Local Security Policy - Restricting Access

[daz_oldham]

Hi everyone

I'm trying to lock my SQL Server Desktop Edition down which is running
on a relatively fresh install of Windows 2003 Server Standard Edition
which is a dedicated server from Fasthosts.

I'd like to create a local security policy that denies access to all
remote addresses other than my fixed IP address at home and work.

However, all attempts to create a policy just result in nothing
actually changing - can anybody suggest an article with step-by-step
idiot proof instructions.

Somebody is trying to log on as SA but they aren't going to get far as
one of the first things I did was disable the user.... but the
constant logon attempts are affecting server performance.

Many thanks

Darren

[Erland Sommarskog]

daz_oldham (Da**************@gmail.com) writes:

I'm trying to lock my SQL Server Desktop Edition down which is running
on a relatively fresh install of Windows 2003 Server Standard Edition
which is a dedicated server from Fasthosts.

I'd like to create a local security policy that denies access to all
remote addresses other than my fixed IP address at home and work.

I may be missing something, but isn't this a firewall-configuration
issue?

If you are using Windows Firewall, add SQL Server if it's not there.
Oh, you were running Express, and I guess then you have a named instance.
It really helps if you tie it to a specific port, and don't have the
the port number assigned dynamically. This you can do from SQL Server
Configuration Manager.

Once you have decided which port to use, add SQL Server to Windows
Firewall under Exception and specify the port (TCP). Then under
Change scope, select Custom list and enter the IP addresses you
need.

--
Erland Sommarskog, SQL Server MVP, es****@sommarskog.se

Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pro...ads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodinf...ons/books.mspx

[daz_oldham]

After all that it was so simple - thanks Erland :)

I've just configured access to port 1433 which seems to have done the
trick.

Many thanks

Darren