As part of a project at one of my customers I was asked to create an automatic installation that will be a secure installation and will use an Alias, disable unnecessary protocols and use a fix port number instead of dynamic.

In my last post I shared with you all a Power Shell script that helped us to create SQL Alias automatically as part of an automatic installation.

This time I'd like to share how this can be done as a part of securing a SQL server and disable unnecessary protocols like Named Pipe, VIA, Shared Memory and setting the port number to a fixed port.

First part the property declaration, in this part we will choose the instance name, port number, connection string and which protocol to disable.

Second Part SMO declaration and the manage SMO object

Third part is the protocol reference

Forth part is the port part where we are fixing the port

-----------------

# propertyies declarations

$computerName="."

$instance="(local)"

$tcpPort='1434'

$ProtocolUri="ManagedComputer[@Name='$env:computername']/ServerInstance[@Name='MSSQLSERVER']/ServerProtocol"

$tcpEnabled=$true

$npEnabled=$false

$smEnabled=$true

# load the sqlsmo assemblies

# $null = suppress output of assembly loading

$null=[reflection.assembly]::LoadWithPartialName('Microsoft.SqlServer.Smo')

$null=[reflection.assembly]::LoadWithPartialName('Microsoft.SqlServer.SQLWMIManagement')

# create a managed computer smo object

$ManagedComputer=New-ObjectMicrosoft.SqlServer.Management.Smo.WMI.ManagedComputer$computerName

# get refernce to server protocols

$tcp=$ManagedComputer.GetSmoObject("$ProtocolUri[@Name='Tcp']")

$np=$ManagedComputer.GetSmoObject("$ProtocolUri[@Name='Np']")

$sm=$ManagedComputer.GetSmoObject("$ProtocolUri[@Name='Sm']")

# enable or disbale protocol

$tcp.IsEnabled=$tcpEnabled

$tcp.Alter()

$np.IsEnabled=$npEnabled

$np.Alter()

$sm.IsEnabled=$smEnabled

$sm.Alter()

# determine if the instance is default or named

$smoTcp=if('.','(local)'-contains$instance) 

{

# Default database instance

$smoComputer.ServerInstances['MSSQLSERVER'].ServerProtocols['Tcp']

} 

else

{ 

# Named database instance

$smoComputer.ServerInstances[$instance].ServerProtocols['Tcp']

}

# assign new port number to tcp protocol $tcpPort is the instance port declared at the top of this script

$smoTcp.IPAddresses['IPAll'].IPAddressProperties['TcpPort'].Value =$tcpPort

$smoTcp.Alter()

We can perform lots of tweaks and tricks on SQL Server, using the Power Shell script. Use it if you need to secure servers.

I have been asked by one of my customers to write down a PowerShell script to add an SQL Alias as part of an automatic installation.

The Alias is stored in the registry at this path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo

The alias is configured via the configuration manager.

An alias is a name that can be used instead of a connection.

It holds inside some elements of the connection string and can be used from each and every client application. One of its advantages is that it contains all the connection details - protocol, ports and named pipes. It even allows you to redirect a connection to a remote server.

Here is the script:

## Setting the Alias name, Server name and setting the port number

## Adding an extension to the alias name _ALDB Customer Request 

$ServerName = Get-Content Env:Computername

$AliasName = $ServerName+"_ALDB" 

$SN

$AliasName

$PortNum = 1111

## The Aliase is stord in the registry here i'm seting the 

## REG path for the Alias 32 & 64

$Bit32 = "HKLM:\SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo"

$bit64 = "HKLM:\SOFTWARE\Wow6432Node\Microsoft\MSSQLServer\Client\ConnectTo"

## chect if the ConnectTo SubFolder 

## exist in the registry if not it will create it.

If((Test-Path -Path $Bit32)-ne $true)

    {$writable = $true

        $key = (get-item HKLM:\).OpenSubKey("SOFTWARE\Microsoft\MSSQLServer\Client", $writable).CreateSubKey("ConnectTo")

    }

    If((Test-Path -Path $Bit64)-ne $true)

    {        $key = (get-item HKLM:\).OpenSubKey("SOFTWARE\Wow6432Node\Microsoft\MSSQLServer\Client", $writable).CreateSubKey("ConnectTo")

    }

## Create the TCPAlias

$TCPAliasName="DBMSSCON,"+$ServerName+","+$PortNum

New-ItemProperty -Path $Bit32 -Name $AliasName -PropertyType string -Value $TCPAliasName

New-ItemProperty -Path $Bit64 -Name $AliasName -PropertyType string -Value $TCPAliasName 

I was often asked this question:

I'm installing my SQL Server. What should I use as the service account?

There are a few options (Local Account, Service Network, domain User)

What is the best and suitable account for the service?

I will try to answer that on this blog post.

It is very important for System Admins (SA) to make sure that SQL Server is highly secured and is not exposed to users or/and application that don’t need access to the SQL Server.

Configuring the permissions and security settings for SQL Server users and logins is one way to do it, but it is also very important to select the correct service account to run SQL Server services.

Domain Account

Domain user account is the recommended account for SQL Server services that interact with other servers on the network. Another reason to use a Domain User Account is that the account is controlled by Windows active directory therefore, domain level policy on accounts are applied to the service account.

Applying permission to the Domain user account that is running an SQL service are detailed in this link. it is highly recommended to read and know all the needed permissions.

https://msdn.microsoft.com/en-us/library/ms143504.aspx

Network Service Account

NET AUTHORITY\NETWORK SERVICE

Local User Account

Local System Account

Try to use the Domain user account wherever is possible for the SQL services (SQL DB Engine, SQL Agent, SSIS, SSRS, SSAS). Use the link above to configure the correct user privileges for the SQL Service.

Parameters like fill factor (%) or max degree of parallelism. Does this parameter exist in the short list or do I need the show advance option?

So how do we know if the fill factor (%) require a service restart?

Well, like everything in SQL we have a SYS table sys.configuration; that will show us if the parameter is dynamic and if the parameter is an advance setting.

Running a query on the sys.configuration will show us the parameters:

   1: Select * From Sys.configurations

We can spot the fill factor on this screenshot.

We can see that in order to modify this parameter, it will require a service restart and we can also see that the parameter is hidden, so we should enable the "Show advanced option"

In this table we have the description of the sys.configuration columns.

That is a very useful table and can be used every time that we are required to change the configuration of the instance

First time I have encountered this tool was around 2004 when I had to load a big mass of data (IIS Log) into a database.

A month ago I was asked by a customer, how can is it possible to read and load into SQL Server flat files / application files. I recommended using the log parser and I was surprised to see that he was not aware of its existence. a fast survey among my customers reviled that there is a rather large group of DBAs that are not aware of this tool.

Log Parser is a command line tool that allows the user to use SQL in order to query log files.

This is how it works:

The logparser command has three parts: INPUT, DATA, OUTPUT.

Input – will be the part that supports the file format such as IIS LOG, Windows event logs, CSV, XML, TSV and other file formats.

Data – the data is the engine that make it possible to run SQL queries on the input file, much like a database engine.

Output – this part supports many types of outputs, you can format the output table into plain text files, SQL databases and XML.

Opening the logparser starts with a CMD command.

Executing a command with log parser basic command on an IIS log file with a group by:

logparser “SELECT * FROM C:\1\iislog.log”

This query will return the file output in a table format:

We can also do some manipulation on the file just like T-SQL command.

This query will show the Requests per day.

logparser"SELECT TO_STRING(TO_LOCALTIME(TO_TIMESTAMP(date, time)), 'yyyy-MM-dd') AS [Day], COUNT(*) AS [Requests] FROM u_ex*.log GROUP BY [Day] ORDER BY [Day]"

And now for the SQL fun part, we can upload the log/logs output directly to a database table and keep it for inquiries and history.

logparser"SELECT * INTO EmailLogs FROM C:\1\iislog.log"-i:W3C-o:SQL-oConnString"Server=SQL2012; Database=IIS_LOGS; Trusted_Connection=True;" -oConnString:"Driver={SQL Server};Server=MyServer;db=pubs;uid=sa;pwd=MyPassword"

The -i:W3C parameter for the input format (IIS file)

The -o:SQL parameter for the output format (to SQL)

The -oConnString parameter is the connection string to the database

You can download and enjoy it.

 Don’t forget to try the In memory DB

https://technet.microsoft.com/en-US/evalcenter/dn205290.aspx

In addition to tables, views and procedures we had indexed view including Full Text Index base on it.

Currently, we cannot specify on the management studio what we’d like to replicated with the indexed view, so the only way is to do it with a script.

We need to pay attention to the following parameters: @type and @schema_option.

There are a few options, I’ve used
@type=N'indexed view schema only' and @schema_option=0x0000000009000051

@type is quite simple, I wanted to replicate only the schema.

The @schema_option is a bitmask and in my case it contains the following bits:

· 0x01 - Generates the object creation script

· 0x10 - Generates a corresponding clustered index

· 0x40 - Generates corresponding nonclustered indexes

· 0x1000000 - Full-text index

· 0x8000000 - Create any schemas not already present on the subscriber

The command looks like this

use [PublishedDB]

exec sp_addarticle
@publication=N'DB_Publication',
@article=N'v_View',
@source_owner=N'dbo',
@source_object=N'v_View',
@type=N'indexed view schema only',
@description=null,
@creation_script=null,
@pre_creation_cmd=N'drop',
@schema_option= 0x0000000009000051,
@destination_table=N'v_View',
@destination_owner=N'dbo'
GO

conclusions

· indexed view can be replicated in a few ways – schema only or as table

· article replication has lots of options, you can read about them here

He had a scenario in which he needed to update a table and keep the old data.

In the past, developers and DBAs have used custom code to track changes, stored procedures, triggers and CDC.

Starting with version 2005, SQL Server supports a simple method for auditing DML changes; the OUTPUT clause.

The OUTPUT command, collects the audited data into a table or a table variable. It enables us to track DML info of DELETE, UPDATE, INSERT & MERGE command.

The most common usage of the output command is in archiving processes. If we want to delete info from a business data table and archive the deleted data.

An important thing to know about OUTPUT:

When UPDATE, INSERT, or DELETE statements are cached in an OUTPUT clause, it will return rows to the client even if the statement encounters errors and is rolled back.

The result should not be used if any error occurs.

Example:

In this example we have an Employee salary table that we want to trace the salary changes.

In this scenario, the HR department of a big corporation would like to update all hourly tariff of the employees by 15% and keep the changes in an audit table for further action or for a fast rollback after testing the impact of the raise.

 1: Create Database Output_Syntax

 2: go

 3: use Output_Syntax

 4: go

 5:  

 6: Create Table Emp_Hour_Rate(

 7:     Emp_ID        intidentity,

 8:     EmpFName    varchar(15),

 9:     Emp_Sal_H    int,

 10:     Emp_hour    int,

 11:     Emp_Sal    AS ([Emp_Sal_H]*[Emp_hour]),

 12:     Mod_Date    Datetime)

 13:  

 14: Insert into Emp_Hour_RateValues ('David',120, 180,getdate()-1)

 15: Insert into Emp_Hour_RateValues ('Tomer',120, 165,getdate()-7)

 16: Insert into Emp_Hour_RateValues ('Daniel',120,192,getdate()-21)

 17: Insert into Emp_Hour_RateValues ('Yoel',120,160,getdate()-32)

 18: Insert into Emp_Hour_RateValues ('Eran',120,172,getdate()-32)

 19: Insert into Emp_Hour_RateValues ('Israel',120,147,getdate()-12)

 20:  

 21: Create table Audit_Sal(

 22: EmpID         int NOTNULL,

 23: EmpFName    varchar(15),

 24: OldSalery     int,

 25: NewSalery     int,

 26: ModifiedDa     tedatetime);

 27:  

 28:  

 29:  

 30:  

 31: -- updateing a raise of 15% for 

 32: UPDATE Emp_Hour_Rate

 33: SET        Emp_Sal_H=Emp_Sal_H*1.15,

 34:         Mod_Date=GETDATE()

 35: OUTPUT inserted.Emp_ID,

 36:         inserted.EmpFName,

 37: deleted.Emp_Sal_H,

 38: inserted.Emp_Sal_H,

 39: inserted.Mod_Date

 40: INTO Audit_Sal;

 41:  

 42: --Display the result set of the table variable.

 43:  

 44:  

 45: Select    EmpID,EmpFName,OldSalery,NewSalery,ModifiedDate

 46: FROM    Audit_Sal

 47:  

 48: Select * from Emp_Hour_Rate

 49:  

 50: Usemaster

 51: go

 52:  

 53: drop database Output_Syntax

 54: go

1) Remove all built-in admin account from SQL Server logins.

2) Remove all users from SYSADMIN server role except SA (assuming you are 
    working in a mixed mode environment).

3) Change the SA account password to something extremely complex.

4) For SQL daily operations, you use a domain user account with DBO permissions on 
     user databases with no SYSADMIN privileges on the system.

5) You haven't saved the SA password.

Since the SA password is complicated, you are using your domain account and in time you have forgotten the SA password.

Well, you are the only one on the team that knows the password but you don't remember it.

The first option is to write the resignation letter.

The recommended option is to continue reading.

Here are the Steps to take back control of your SQL 2012 SA:

Start the damaged instance of SQL 2012 in single user mode from command prompt with Administrator rights and type:
SQLServr.Exe –m (or SQLServr.exe –f).
The SQLServr.exe will be located in the Binn folder, make shure that the Binn path exist in the environmental parameters:
C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Binn>.

Now that SQL Server 2012 was started in single user mode, we open up another CMD (with elevated right) window and f
rom the command prompt connect to SQL Server 2012 instance with the SQLCMD command:

SQLCMD –S <My_Machin\My_Instance>

For Example:
SQLCMD –S ServSQL2012\Inst2012

When connecting in –S mode you are to the SQL in an windows authentication mode and with the user admin right.
Once connected to the SQL Instance we can start and create a new login "NEW_SA"
The command to create the new login:

1> CREATE LOGIN <Login_Name> with PASSWORD=’<Password>’
2> GO

Once the login was created we will add it to the SYSADMIN role.

The command to add a login to the SYSADMIN role:

1> SP_ADDSRVROLEMEMBER '<Login_Name>','SYSADMIN'
2> GO

Now that the new LOGIN was created and that the added to the SYSADMIN role we can log with it to the
instance and change the SA password to a new one.

Each time we are approach an upgrade, we try to minimize the risk.
These built-in tools can assist us:

• SQL Server Upgrade Advisor
• SQL Server Profiler deprecation events
• SQL Server Distributed Replay

Once we use any of these simple tools, we minimize the risk of a failing an upgrade. It is also important to mention that it is also required to perform full regression, functionality and performance tests as well.

Here are some of most relevant deprecated and discontinued features.

Deprecated

• SET ROWCOUNT
• SQL Server Database Mirroring
• Specifying the SQLOLEDB provider for linked servers.
• Not ending Transact-SQL statements with a semicolon.
• Specifying table hints without using the WITH keyword.
• Specifying NOLOCK or READUNCOMMITTED in the FROM clause of an UPDATE or DELETE statement.
• SQL Trace stored procedures, functions, and catalog views.
• sp_dbcmptlevel
• sp_attach_db & sp_attach_single_file_db
• c2 audit option
• default trace enabled option
• sp_addlogin / sp_droplogin / sp_adduser / sp_dropuser / sp_grantdbaccess / sp_revokedbaccess / sp_denylogin
  

Discontinued

• fastfirstrow option
• compatibility level 80
• sp_dboption
• AWE

For more details, please refer to this detailed document (including 4 topics) -
https://msdn.microsoft.com/en-us/library/ms143532.aspx