Author: way0utwest

  • SQL Authentication – Forcing Password Changes

    When you create a SQL Server login (with SQL authentication), you have the option of enforcing password policies from Windows (in SQL Server 2005 and above).

    chagepwd3

    The recommendation is that you check all three and force strong passwords. You also force a password change so the person has a private password not known by the administrator.

    If you go back into this account later, and look at the boxes, only 2 are available to be checked. The “User must change password at next login” is grated out.

    chagepwd1

    In order to access this box and force a password change, you need to change the password. The reason is that if the account is compromised, the hacker should not be the one to set a new password. The security model assumes the administrator can contact the legitimate owner offline and give them the new password.

    Start typing in the password box, and you can check the box:

    chagepwd2

    Of course you need to set a password that conforms to the policies, and it needs to match the confirm edit box Winking smile

  • Closing Out Replies

    This editorial was originally published on Oct 17, 2006. It is being republished as Steve is at SQLBits 9 today.

    I’ve been posting on the Internet for nearly 17 years, from back in the days of Usenet, GOPHER, ARCHIE and FTP when everything was text. I’ve asked questions and answered them on various topics and as the World Wide Web grew, I grew with it, moving to BrainBench and various other sites where I could gett and provide answers. Recently some one sent me this definition for Warnock’s Dilemma, which was timely considering the today’s article on posting manners, which I received about the same time. I thought it was interesting wanted to bring it to people’s attention.

    Early on when I’d post a question, I got an answer, but then I wondered if it was good information. I could usually test it myself, but since I wasn’t sure of how to solve it on my own (hence the post), I wondered if there was a better way to solve it. Ideally I’d get 2-3 responses, maybe even some improving or commenting on others, to help me sort things out.

    If I didn’t get a response, then I wondered if I hadn’t phrased things correctly, or no one else knew, or even that no one bothered to read my post. All of these are valid interpretations and the new definition from Wikipedia pointing out that a lack of response doesn’t necessarily mean anything. There are 5 possible interpretations of this.

    When we started SQLServerCentral.com, our goal was to answer every single post. The three of us (and three others at the time) would research questions and make it a point to answer in some way, some type of post. As we grew, we encountered areas, such as MDX, where none of us had any expertise and couldn’t even understand the research sometimes, much less the question. To facilitate getting responses, you have probably noticed that we add an automatic post to some threads if they haven’t seen a response in a day or two. This is to bring them back to the top of the list and hopefully someone else’s attention.

    The other thing we debated on with answered posts was whether one answer was sufficient. Often one of us would come on a thread that someone else had answered and we liked the solution, but there was no closing “thanks” or “that worked”. So we decided that adding another post that agrees with the solution, a “me too” post, was a good idea. That way we hoped that we’d build some confidence in the solutions we believed in and give the newbies out there a reason to follow the advice.

    I’m really not sure what the best way to handle posts on the Internet. We’ve been asked to allow people to “rate” solutions as well as “close” threads. We’ve resisted because we see various issues with all of those solutions, just as with the thread within a thread capabilities of many forums. We’ve opted for a simpler solution that we think works well and we hope you agree.

  • The Two Day Adjustment

    I made it to Cambridge and actually feel OK. I wonder how I’ll feel tomorrow, but the two day adjustment worked well. Tuesday I woke up at 5:30, and around 4:30 Wednesday before leaving for London. I flew late in the day, a 3:00 flight to Calgary, easily cleared customs and got to my plane in 30 minutes, then an hour delay while a bathroom was being fixed on the plane. Is it me or does it seem the bathrooms regularly have problems on airplanes?

    I left around 7:30 from Calgary, flying overnight and arrived around 10:30am in London. Not fresh, but fresher than I normally am on the arrival.

  • RTO in Disaster Recovery

    When you have a disaster, the time that you have to restore service is usually referred to as the RTO time. This stands for the Recovery Time Objective and it can is defined like this in Wikipedia:

    The Recovery Time Objective (RTO) is the duration of time and a service level within which a business process must be restored after a disaster (or disruption) in order to avoid unacceptable consequences associated with a break in business continuity.

    That’s a great definition, covering the term with a great set of large, geeky words. However I came up with a simpler one that conveys the same information:

    The time it takes for you to get things running to the point where someone can use them after someone notices that they aren’t.

    You can also view the RTO as the downtime or uptime level of your system. I prefer looking at the RTO as the intervals between uptime, since I think that’s a glass half full view.

    That’s the basic definition and it’s important that you determine what the RTO is for your systems in order to begin planning for the resources that you devote to disaster recovery preparation.

    This post is based on the information in my Preparation for Disaster talk.