Press "Enter" to skip to content

Category: Administration

The Power of Group Managed Service Accounts

Published 2026-10-14 by Kevin Feasel

John Sterrett gets rid of a password:

Somewhere in your environment, a SQL Server service account password hasn’t changed in years. Several people know it, and it’s probably in a script or a spreadsheet. I wouldn’t be surprised if someone hasn’t even put it in an AI chat.  Group managed service accounts (gMSAs) remove that problem.

This past weekend, during my Advanced Security Protection talk (online version you can watch) at Days of Data in Pittsburgh, someone asked: “What are the best practices for encrypting passwords in connection strings?” That reminded me I’m overdue to blog about Group Managed Service Accounts, so here we are, because the best way to encrypt them is to not need to encrypt them.

This does get a lot trickier if you’re not on Windows, and it does require Active Directory. But for most environments, gMSAs are an outstanding idea.

Leave a Comment

SQL Server 2017 Has One Year of Support Remaining

Published 2026-10-13 by Kevin Feasel

Brent Ozar provides a reminder:

Even if you can knock out one of these per month on every 2017 & prior instance that you have, you’re still gonna be banging up against the October 12, 2027 deadline.

It’s not like your servers will magically stop working on that date – but if your company’s insurance or compliance rules say you’re not allowed to run out-of-date software, then it might be your butt on the line for not getting onto a supported version. (And if you’re subject to that, and you’re still running on SQL Server 2016, I’d be curious to hear in the comments how your experience went trying to purchase 2016 Extended Security Updates (ESU) from Microsoft.)

Brent has a list, and if you have any 2017 instances kicking, it’d be a good idea to get started on these.

Leave a Comment

Worker Thread Exhaustion and sp_invoke_external_rest_endpoint

Published 2026-10-12 by Kevin Feasel

Louis Tochon runs out of worker threads:

With SQL Server 2025, Microsoft lets the database engine call an AI model by itself. sp_invoke_external_rest_endpoint sends an HTTPS request straight from T-SQL, to Azure OpenAI or to any other REST service, so an embedding or a completion no longer needs application code in between.

But what happens under heavy pressure, when hundreds of sessions make that call at the same moment and the model takes its time to answer? I ran this scenario on SQL Server 2025 and on Azure SQL Database, with the same procedure and the same load script. The two platforms do not react the same way at all.

Click through for three tests, covering SQL Server 2025 with and without Resource Governor, as well as Azure SQL Database.

Leave a Comment

Securing MCP Servers Connected to a Database

Published 2026-10-06 by Kevin Feasel

Dejan Lukic shares some advice:

AI agents don’t ask permission before every query. Instead, they themselves decide which tools to call and chain together. That’s a fundamentally different risk model than traditional access control – and it’s exactly why MCP (Model Context Protocol) servers connected to databases need their own security playbook.

This guide covers the failure modes to watch for: confused deputy, token passthrough, prompt injection, over-scoped credentials, and session hijacking. Then, how to prevent those failure modes – using authentication, authorization, and least-privilege controls.

Treat them like any other often-confused employee. Which, in many environments, means making them sysadmins.

Leave a Comment

Fabric Tenant Settings to Check at Launch

Published 2026-10-01 by Kevin Feasel

Paul Turley continues a series on Microsoft Fabric:

Article 3 covered the headline settings almost every tenant touches first, but the full tenant settings screen runs past 30 categories, from information protection to advanced networking. You won’t master all of it on day one, but knowing what’s there keeps you from being caught flat-footed later. Skim the full list once, even if you’re not ready to configure most of it, just so nothing surprises you when a business unit asks for a capability you didn’t know existed.

Click through for six tips.

Leave a Comment

Users, Licenses, and Guest Access in Microsoft Fabric

Published 2026-09-28 by Kevin Feasel

Paul Turley manages a tenant:

Fabric doesn’t have its own separate licensing screen — you assign every license, Fabric included, from the Microsoft 365 admin center, the same place you’d manage Exchange or Teams. Easy to miss if you came into this world through the Fabric admin portal. Save yourself a search: bookmark the Microsoft 365 admin center alongside the Fabric admin portal, since you’ll need both within your first week.

Click through for some more tips and tricks around user management in Microsoft Fabric.

Leave a Comment

Managing Resources via Azure Cloud Shell

Published 2026-09-25 by Kevin Feasel

Jordan Boich isn’t afraid of the command line:

As a DBA or any data professional, it is becoming more valuable and vital to have a well rounded understanding of your data estate and environment. However, sometimes it can be a bit cumbersome, especially when connecting to Azure resources via PowerShell. You have to fumble with authentication, connection cmdlets and more, which can be a bit discouraging to use at times.

There are some interesting and useful tools to help circumvent that overhead and manage your Azure resources. Azure Cloud Shell is a great quick tool to use if you want to have a lightweight, and easily accessible way to help manage and administer your Azure resources.

Read on to see how you can connect and some of the things you can do with it. You also get your choice of bash versus PowerShell.

Comments closed

Checking archive_mode on pgBackRest

Published 2026-09-25 by Kevin Feasel

Stefan Fercot shares some advice:

A recent question on the community channels described a difficult situation: a standby had been promoted with archive_mode=off, and restarting the new primary was something the team wanted to avoid. Could they enable archiving on a downstream standby and take a pgBackRest backup from there instead?

Their attempt failed with archive_mode must be enabled, even with archive-mode-check=n. Removing the checks from pgBackRest’s source code allowed their proof of concept to succeed, but was that enough to trust the approach?

My recommendation was to return to a supported configuration, either through a restart or a controlled switchover. But I wanted to take a closer look and see whether archive-mode-check=n might allow the standby-based approach.

Read on for that answer, as well as some of the issues you might run into.

Comments closed

Storage Engines in MySQL versus MariaDB

Published 2026-09-24 by Kevin Feasel

Lukas Vileikis compares storage engines:

The big difference between MySQL and MariaDB largely revolves around database storage engines and anything related to them. In this article, I’ll walk you through some of the key differences between storage engines in MySQL and MariaDB, explain which is best for your use case, and detail how to change your database’s storage engine if necessary. 

Most of you will do just fine with InnoDB on either of the database management systems – however, those of you who are building something more wild and exotic might want to look specifically into MariaDB. 

Read on to learn more.

Comments closed