Chapter 11 -- Logins, User Accounts, and User Roles

[Previous] [Next]

Chapter 11

About This Chapter

Before a user can access data in a Microsoft SQL Server database, three levels of access are verified:

• The user's access to SQL Server is authenticated against a login account. This authentication can be performed by Microsoft Windows NT or by SQL Server.
• The user's access to a particular database is determined by the login account's defined database user account or role membership.
• The user's access to objects or tasks within a database is determined by permissions that have been granted to the user's account or role.

In this chapter, you will learn how to create and manage logins, users, and roles. You will also learn about the important difference between logins that are authenticated by Windows NT and those that are authenticated by SQL Server.

Before You Begin

To complete the lessons in this chapter, you must have

• Experience using the SQL Server Enterprise Manager and SQL Server Query Analyzer.
• Knowledge of Windows NT Server user accounts, groups, Windows NT User Manager for Domains, and .CMD (or .BAT) files. This chapter refers to Windows NT User Manager for Domains, although your Windows NT_based computer may display Windows NT User Manager. Both utilities work the same for the purposes of this chapter.

You must also have done the following:

• Configured your Windows NT_based computer to allow the group Everyone to log on locally. (You can do this with the User Manager For Domains User Rights option under the Policies menu.) This allows you to log on as various users and test different security configurations in the exercises.
• Installed SQL Server version 7 on your computer. Installation procedures are covered in Chapter 2.

IMPORTANT

---

The exercises in this chapter assume that you are working on a Windows NT Server configured as a domain controller, although you can complete the exercises using SQL Server installed under Windows NT Workstation or on a standalone Windows NT Server. You cannot complete all of the exercises for this chapter on SQL Server installed under Microsoft Windows 95 or Windows 98.

• Created the users and the groups (local groups will suffice for this exercise, but you should create global groups if you are using an Windows NT Server installed as a domain controller) listed in the following table, in your Windows NT domain. You can create these using the Windows NT User Manager for Domains, or you can run the batch file makeusrs.cmd located in the C:\Sqladmin\Exercise\Setup folder installed on your hard disk drive from the Supplemental Course Materials CD-ROM.

Windows NT group	Members	Password
Customer_mgmt	Carl	password
	Cathy	password
Domain Users	Carl	password
	Cathy	password
	Paul	password
	Max	password