May 26, 2010 at 2:36 pm
I've got a couple of servers that were never well documented and I don't have any idea of what the middle ware account passwords are?
I've got sa permissions and can change them; but that will break the applications. Something I'd like to avoid if possible. I might be able to get some of the passwords from vendors (maybe, if the vendor defaults were used) but others are pretty much an unknown.
I've seen a couple of apps that might work but is there a way to get these out from SQL? I'm mostly concerned about a couple SQL 2000 instances.
Thanks!
Norman
May 26, 2010 at 3:29 pm
No - you are not going to be able to get those passwords. You're going to have to bite the bullet and change the password and see what falls out.
Jeffrey Williams
“We are all faced with a series of great opportunities brilliantly disguised as impossible situations.”
― Charles R. Swindoll
How to post questions to get better answers faster
Managing Transaction Logs
May 26, 2010 at 4:13 pm
This might be a reach but try these guys - http://www.sentrigo.com/.
They showed us a presentation at our UG showing how to capture your SQL Passwords (if in use) because the password is stored in clear text in memory in SQL Server.
Jason...AKA CirqueDeSQLeil
_______________________________________________
I have given a name to my pain...MCM SQL Server, MVP
SQL RNNR
Posting Performance Based Questions - Gail Shaw[/url]
Learn Extended Events
May 26, 2010 at 4:17 pm
The actual product you should take a look at is:
http://www.sentrigo.com/passwords
Jason...AKA CirqueDeSQLeil
_______________________________________________
I have given a name to my pain...MCM SQL Server, MVP
SQL RNNR
Posting Performance Based Questions - Gail Shaw[/url]
Learn Extended Events
May 27, 2010 at 8:10 am
Thanks for the pointer, an interesting program since it shows the first and last letters in the password but I don't see a way to get the entire password out. I guess that is good...
I'm afraid Mr Williams' answer was correct, I'm just going to have to bite the bullet and reset them and work with the application support to get this all done. Probably the best way but I was trying to avoid that little bit of irritation.
Thanks to all for the help.
Norman
May 27, 2010 at 3:52 pm
n.heyen (5/27/2010)
Thanks for the pointer, an interesting program since it shows the first and last letters in the password but I don't see a way to get the entire password out. I guess that is good...I'm afraid Mr Williams' answer was correct, I'm just going to have to bite the bullet and reset them and work with the application support to get this all done. Probably the best way but I was trying to avoid that little bit of irritation.
Thanks to all for the help.
Norman
I wonder if that is just a demo of the app that is only showing the limited characters. We watched the full blown app divulge the full passwords. It was rather scary to see how easy it is to retrieve those passwords.
Jason...AKA CirqueDeSQLeil
_______________________________________________
I have given a name to my pain...MCM SQL Server, MVP
SQL RNNR
Posting Performance Based Questions - Gail Shaw[/url]
Learn Extended Events
May 28, 2010 at 3:03 am
If its all working OK why change them? Changing could put you in a much worse position than you are now. If you have to change them, what fallback do you have?
May 28, 2010 at 6:59 am
Maybe you could take a copy of the server to VHD using Disk2vhd then test changing the password in your new virtual system without effecting your production system
May 28, 2010 at 7:13 am
May 28, 2010 at 9:42 am
One thing you might try is using Network Monitor to capture the logon process. Since most of the time these are not encrypted, you could capture the network traffic and find the password that is being passed to SQL for authentication.
Raymond Laubert
Exceptional DBA of 2009 Finalist
MCT, MCDBA, MCITP:SQL 2005 Admin,
MCSE, OCP:10g
May 28, 2010 at 9:43 am
skcadavre (5/28/2010)
Have you tried this?
Nice resource
Jason...AKA CirqueDeSQLeil
_______________________________________________
I have given a name to my pain...MCM SQL Server, MVP
SQL RNNR
Posting Performance Based Questions - Gail Shaw[/url]
Learn Extended Events
May 28, 2010 at 9:56 am
What we are trying to do is consolidate a bunch of scattered department servers into one central SQL server. None of them have users that are company wide but contain critical data, non are managed by the IT staff. Some even have the *&$!# IP addresses in the connect strings...
So, it looks like we will have to visit each application and make the changes to address at least and might as well document what the connection account is. Setting up aliases to soon to be non-existent servers seems like a bad choice in the long run.
Fortunately this isn't really time critical so I can do it over the span of a few weeks or months if it comes to that, But I'm going to have to work with a lot of people, some of which are going to be unhappy.
Thanks for all the tips and advice, greatly appreciated!
Norman
May 28, 2010 at 10:02 am
You're welcome.
Jason...AKA CirqueDeSQLeil
_______________________________________________
I have given a name to my pain...MCM SQL Server, MVP
SQL RNNR
Posting Performance Based Questions - Gail Shaw[/url]
Learn Extended Events
Viewing 13 posts - 1 through 12 (of 12 total)
You must be logged in to reply to this topic. Login to reply