Microsoft Security Changes and SQL Server

For almost as long as I've been working as a data professional, NTLM has been the security protocol used in Windows. Microsoft added Kerberos over 20 years ago, but NTLM is still a fallback. Like so many things Microsoft has worked on, they loathe breaking backwards compatibility, so NTLM has been available. However, it has issues, like the double hop problem, and there are numerous security issues with the protocol. I tested a security product over 20 years ago that could break NTLM passwords in under an hour. On old Pentium-based computers.

This week Rebecca Lewis posted an article about the upcoming changes in Windows where NTLM is being phased out. She audits various clients and finds many are still using NTLM for SQL Server connections. Her observation is many people aren't aware of this, and I'd concur. There is an informational message that is written to the SQL Server error log, but how many of you are checking the log and acting on this or even understand what it means? How many of you might have developers (or yourself) using named pipes and be unaware? That's an NTLM only connection.

Heck, I've got a friend fighting through SSL connections with SQL Server, which is something I rarely seen. This person will eventually no longer need to "trust server certificate" in every connection string, but I bet many of you are years away from implementing that. That's another change Microsoft wanted implemented, and why modern drivers no only set this to true by default.

Later this year, NTLM v1 will phase out, but that's not likely what most of you use with SQL Server. However, the next major Windows server release will disable NTLM v2, and you won't remember this editorial or the announcement then. What will happen is Windows admins will upgrade systems and you won't be able to connect.

Rebecca gives you some things to check, but since many of you might work in large estates, you'll need time to ensure clients and servers get updated and NTLM isn't the protocol you depend on. Trust me, if Windows or even a client driver upgrade remove this, you are in for a bad day (or week, or weeks) trying to get things working.

I'd also suggest you learn how SQL Server SSL connections work. I don't know that many orgs will require this, but some might as security becomes more automate-able and more CSOs start to ask that we ensure no man-in-the-middle attacks reach our servers.

Steve Jones - SSC Editor

Join the debate, and respond to the editorial on the forums

SQL Prompt’s latest releases focus on stability and quality improvements, particularly around our AI features and SSMS 22 compatibility.

After three decades of working with databases, one thing Steve Jones has seen over and over is this: we don’t treat our development and test environments with the same respect we do our production systems.

Find out about new Skills and the Claude Cowork plugin for generating WordPress sites with AI.

Baolin Li, Lingyi Liu, Binh Tang, Shaojing LiIntroductionPre-training gives Large Language Models (LLMs) broad linguistic ability and general world knowledge, but post-training is the phase that actually aligns them to...

Because even machines need their first job — and...

AI has moved quickly from novelty to normality. Customer service bots, sales assistants, automated support agents, many organisations are now letting AI speak directly to customers under their brand....

OpenAI unveils GPT-5.3-Codex-Spark, a lightweight real-time coding model powered by Cerebras hardware and optimized for ultra-low latency performance. The post OpenAI Debuts GPT-5.3-Codex-Spark, a Near-Instant AI for Real-Time Coding appeared...

Now that SQL Server 2025 has finally been released to the public, I was finally able to test and learn a lot about this command (named CREATE EXTERNAL MODEL), and I want to share my knowledge with you here. If you’re new to the world of AI, don’t worry, we’ll start with the basics and evolve to where this command fits in!

Ram Srivasta Kannan, Wale Akintayo, Jay Bharadwaj, John Crimmins, Shengwei Wang, Zhitao ZhuIntroductionIn 2024, the Online Data Stores team at Netflix conducted a comprehensive review of the relational database technologies...

The cloud has become the backbone of modern business, enabling rapid scalability, advanced analytics, and collaboration across global teams. In the age of artificial intelligence (AI), the cloud’s role is even more critical, both serving as the storage and processing hub for vast quantities of data that feed machine learning models, power real-time analytics, and drive business innovation.

Microsoft and Pure Storage will break down the new capabilities shaping the future of AI, performance, and resilience in SQL Server 2025, and show you what these advancements mean for the way you build, manage, and scale your data platform. Join the hour-long session for free on March 26 at 9 AM PT / 12 PM ET / 4 PM GMT.

Adopting an open data lakehouse is like upgrading ...

Rollbacks act as an ‘undo’ for databases, but why are they important, what happens if you can’t roll back, and how do you prevent even needing to in the first place? Steve, Kellyn, Grant & Pat try to answer these questions – and more.

Over the past few weeks, I have been doing some experimenting with Azure SQL mirroring to Microsoft Fabric. In the process, I ran into a couple of issues and challenges. In this data recipe, I will be going through one of my challenges when I got Azure SQL mirroring to Microsoft Fabric setup and running.

How much value would you generate for your enterprise if you could enable every user to unlock actionable insights in high-volume time-series data from your operations with real time, interactive exploration?

One of the popular low-code tools within Microsoft Fabric is the Gen2 Dataflow. Power BI report builders already know some Power Query. So armed with this knowledge is a popular starting point to load data into Microsoft Fabric. Adding values from the Variable Library in a Dataflow is an obvious plan to make it more future proof and to work better with Deployment pipelines.

In Part 1 we covered what Fabric is. In Part 2 we ...

SQL Server 2025 introduced Optimized Locking. Not ...

A lot of the time in database land, our queries are I/O constrained. As such, performance work often involves reducing the number of page reads. Indexes are a prime...

Bluebox Docker provides a realistic, continuously-updating sample database for PostgreSQL users. It automates data generation, simulating a video rental kiosk with real movie data. Users can easily set it...

LIVESTREAM DATE/TIME ??February 20th, 2026 - 9:30 ...

If you’ve spent any time working with Oracle databases, you’ve probably internalized a few expectations so deeply that you don’t even think about them anymore. One of the biggest...

One of the things a customer asked recently about ...

Erik Darling announces a new open-source product: That is, if you survive the installation process. Active Directory. Domain accounts. Firewalls. Security policies. Additional database servers.…

The .gov website hosts companies house and the companies house API. This is a comprehensive list of businesses across the UK, new and old, big and small, and their filings and info. You can interact with this information via code such as Python.

Four years ago I wrote a blog on Simple Talk explaining why Python is better than C# and, arguably, most other programming languages. To redress the balance, here are 10 reasons why you might want to avoid getting caught up in Python’s oh-so-tempting coils – particularly when building large, long-lived systems.

Every blog post about Microsoft killing NTLM is written for Windows admins and security teams. Why aren't we talking about what this means for SQL Server?

Recently, a developer asked for my input on solving a complex SQL query problem. As we went through each step, I suggested using a ranking function at one point, specifically RANK. However, they were having trouble deciding when to use RANK versus DENSE_RANK in a query. It raises a good question: When should you use DENSE_RANK instead of RANK?

Get AI-Ready With Erik: A Little More About Vector Types Video Summary In this video, I delve into the new vector types introduced in SQL Server 2025, focusing on...

It’s the second Tuesday of the month again. Time...

Part of the series “SQL Techniques You Should Kn...

A few weeks ago, I wrote this post “This post is not only about SELECT *”. It was primarily about the various reasons to avoid using SELECT * in...

Claude Cowork turns AI into a desktop agent that m...

Azure Data Studio retires on February 28, 2026. No...