A Fine Slice Of SQL Server
Our requirement is to record unsuccessful login attempts i.e. failed logins for security and compliance reasons. The database estate includes SQL Servers, Azure SQL Databases, and Azure SQL Managed Instances. How can I configure auditing for failed logins for each of these database environments?
Read on for the answer in SQL Server, Azure SQL Database, and Azure SQL Managed Instance.
Leave a CommentErik Darling has a video for us:
Erik Darling here with Darling Data and in today’s video we are going to talk about why the version store won’t clear if any database has open transactions. I realized that I read it a little bit differently than it looks there because I had to say it is what we’re talking about where this asks a question, right, so the words don’t precisely line up. But don’t blame the robots for that. That looks weird in the transcript. Anyway, it sounded weird in my head as I was trying to phrase it because I’m looking at the words and trying to rearrange them. That was tough. I’m not as sharp as I used to be.
It’s okay, Erik; none of us are.
Leave a CommentStephane Haby turns off a feature:
A customer recently asked me to disable FileTable/FileStream on their instance because the databases no longer use it, and to ensure that this is indeed the case.
The aim is to migrate to a new architecture without FileTable/FileStream in a second time.
The tricky bit is that the relevant database is also inside of an Availability Group. Click through for the process.
Leave a CommentJohn Sterrett gets rid of a password:
Somewhere in your environment, a SQL Server service account password hasn’t changed in years. Several people know it, and it’s probably in a script or a spreadsheet. I wouldn’t be surprised if someone hasn’t even put it in an AI chat. Group managed service accounts (gMSAs) remove that problem.
This past weekend, during my Advanced Security Protection talk (online version you can watch) at Days of Data in Pittsburgh, someone asked: “What are the best practices for encrypting passwords in connection strings?” That reminded me I’m overdue to blog about Group Managed Service Accounts, so here we are, because the best way to encrypt them is to not need to encrypt them.
This does get a lot trickier if you’re not on Windows, and it does require Active Directory. But for most environments, gMSAs are an outstanding idea.
Leave a CommentBrent Ozar provides a reminder:
Even if you can knock out one of these per month on every 2017 & prior instance that you have, you’re still gonna be banging up against the October 12, 2027 deadline.
It’s not like your servers will magically stop working on that date – but if your company’s insurance or compliance rules say you’re not allowed to run out-of-date software, then it might be your butt on the line for not getting onto a supported version. (And if you’re subject to that, and you’re still running on SQL Server 2016, I’d be curious to hear in the comments how your experience went trying to purchase 2016 Extended Security Updates (ESU) from Microsoft.)
Brent has a list, and if you have any 2017 instances kicking, it’d be a good idea to get started on these.
Leave a CommentLouis Tochon runs out of worker threads:
With SQL Server 2025, Microsoft lets the database engine call an AI model by itself.
sp_invoke_external_rest_endpointsends an HTTPS request straight from T-SQL, to Azure OpenAI or to any other REST service, so an embedding or a completion no longer needs application code in between.But what happens under heavy pressure, when hundreds of sessions make that call at the same moment and the model takes its time to answer? I ran this scenario on SQL Server 2025 and on Azure SQL Database, with the same procedure and the same load script. The two platforms do not react the same way at all.
Click through for three tests, covering SQL Server 2025 with and without Resource Governor, as well as Azure SQL Database.
Leave a CommentDualcore DBA performs an upgrade:
The upgrade will:
- Install PostgreSQL 18
- Migrate the existing version 15 cluster to version 18
- Use only tools from the standard PostgreSQL repository rather than any Debian-specific tooling (pg_createcluster, pg_lsclusters etc.)
Read on for the steps and the process.
Leave a CommentDejan Lukic shares some advice:
AI agents don’t ask permission before every query. Instead, they themselves decide which tools to call and chain together. That’s a fundamentally different risk model than traditional access control – and it’s exactly why MCP (Model Context Protocol) servers connected to databases need their own security playbook.
This guide covers the failure modes to watch for: confused deputy, token passthrough, prompt injection, over-scoped credentials, and session hijacking. Then, how to prevent those failure modes – using authentication, authorization, and least-privilege controls.
Treat them like any other often-confused employee. Which, in many environments, means making them sysadmins.
Leave a CommentPaul Turley continues a series on Microsoft Fabric:
Article 3 covered the headline settings almost every tenant touches first, but the full tenant settings screen runs past 30 categories, from information protection to advanced networking. You won’t master all of it on day one, but knowing what’s there keeps you from being caught flat-footed later. Skim the full list once, even if you’re not ready to configure most of it, just so nothing surprises you when a business unit asks for a capability you didn’t know existed.
Click through for six tips.
Comments closedFabric doesn’t have its own separate licensing screen — you assign every license, Fabric included, from the Microsoft 365 admin center, the same place you’d manage Exchange or Teams. Easy to miss if you came into this world through the Fabric admin portal. Save yourself a search: bookmark the Microsoft 365 admin center alongside the Fabric admin portal, since you’ll need both within your first week.
Click through for some more tips and tricks around user management in Microsoft Fabric.
Comments closed