{"id":57416,"date":"2021-12-30T11:00:00","date_gmt":"2021-12-30T16:00:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=57416"},"modified":"2024-02-08T11:39:29","modified_gmt":"2024-02-08T16:39:29","slug":"domainless-access-to-ms-sql-server-tutorial","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/domainless-access-to-ms-sql-server-tutorial","title":{"rendered":"Domainless Access to MS SQL Server Tutorial"},"content":{"rendered":"\n
Traditionally, there have been two options to authenticate into Microsoft\u2019s SQL Server: Integrated Windows Authentication (managed by Active Directory) or SQL Server\u2019s built-in authentication scheme. The first requires a domain controller, while the latter sends (encrypted) credentials over the wire when its \u201cForce Encryption\u201d flags are configured. In both cases, there is additional IT management overhead required to get users access to this particular server. <\/p>\n\n\n\n
There\u2019s now a third method: local group access through JumpCloud and Integrated Windows Authentication. It enables remote users to work with SQL Server without passing credentials around the web and<\/em> without the need for users to run their access requests over a VPN and through the domain controller.<\/p>\n\n\n\n This article is a follow-up to a previous example that discusses domainless Windows File Sharing<\/a>. The methods are similar, except in this example IT administrators in smaller organizations gain the additional advantage of enabling DBAs to work with SQL Server without having to stand up a domain controller. The DBA gains access to SQL Server with the same credentials they use to log into their devices and cloud services, with a single managed identity that integrates with fully-supported Windows authentication methods and SQL Server. This is all possible without the introduction of any software other than the JumpCloud agent.<\/p>\n\n\n\n This tutorial outlines the steps involved to create and manage local user groups for SQL Server through the JumpCloud console in addition to outlining how to harden Integrated Windows Authentication (NTLM) for better security. You can also monitor access logs for any suspicious events with Directory Insights<\/a>. JumpCloud accounts are a prerequisite for this workflow.<\/p>\n\n\n\n (After the user was created in JumpCloud)<\/p>\n\n\n\n Open Security > Logins in the SQL Server Management Studio GUI or <your server>\\Databases\\<your database>\\Security\\<\/p>\n\n\n\n You may also consider disabling WLAN for remote users only<\/em>. Disabling this on PCs have use WLAN for their proxy configuration on a LAN could disrupt internet access.<\/p>\n\n\n\n JumpCloud\u2019s Device Trust<\/a> limits which devices may access applications and other resources through SSL\/TLS certificates. It\u2019s fundamental to conditional access<\/a>, which can further secure access to resources via geofencing and other measures such as requiring MFA. These features are included in the JumpCloud platform without additional services required. JumpCloud also provides policies<\/a> to ensure that Windows updates are applied and not delayed, which helps to ensure that any high-priority security patches are delivered to your Windows endpoints.<\/p>\n\n\n\n Monitoring also helps to ensure that your configuration isn\u2019t being misused.<\/p>\n\n\n\n JumpCloud Directory Insights<\/a> provides an audit trail of user logins so unauthorized attempts will be noticed and you\u2019ll be alerted. Directory Insights is a component of the platform and has no additional cost to access.<\/p>\n\n\n\n Don’t take our work for it: test it out. Get started with a\u00a0free 30 Day Trial<\/a>\u00a0of JumpCloud.<\/p>\n\n\n\n<\/figure>\n\n\n\n
Prerequisites<\/h3>\n\n\n\n
\n
\n
Create a Local Group<\/a><\/h3>\n\n\n\n
\nNew-LocalGroup -Name “SQLServerUsers”\n<\/code>\n\n\n\n
<\/figure>\n\n\n\n
Add User to the Local Group:<\/a> <\/h3>\n\n\n\n
\nAdd-LocalGroupMember -Group “SQLServerUsers” -Member “yourname”\n<\/code>\n\n\n\n
<\/figure>\n\n\n\n
Select Users and Groups within SQL Server<\/h2>\n\n\n\n
\n
<\/figure>\n\n\n\n
Hardening NTLM<\/h2>\n\n\n\n
Harden NTLM Using PowerShell<\/a> <\/h3>\n\n\n\n
\nGet-ItemProperty -Path ‘HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\’ -Name ‘LmCompatibilityLevel’\n\nNew-ItemProperty -Path ‘HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\’ -Name ‘LmCompatibilityLevel’ -Value 5 -Force\n<\/code>\n\n\n\n
\nHKLM\\SYSTEM\\CurrentControlSet\\Services\\WinHttpAutoProxySvc\\Start\nREG_DWORD4\n<\/code>\n\n\n\n
Conditional Access<\/h3>\n\n\n\n
Directory Insights<\/h3>\n\n\n\n
Try JumpCloud<\/h2>\n\n\n\n