Add domain user?

Hi,
By default, when add a domain user in the Domain Controller, is it this new
user can access the sql data?
public role only? Thanks...By default, a new AD user will have no access to a specific SQL Server
unless they are added to a windows group that has access to SQL Server or
their domain account is explicitly added as a login.
HTH
Jasper Smith (SQL Server MVP)
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"js" <js@.someone@.hotmail.com> wrote in message
news:uB%23HnU3MEHA.3712@.TK2MSFTNGP10.phx.gbl...
> Hi,
> By default, when add a domain user in the Domain Controller, is it this
new
> user can access the sql data?
> public role only? Thanks...
>|||Thanks Jasper.
Another question about this one: if a particular role of which the user is a
member has been denied a specific object permission (such as SELECT), the
user is unable to exercise that permission. The most restrictive permission
(DENY) takes precedence.
What will happen in this case: MYDN\Test is belonging to local administrator
group and System Admin Server Role. And I set "db_denydatawriter" to this
user in Northwind database. Can this user exec the "Updte ." statement in
Northwind's table?
Please advice...
"Jasper Smith" <jasper_smith9@.hotmail.com> wrote in message
news:OSzDVD5MEHA.2592@.tk2msftngp13.phx.gbl...
> By default, a new AD user will have no access to a specific SQL Server
> unless they are added to a windows group that has access to SQL Server or
> their domain account is explicitly added as a login.
> --
> HTH
> Jasper Smith (SQL Server MVP)
> I support PASS - the definitive, global
> community for SQL Server professionals -
> http://www.sqlpass.org
>
> "js" <js@.someone@.hotmail.com> wrote in message
> news:uB%23HnU3MEHA.3712@.TK2MSFTNGP10.phx.gbl...
> new
>|||SA will overrule. The user will be SA.
Jeff Duncan
MCDBA, MCSE+I
"js" <js@.someone@.hotmail.com> wrote in message
news:edWLIh5MEHA.1644@.TK2MSFTNGP09.phx.gbl...
> Thanks Jasper.
> Another question about this one: if a particular role of which the user is
> a
> member has been denied a specific object permission (such as SELECT), the
> user is unable to exercise that permission. The most restrictive
> permission
> (DENY) takes precedence.
> What will happen in this case: MYDN\Test is belonging to local
> administrator
> group and System Admin Server Role. And I set "db_denydatawriter" to this
> user in Northwind database. Can this user exec the "Updte ." statement in
> Northwind's table?
>
> Please advice...
>
> "Jasper Smith" <jasper_smith9@.hotmail.com> wrote in message
> news:OSzDVD5MEHA.2592@.tk2msftngp13.phx.gbl...
>|||Thanks Jeff.
How to assign denywrite to MYDN\Test have without by removing it from local
administrator?
If I take out the db_owner from BUILTIN\Administrators will cause any
problem'
"Jeff Duncan" <jduncan@.gtefcu.org> wrote in message
news:eq5wXr5MEHA.3208@.TK2MSFTNGP10.phx.gbl...
> SA will overrule. The user will be SA.
> --
> Jeff Duncan
> MCDBA, MCSE+I
> "js" <js@.someone@.hotmail.com> wrote in message
> news:edWLIh5MEHA.1644@.TK2MSFTNGP09.phx.gbl...
is[vbcol=seagreen]
the[vbcol=seagreen]
this[vbcol=seagreen]
in[vbcol=seagreen]
or[vbcol=seagreen]
>|||Go through it first with a fine tooth comb. Make sure the ID that is
running SQL has access by itself and not in a group. Make sure that the
proper Local Admins have direct access accounts and then remove it. Make
yourself a standard login first just for safe keeping if you are in mixed
mode. You should be fine.
Jeff Duncan
MCDBA, MCSE+I
"js" <js@.someone@.hotmail.com> wrote in message
news:O86FNw5MEHA.3472@.TK2MSFTNGP10.phx.gbl...
> Thanks Jeff.
> How to assign denywrite to MYDN\Test have without by removing it from
> local
> administrator?
> If I take out the db_owner from BUILTIN\Administrators will cause any
> problem'
>
>
> "Jeff Duncan" <jduncan@.gtefcu.org> wrote in message
> news:eq5wXr5MEHA.3208@.TK2MSFTNGP10.phx.gbl...
> is
> the
> this
> in
> or
>

add domain login from management studio

We have a SQL Server 2005 SP2 server that also functions as a
secondary domain controller in active directory. Everything works
extremely well except for 1 bug that was found today. Currently
windows authentication is the only method. When creating a new sql
login either physically at the server or through a remote desktop
connection the user is found in the domain and works just fine.
However when trying to do the same process using management studio
from a desktop connecting to the sql instance as soon as you try to
find the user in the domain you get this error: "The program cannot
open the required dialog box because it cannot determine whether the
computer name "COMPNAME" is joined to a domain."
I have sysadmin privileges on the sql server and if I use my login
name on the server physically I am able to create logins.
Any help would be greatly appreciated.
Thanks
MattI've previously posted a bug to connect.microsoft.com about this. Please go
there
(https://connect.microsoft.com/SQLSe...=126
183) and let them know of your problem.
--
Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration /
Microsoft Office SharePoint Server 2007: Configuration)
MCITP (dbadmin, dbdev)
"Matt Ziegler" wrote:

> We have a SQL Server 2005 SP2 server that also functions as a
> secondary domain controller in active directory. Everything works
> extremely well except for 1 bug that was found today. Currently
> windows authentication is the only method. When creating a new sql
> login either physically at the server or through a remote desktop
> connection the user is found in the domain and works just fine.
> However when trying to do the same process using management studio
> from a desktop connecting to the sql instance as soon as you try to
> find the user in the domain you get this error: "The program cannot
> open the required dialog box because it cannot determine whether the
> computer name "COMPNAME" is joined to a domain."
> I have sysadmin privileges on the sql server and if I use my login
> name on the server physically I am able to create logins.
> Any help would be greatly appreciated.
> Thanks
> Matt
>|||The problem that you are having is that when the SQL GUI opens the dialog to
select a user, it defaults to the local machine. Because the machine is
running as a domain controller it has no local accounts, and no local accoun
t
database.
Please go to connect.microsoft.com
(https://connect.microsoft.com/SQLSe...=126
183) and post additional information reguarding the issue.
--
Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration /
Microsoft Office SharePoint Server 2007: Configuration)
MCITP (dbadmin, dbdev)
"Matt Ziegler" wrote:

> We have a SQL Server 2005 SP2 server that also functions as a
> secondary domain controller in active directory. Everything works
> extremely well except for 1 bug that was found today. Currently
> windows authentication is the only method. When creating a new sql
> login either physically at the server or through a remote desktop
> connection the user is found in the domain and works just fine.
> However when trying to do the same process using management studio
> from a desktop connecting to the sql instance as soon as you try to
> find the user in the domain you get this error: "The program cannot
> open the required dialog box because it cannot determine whether the
> computer name "COMPNAME" is joined to a domain."
> I have sysadmin privileges on the sql server and if I use my login
> name on the server physically I am able to create logins.
> Any help would be greatly appreciated.
> Thanks
> Matt
>