Comments on Project 31-A: NEVER use NT Groups to control SQL Server Permissi...

Hi, After hours of investigations, I thing I found...

2012-02-13T04:40:25.147-08:00

Hi,
After hours of investigations, I thing I found the {obtuse} cause : Using NT Security groups in SQL works very well (adding/removing users to group produce a correct behavior in SQL Server)... HOWEVER : User have to logoff/logon again in Windows to make new membership effective (as for NTFS permissions)...

Nobody mentioned this, so I thought I'd point ...

2011-02-04T08:23:20.965-08:00

Nobody mentioned this, so I thought I'd point it out. A user that is removed from a group continues to have that permission until they log out of Windows and back in.

Since it seems that it alleged that it works some ...

2011-02-03T14:38:45.347-08:00

Since it seems that it alleged that it works some times and documented as not working other times I suspect that there is some {obtuse} configuration issue involved between SQL Server and the domain.

If you plan on using groups, you may wish to verify that it actually works (especially when a user is removed from a group that is contained in another group -- the permission cascade problem) and then make a point of re-verifying it periodically -- in case the {obtuse} configuration issue is changed.

140+ servers here with SQL2005\2008 and Windows200...

2010-09-01T17:22:40.791-07:00

140+ servers here with SQL2005\2008 and Windows2000\2003\2008 and using NT groups with no problems at all. I can add and remove users at will from domain groups and access is immediately granted or denied.

SQL 2005 and Windows Server 2003 with users in a s...

2010-03-31T15:33:48.273-07:00

SQL 2005 and Windows Server 2003 with users in a security group. No problem at all.

wow - i agree with Scott - i was also in the proce...

2010-03-15T09:47:44.551-07:00

wow - i agree with Scott - i was also in the process of testing using NT user groups. Thanks for saving me a bunch of time and headaches.

THANK YOU! I was in the process of testing using N...

2010-02-26T09:30:16.900-08:00

THANK YOU! I was in the process of testing using NT user groups as an alternative to maintaining custom database roles or individual login permissions. I turned up this post in an internet search I did while trying to figure out why it wasn't working as expected. Now I know ... Time to go delete those test group IDs from the database.

And here I thought I could hand off some of my work to the Windows network admins. Teach me to be lazy! :)