableName',
@capture_instance = N'dbo_YourTableName'
GO

How to check if Change Data Capture is enabled or disabled on a SQL Server Database?

SELECT [name], is_cdc_enabled
FROM sys.databases where name = 'Database_Name'
/*
is_cdc_enabled = 0 -- CDC is disabled
is_cdc_enabled = 1 -- CDC is enabled
*/

How to Restore Database On Which Change Data Capture (CDC) Is Enabled?

When we restore a database from a CDC enabled database backup, it does not restore the CDC object automatically. Also if you try to look for some options for Restore with CDC object etc. in Database Restore Wizard, you would not find anything.

If we restore the database on the same SQL Server instance with same name, CDC objects will be restored and it will start working fine as CDC jobs are available on the server already.

If you try to restore with a different name or restore to different SQL Server instance, It will not restore CDC objects by default. In Restore Database statement, we have to include Keep_CDC.

What is the Guest user account in SQL Server?  What login is it mapped to it?

The Guest user account is created by default in all databases and is used when explicit permissions are not granted to access an object.  It is not mapped directly to any login, but can be used by any login.

How can SQL Server instances be hidden?

To hide a SQL Server instance, we need to make a change in SQL Server Configuration Manager. To do this launch SQL Server Configuration Manager and do the following: select the instance of SQL Server, right click and select Properties.

After selecting properties you will just set Hide Instance to “Yes” and click OK or Apply. After the change is made, you need to restart the instance of SQL Server to not expose the name of the instance.

Is it possible to disable SA, how?

Disable the SA Login

Disabling the SA account is a good option to prevent its use. When it is disabled no one can use it in any circumstance until it is enabled.

What is the difference between Authenticate and Authorization?

When you log on to a PC with a user name and password you are authenticating. Authorization is the process of verifying that you have access to something. Gaining access to a resource (e.g. directory on a hard disk) because the permissions configured on it allow you access is authorization.

Which one is highest privileged role out of SQLAgentUserRole, SQLAgentReaderRole, SQLAgentOperatorRole?

SQLAgentOperatorRole is the most privileged of the SQL Server Agent fixed database roles. It includes all the permissions of SQLAgentUserRole andSQLAgentReaderRole. Members of this role can also view properties for operators and proxies, and enumerate available proxies and alerts on the server.

What is the password policy for SQL Server Accounts?

• The password must contain uppercase & lowercase letters.
• The password must contain numbers & alphanumeric characters.
• The password must contain non-alphanumeric characters such as &, ^,%,*,$ etc.
• Do not use common known passwords that are easy to guess such as: admin, password, sa, administrator, sysadmin etc.
• Passwords should be long enough (at least 8 characters long).
• It does not allows blank password for the SA account.

What are the disadvantages of SQL Server Authentication Mode?

If a user is a Windows domain user who has a login and password for Windows, he must still provide another (SQL Server) login and password to connect. Keeping track of multiple names and passwords is difficult for many users. Having to provide SQL Server credentials every time that one connects to the database can be annoying.

SQL Server Authentication cannot use Kerberos security protocol.

Windows offers additional password policies that are not available for SQL Server logins.

The encrypted SQL Server Authentication login password, must be passed over the network at the time of the connection. Some applications that connect automatically will store the password at the client. These are additional attack points.

When CHECK_POLICY is ON, what kind of behavior occur?

CHECK_EXPIRATION is also set to ON unless it is explicitly set to OFF.

The password history is initialized with the value of the current password hash.

Account lockout duration, account lockout threshold, and reset account lockout counter after are also enabled.

What is What is TRUSTWORTHY database?

Applies To: SQL Server 2016.

The TRUSTWORTHY database property is used to indicate whether the instance of SQL Server trusts the database and the contents within it. By default, this setting is OFF, but can be set to ON by using the ALTER DATABASE statement.

This property can be used to reduce certain threats that can exist as a result of attaching a database.

Where are the places that I should not use the sa login?

• Embedded in management tools or application development tools
• Hard coded in application connection strings
• DTS or SSIS connection objects
• UDL files
• Batch files
• SQLCMD, OSQL or ISQL T-SQL scripts
• In casual conversation
• On sticky notes on your desk or monitor

What is the use of BUILTIN\Administrators Group in SQL Server?

Any Windows login in BUILTIN\Administrators group is by default a SQL Server system administrator. This single group can be used to manage administrators from a Windows and SQL Server perspective.

How to detect Orphaned Users in SQL Server?

SELECT dp.type_desc, dp.SID, dp.name AS user_name
FROM sys.database_principals AS dp
LEFT JOIN sys.server_principals AS sp
ON dp.SID = sp.SID
WHERE sp.SID IS NULL
AND authentication_type_desc = 'INSTANCE';

What is SQL Profiler?

Microsoft SQL Server Profiler is a graphical user interface to SQL Trace for monitoring an instance of the Database Engine or Analysis Services. You can capture and save data about each event to a file or table to analyze later.

Use SQL Profiler to monitor only the events in which you are interested.

If traces are becoming too large, you can filter them based on the information you want, so that only a subset of the event data is collected.

Monitoring too many events adds overhead to the server and the monitoring process and can cause the trace file or trace table to grow very large, especially when the monitoring process takes place over a long period of time.

What is Builtin/Administrator?

The Builtin/Administrator account is basically used during some setup to join some machine in the domain. It should be disabled immediately thereafter. For any disaster recovery, the account will be automatically enabled. It should not be used for normal operations.

How can SQL Server instances be hidden?

To hide a SQL Server instance, we need to make a change in SQL Server Configuration Manager. To do this launch SQL Server Configuration Manager and do the following: select the instance of SQL Server, right click and select Properties.

After selecting properties you will just set Hide Instance to “Yes” and click OK or Apply. After the change is made, you need to restart the instance of SQL Server to not expose the name of the instance.

What are the authentication modes in SQL Server? How can it be changed?

Windows mode and Mixed Mode – SQL and Windows. To change authentication mode in SQL Server click Start, Programs, Microsoft SQL Server and click SQL Enterprise Manager to run SQL Enterprise Manager from the Microsoft SQL Server program group. Select the server then from the Tools menu select SQL Server Configuration Properties, and choose the Security page.

How can we check whether the port number is connecting or not on a Server?

TELNET [HOSTNAME] PORTNUMBER

Can we uninstall/rollback a service packs from SQL Server?

No: To rollback a SP you have to uninstall entire product and reinstall it.

What do you know about the Hotfixes?

Hotfixs are software pathces that were applied to live i.e. still running systems. A hotfix is a single, cumulative package that includes one or more filfes that are used to address a problem in a software product.

Why shrinking of database is bad in SQL Server?

Shrinking a database increases fragmentation which causes performance problems.

I talked about how databases are like boxes being filled with content every day. As the box gets filled, the amount of free space decreases. But if you know that you will need to fill it up with more content, wouldn’t you go get a bigger box? Sadly, that’s not what we’re doing when we’re shrinking databases.

We’re basically throwing away the box with free space to replace it with a smaller box with just enough space to keep all of the existing content. Imagine what you would do to accomplish this task – empty the box of its contents, throw away the box, replace it with a smaller box and put the contents back in.

Can we install SQL Server using a configure file?

Yes: We can prepare a configuration file. While installing SQL Server the path to the configuration file is specified in the “Ready to Install” page in the configuration file path section.

Which Dynamic memory view is used to check memory usage by SQL Server?

We can use this view sys.dm_os_process_memory.

What do you know about the Lock Page in Memory?

Lock Pages in Memory is a setting that can be set on 64-bit operating systems that essentially tell Windows not to swap out SQL Server memory to disk. By default, this setting is turned off on 64-bit systems.

What do you know about the SQL Server Latches?

• A latch is used to cordinate the physical execution of multiple threads within a database.
• A latch is a lightweight synchronization object used by the Storage Engine to protect memory structures used internally by SQL Server. A latch is nothing more than a so-called Critical Section in multi-threaded programming.
• For row-level locking it was very important to introduce a concept like latching, because otherwise it would give rise to phenomena like Lost Updates in memory.

What are the different types of Lathces in SQL Server?

• IO Latches
• Buffer Latches (BUF)
• Non-Buffer Latches (Non-BUF)

Can DBA control or manage the SQL Server Latches?

No: It is not possible, It’s internally manage by the SQL Server. We can just check the different statuses of latches.

What is a User Database?

A user database is a database that we create to store data and start working with  the data.

Why is all of the memory allocated for SQL Server not shown in Windows Task Manager?

The” Mem Usage” column shows the amount of memory for the working se t. The working set of a process is the set of pages in the virtual address space of the process that are currently resident in physical memory.

To find out how much memory SQL Server has allocated through the AWE mechanism, you can use the sys.dm_os_memory_clerks DMV.

Which autogrowth database setting is good?

Setting an autogrowth in multiples of MB is a better option than setting autogrowth in percentage (%).