473,320 Members | 1,957 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,320 software developers and data experts.

ADP with SQL Server login

When I make change in the Connection screen in an adp I get the message
"Your password will not be encrypted before it is saved to the file. Users
who view the source contents of the file will be able to see the account
user name and password".

I am trying to build a case for using NT accounts rather than SQL internal
accounts. What are the steps required to access the locally saved password?

Thanks,
Chris

Nov 13 '05 #1
3 2875
Terri,
Don't save the password in the connection string. Two, Microsoft with SQL
Server 2000 says that the recommended password scheme is Windows 2000
Integrated. But I am a stubborn, paranoid old cuss and don't like the fact
that a user can get to my databases by signing on to my Windows domain. So
I've got my SQL Server instance set up so it uses both SQL Server logins
independant of Windows. It's two account names/passwords for my users but
then it's also harder to hack my databases so I leave it like that. But . .
.. when you set up an instance of SQL Server one of the choices you make is
the authentication method. At the moment I am allowing Windows Integrated
authenticated but then I am only one guy and three computers. If I was
getting paid by a client I'd probably set up my instance to require a
seperate login.

"Terri" <te***@cybernets.com> wrote in message
news:cj**********@reader2.nmix.net...
When I make change in the Connection screen in an adp I get the message
"Your password will not be encrypted before it is saved to the file. Users
who view the source contents of the file will be able to see the account
user name and password".

I am trying to build a case for using NT accounts rather than SQL internal
accounts. What are the steps required to access the locally saved
password?

Thanks,
Chris

Nov 13 '05 #2
Thanks Alan. I'd like to move to a Windows integrated security model because
of its security advantages, but unless I can demonstrate that the password
is recoverable on the local workstation I'm not going to get very far with
the people who can make the decision to move to Windows integrated security.
Thanks
"Alan Webb" <kn*****@hotmail.com> wrote in message
news:gY********************@comcast.com...
Terri,
Don't save the password in the connection string. Two, Microsoft with SQL
Server 2000 says that the recommended password scheme is Windows 2000
Integrated. But I am a stubborn, paranoid old cuss and don't like the fact that a user can get to my databases by signing on to my Windows domain. So I've got my SQL Server instance set up so it uses both SQL Server logins
independant of Windows. It's two account names/passwords for my users but
then it's also harder to hack my databases so I leave it like that. But . .. . when you set up an instance of SQL Server one of the choices you make is
the authentication method. At the moment I am allowing Windows Integrated
authenticated but then I am only one guy and three computers. If I was
getting paid by a client I'd probably set up my instance to require a
seperate login.

"Terri" <te***@cybernets.com> wrote in message
news:cj**********@reader2.nmix.net...
When I make change in the Connection screen in an adp I get the message
"Your password will not be encrypted before it is saved to the file. Users who view the source contents of the file will be able to see the account
user name and password".

I am trying to build a case for using NT accounts rather than SQL internal accounts. What are the steps required to access the locally saved
password?

Thanks,
Chris


Nov 13 '05 #3
Terri,
It is as recoverable as any Windows Domain account/password. This is the
advantage/curse of it. When a user calls support complaining that their
password doesn't work you can reset the password to whatever in User Manager
(Windows NT) or Win2K Server's Active Directory Users & Computers. Why,
unless you want to be able to hack accounts, would you want to store the
account name & password in clear text on the local machine? Seems like and
invitation to a hacker to just steal everything. But . . . through the
Windows API's you can discover the currently logged in account name.
Password is another matter. And, this may not relate, but some services in
Windows 2000 can authenticate using Digest Authentication and that method
does ship the password across the network as clear text so it should be
possible to capture it. Last, but not least, if you defy my advice and
store the password in the connection string it's right there in that string.
Peeling it out is a simple matter of doing some fairly straightforward
string manipulation code.
But . . . I'd rather irritate my users and have better security.
"Terri" <te***@cybernets.com> wrote in message
news:cj**********@reader2.nmix.net...
Thanks Alan. I'd like to move to a Windows integrated security model
because
of its security advantages, but unless I can demonstrate that the password
is recoverable on the local workstation I'm not going to get very far with
the people who can make the decision to move to Windows integrated
security.
Thanks
"Alan Webb" <kn*****@hotmail.com> wrote in message
news:gY********************@comcast.com...
Terri,
Don't save the password in the connection string. Two, Microsoft with
SQL
Server 2000 says that the recommended password scheme is Windows 2000
Integrated. But I am a stubborn, paranoid old cuss and don't like the

fact
that a user can get to my databases by signing on to my Windows domain.

So
I've got my SQL Server instance set up so it uses both SQL Server logins
independant of Windows. It's two account names/passwords for my users
but
then it's also harder to hack my databases so I leave it like that. But
.

.
. when you set up an instance of SQL Server one of the choices you make
is
the authentication method. At the moment I am allowing Windows
Integrated
authenticated but then I am only one guy and three computers. If I was
getting paid by a client I'd probably set up my instance to require a
seperate login.

"Terri" <te***@cybernets.com> wrote in message
news:cj**********@reader2.nmix.net...
> When I make change in the Connection screen in an adp I get the message
> "Your password will not be encrypted before it is saved to the file. Users > who view the source contents of the file will be able to see the
> account
> user name and password".
>
> I am trying to build a case for using NT accounts rather than SQL internal > accounts. What are the steps required to access the locally saved
> password?
>
> Thanks,
> Chris
>
>
>



Nov 13 '05 #4

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

4
by: rrober07 | last post by:
Hello, My Setup is I have a Web Server machine(Devweb01), Database SQL Machine(Devsql01), a Client Machine(local machine) I have configured the SQL machine as follows: 1) Added local Aspnet...
4
by: Greg P | last post by:
I know this is a long post, please bear with me. I have been working on this all weekend to no avail although I have done a good amount of research (see most pertinent links that I've looked at...
7
by: Greg P | last post by:
I know this is a long post, please bear with me. I have been working on this all weekend to no avail although I have done a good amount of research (see most pertinent links that I've looked at...
9
by: craig.overton | last post by:
All, I am currently developing an FTP class in VB.NET. It's kid tested, mother approved when trying to access an FTP Server on a Windows box meaning I can connect, run commands, upload and...
2
by: Connie | last post by:
We have a blob in one table that is storing pdf files. I need to write a select query that will grab that column and write those *.pdf files out to a location on my hard drive. Does anyone know...
3
by: Larry Bertolini | last post by:
Experiencing a little weirdness with SQL Server Management Studio... Have created a login, that has fixed server role "securityadmin". The login can create/drop logins, add/remove them as users...
11
by: Anil Gupte | last post by:
I am getting the following error: ********* Login failed for user 'AUM\ASPNET'. Description: An unhandled exception occurred during the execution of the current web request. Please review the...
0
by: Jean | last post by:
Hi, I have a question about logins and sql server express and an ASP.NET aplication. I put this question in sql server newsgroup, but without real answer sofar. I created a login 'Network...
8
by: =?Utf-8?B?U2hlcndvb2Q=?= | last post by:
Greetings, I am attempting to use the following code to establish a connection to a SQL Server database. However, when I execute the code, I receive the following error: "Login failed for...
0
by: daokfella | last post by:
I have a Login.aspx page that takes care of all my login procedures (validation, lockouts, password change requirements, password retrieval, etc.) It works like a charm. However, now I'd like a...
0
by: DolphinDB | last post by:
Tired of spending countless mintues downsampling your data? Look no further! In this article, you’ll learn how to efficiently downsample 6.48 billion high-frequency records to 61 million...
0
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 6 Mar 2024 starting at 18:00 UK time (6PM UTC) and finishing at about 19:15 (7.15PM). In this month's session, we are pleased to welcome back...
1
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 6 Mar 2024 starting at 18:00 UK time (6PM UTC) and finishing at about 19:15 (7.15PM). In this month's session, we are pleased to welcome back...
0
by: Vimpel783 | last post by:
Hello! Guys, I found this code on the Internet, but I need to modify it a little. It works well, the problem is this: Data is sent from only one cell, in this case B5, but it is necessary that data...
0
by: jfyes | last post by:
As a hardware engineer, after seeing that CEIWEI recently released a new tool for Modbus RTU Over TCP/UDP filtering and monitoring, I actively went to its official website to take a look. It turned...
1
by: CloudSolutions | last post by:
Introduction: For many beginners and individual users, requiring a credit card and email registration may pose a barrier when starting to use cloud servers. However, some cloud server providers now...
1
by: Shællîpôpï 09 | last post by:
If u are using a keypad phone, how do u turn on JavaScript, to access features like WhatsApp, Facebook, Instagram....
0
by: af34tf | last post by:
Hi Guys, I have a domain whose name is BytesLimited.com, and I want to sell it. Does anyone know about platforms that allow me to list my domain in auction for free. Thank you
0
by: Faith0G | last post by:
I am starting a new it consulting business and it's been a while since I setup a new website. Is wordpress still the best web based software for hosting a 5 page website? The webpages will be...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.