Problems displaying this newsletter? View online.
SQL Server Central
Featured Contents
Question of the Day
Featured Script
The Voice of the DBA
 

Password Guidance

I remember working at a large organization with a team of other IT Operations staffers. We rotated this one job every month amongst a few people, each taking turns, where we'd lose a day to update all the privileged passwords for our servers. This was before Managed Service Accounts and the cloud, when we were required to change these every 30 days and then store the new ones in an encrypted store.

What struck me when I got stuck with this wasn't the requirement to change every 30 days; that seemed normal. The thing that bothered me was how manual this was. As a former developer, I wrote some scripts to automated this, pre-PowerShell, and make the task easier on my fellow sys admins. I had scripts to generate a password, change it in AD, then print the pwd to be copied into our secure storage (no API there). This ran in a loop so I didn't lose a whole day to changing password.

These days, we have lots of alternatives to managing passwords, and in fact, much of modern guidance isn't to require password changes so often. For systems, use an automated process such as an MSA or GMSA. For users, we've mostly given up on changes and are trying to get people to use decently long passwords and disparate ones across services.

Modern guidance from Microsoft says to avoid using common passwords (asdfasdf, password1, ec.) and don't use the same password in multiple places. MFA is also recommended, but the anti-patterns for success are requiring long, complex passwords or frequent changes. Studies show these lead to less security because users do stupid things.

These days, I would guess many of you managing database systems use some sort of integrated security with AD, Entra, OAuth, etc. However, I know there are still places where passwords are in use. Do you require changes often? Do you change any of your passwords regularly?

Security is always hard, and it's even harder when the recommendations and rules aren't consistent or even enforced. I don't know what to do, but I try to use disparate, long passwords and MFA wherever I can. So far that's worked well.

Steve Jones - SSC Editor

Join the debate, and respond to today's editorial on the forums

 
 Featured Contents
Stairway to Transaction Log Management

Stairway to Transaction Log Management in SQL Server, Level 9: Monitoring the Transaction Log

Tony Davis from SQLServerCentral.com

Our major goal in terms of log maintenance for all databases under our care is to optimize for write performance, in order to support all activities that require SQL Server to write to the log, including data modifications, data loads, index rebuilds, and so on. However, it's also important to keep an eye on possible log fragmentation, which, as described previously, can affect the performance of processes that need to read the log, such as log backups and the crash recovery process.

External Article

A Rolling Filtered Index in SQL Server

Additional Articles from MSSQLTips.com

I recently resolved an issue where a query pulling data from the last 30 days would time out due to the table’s size and the lack of a supporting index. Creating a supporting index is possible, but not ideal; it will be very large and may not be useful for most queries and use cases. I wonder how I could implement a filtered index that follows time and is always limited to the last n days.

Blog Post

From the SQL Server Central Blogs - Scooby-Doo and the Mystery of Cloud Costs (Let’s have some fun!) – Scooby Dooing Episode 1

SQLEspresso from SQLEspresso

If there’s one thing I’ve learned in consulting, it’s that SQL Server, and other database performance tuning isn’t just about faster queries—it’s directly tied to your bottom line in...

Blog Post

From the SQL Server Central Blogs - Adding SQL Server 2025 to my Laptop

Steve Jones - SSC Editor from The Voice of the DBA

I wanted to do some testing of SQL Server 2025 on my laptop. I have written before how I avoided installing SQL Server on the laptop and use containers...

Introduction to PostgreSQL for the data professional

Introduction to PostgreSQL for the data professional

Site Owners from SQLServerCentral

Adoption and use of PostgreSQL is growing all the time. From mom-and-pop shops to large enterprises, more data is being managed by PostgreSQL. In turn, this means that more data professionals need to learn PostgreSQL even when they have experience with other databases. While the documentation around PostgreSQL is detailed and technically rich, finding a simple, clear path to learning what it is, what it does, and how to use it can be challenging. This book seeks to help with that challenge.

 

 Question of the Day

Today's question (by Alessandro Mortola):

 

Using table variables in T-SQL

What happens if you run the following code in SQL Server 2022+?
declare @t1 table (id int);

insert into @t1 (id) values (NULL), (1), (2), (3);

select count(*)
from @t1
where @t1.id is distinct from NULL;
 

Think you know the answer? Click here, and find out if you are right.

 

 

 Yesterday's Question of the Day (by Steve Jones - SSC Editor)

Change Tracking Data Retention Options

If I am running this code:

ALTER DATABASE AdventureWorks2017 SET CHANGE_TRACKING = ON (CHANGE_RETENTION=4 xxx);

What are the possible choices for xxx?

Answer: This can be MINUTES, HOURS, or DAYS

Explanation: You can set the scale as MINUTES, HOURS, or DAYS. Ref: ALTER DATABASE - https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-database-transact-sql-set-options?view=sql-server-ver16

Discuss this question and answer on the forums

 

Featured Script

Index Efficiency & Maintenance Advisor

James Smith from SQLServerCentral

This script will help DBAs to find inefficient indexes and duplicate indexes, by providing the following metrics: usage statistics, fragmentation levels, size, and index duplication analysis.

/*
Index Efficiency & Maintenance Advisor
Identifies:
1. Duplicate indexes (same keys/includes)
2. Underutilized indexes (low reads, high writes)
3. Highly fragmented indexes
4. Indexes with high maintenance cost relative to value
*/
DECLARE
@MinPageCount INT = 1000, -- Minimum data pages (8KB/page) to consider
@FragThreshold FLOAT = 30.0, -- Min fragmentation % to flag
@UsageDaysThreshold INT = 30, -- Min server uptime days for usage stats
@ReadsPerMBThreshold INT = 10, -- Reads/MB threshold (usage efficiency)
@UpdateReadRatioThreshold INT = 10; -- Writes vs Reads ratio threshold

WITH IndexData AS (
SELECT
DB_NAME() AS DatabaseName,
SCHEMA_NAME(t.schema_id) AS SchemaName,
t.name AS TableName,
i.name AS IndexName,
i.type_desc AS IndexType,
i.is_primary_key,
i.is_unique,
i.is_disabled,
COALESCE(s.user_seeks, 0) AS user_seeks,
COALESCE(s.user_scans, 0) AS user_scans,
COALESCE(s.user_lookups, 0) AS user_lookups,
COALESCE(s.user_updates, 0) AS user_updates,
s.last_user_seek,
s.last_user_scan,
s.last_user_lookup,
ps.page_count,
ps.avg_fragmentation_in_percent,
(ps.page_count * 8.0 / 1024) AS SizeMB,
COALESCE(STUFF((
SELECT ', ' + COL_NAME(ic.object_id, ic.column_id)
FROM sys.index_columns ic
WHERE
ic.object_id = i.object_id
AND ic.index_id = i.index_id
AND ic.is_included_column = 0
ORDER BY ic.key_ordinal
FOR XML PATH('')
),1,2,''), '') AS KeyColumns,
COALESCE(STUFF((
SELECT ', ' + COL_NAME(ic.object_id, ic.column_id)
FROM sys.index_columns ic
WHERE
ic.object_id = i.object_id
AND ic.index_id = i.index_id
AND ic.is_included_column = 1
ORDER BY ic.index_column_id
FOR XML PATH('')
),1,2,''), '') AS IncludedColumns
FROM
sys.tables t
INNER JOIN sys.indexes i ON t.object_id = i.object_id
LEFT JOIN sys.dm_db_index_usage_stats s ON
s.object_id = i.object_id
AND s.index_id = i.index_id
AND s.database_id = DB_ID()
CROSS APPLY sys.dm_db_index_physical_stats(
DB_ID(),
i.object_id,
i.index_id,
NULL,
'LIMITED'
) ps
WHERE
i.type > 0 -- Exclude heaps
AND t.is_ms_shipped = 0
AND ps.alloc_unit_type_desc = 'IN_ROW_DATA'
AND ps.page_count > @MinPageCount
),
DuplicateIndexes AS (
SELECT
DatabaseName,
SchemaName,
TableName,
KeyColumns,
IncludedColumns,
COUNT(*) AS DupCount
FROM IndexData
GROUP BY
DatabaseName,
SchemaName,
TableName,
KeyColumns,
IncludedColumns
HAVING COUNT(*) > 1
),
ServerUptime AS (
SELECT
DATEDIFF(DAY, sqlserver_start_time, GETDATE()) AS UptimeDays
FROM sys.dm_os_sys_info
)
SELECT
id.DatabaseName,
id.SchemaName,
id.TableName,
id.IndexName,
id.IndexType,
id.is_primary_key,
id.is_unique,
id.SizeMB,
id.avg_fragmentation_in_percent AS FragmentationPct,
id.user_seeks,
id.user_scans,
id.user_lookups,
id.user_updates,
(id.user_seeks + id.user_scans + id.user_lookups) AS TotalReads,
id.KeyColumns,
id.IncludedColumns,
COALESCE(di.DupCount, 1) AS DupCount,
CASE
WHEN di.DupCount > 1 THEN 'DUPLICATE'
WHEN su.UptimeDays > @UsageDaysThreshold
AND (id.user_seeks + id.user_scans + id.user_lookups) = 0
AND id.user_updates > 0 THEN 'UNUSED (COSTLY WRITES)'
WHEN su.UptimeDays > @UsageDaysThreshold
AND (id.user_seeks + id.user_scans + id.user_lookups) > 0
AND (id.user_seeks + id.user_scans + id.user_lookups) < (id.SizeMB * @ReadsPerMBThreshold) AND id.user_updates > (id.user_seeks + id.user_scans + id.user_lookups) * @UpdateReadRatioThreshold
THEN 'INEFFICIENT (HIGH WRITE/READ RATIO)'
WHEN id.avg_fragmentation_in_percent > @FragThreshold THEN 'HIGH FRAGMENTATION'
ELSE 'ANALYZE MANUALLY'
END AS IssueType,
CASE
WHEN di.DupCount > 1 THEN 'Consider dropping duplicate indexes'
WHEN su.UptimeDays <= @UsageDaysThreshold THEN 'Insufficient usage data - server restarted ' + CAST(su.UptimeDays AS VARCHAR) + ' days ago' WHEN (id.user_seeks + id.user_scans + id.user_lookups) = 0 THEN 'Potential candidate for removal. Verify with business logic first.' ELSE 'Evaluate index maintenance/usage patterns' END AS Recommendation, id.last_user_seek, id.last_user_scan FROM IndexData id LEFT JOIN DuplicateIndexes di ON id.DatabaseName = di.DatabaseName AND id.SchemaName = di.SchemaName AND id.TableName = di.TableName AND id.KeyColumns = di.KeyColumns AND id.IncludedColumns = di.IncludedColumns CROSS JOIN ServerUptime su WHERE di.DupCount > 1
OR (
su.UptimeDays > @UsageDaysThreshold
AND (
(id.user_seeks + id.user_scans + id.user_lookups) = 0
OR id.avg_fragmentation_in_percent > @FragThreshold
OR (id.user_seeks + id.user_scans + id.user_lookups) < (id.SizeMB * @ReadsPerMBThreshold) ) ) ORDER BY id.SizeMB DESC, di.DupCount DESC;

More »

 

Database Pros Who Need Your Help

Here's a few of the new posts today on the forums. To see more, visit the forums.


SQL 2012 - General
SQL Server authentication vs. Trusted connection - I maintain an application written years ago, where the database is on a Windows 2012 R2 Server and the database is SQL Server 2012. The people who configured this application made it so that it used SQL Server Authentication. I've always taken it to be the case that SQL Authentication was the only way of […]
SQL Azure - Development
How to resolve issue of custom Audit log table containing incorrect data? - We have created a parent table, child table & Audit log table in SQL Server database. For one parent record, there are multiple child records. When a child record in updated, a Stored Procedure is called in which a few fields of all the child records are updated that are associated with the parent record. […]
SSRS 2016
ssrs subscription file share - I am trying to create a subscription that posts to a one drive directory.  I reset my password through microsoft and then copied that password when setting up the file share subscription.  When the subscription executes I get 'a logon error occurred when attempting to access the file share.  the user account or password is […]
SSDT
Visual Studio SSIS Package Showing Up Blank - Hi all, this is my first time posting on this forum, thank you all very much in advance. I have a .dtsx package open in Visual Studio, and one of the Script Tasks are erroring with "The binary code for the script is not found. Please open the script in the designer by clicking Edit […]
Integration Services
OLE DB Provider SQLNCLI11.1 Is Not Registered - I am not sure if there are components I need to install on my local PC or on our server, so I am hoping for some help. I have Visual Studio 2019 installed.  For a few years, I have been creating SSIS packages for a Microsoft SQL Server 2016 (SP1) - 13.0.4001.0 (X64).  I had […]
Snowflake, DataBricks, Redshift, and other cloud warehouse platforms
just finished a deep dive into snowflake - Hi, i know this is a sql forum but snowflake purports to interface with everything so i was hoping to get an opinion from some of the pundits in this forum. Does anyone in this community have an opinion either way of the snowflake product? One of the biggest areas of confusion is that they […]
Editorials
Concerns over AI Chat Privacy - Comments posted to this topic are about the item Concerns over AI Chat Privacy
Data Sovereignty in the Cloud - Comments posted to this topic are about the item Data Sovereignty in the Cloud
MySQL
MySQL 5.6 not writing any logs - We are using MySQL version 5.6 in our Windows Server 2012 R2 environment. We have enabled the error, general & slow logging in the config file, but the logs are not being written even in case of errors. The below is a snippet from the ‘my.ini’ file:     # Commented lines aren’t included [mysqld] […]
Article Discussions by Author
The Duplicate Cursor - Comments posted to this topic are about the item The Duplicate Cursor
Introduction of Azure SQL Hyperscale: Stairway to Azure SQL Hyperscale Level 1 - Comments posted to this topic are about the item Introduction of Azure SQL Hyperscale: Stairway to Azure SQL Hyperscale Level 1
What is Delayed Durability in SQL Server — And Should You Turn It On? - Comments posted to this topic are about the item What is Delayed Durability in SQL Server — And Should You Turn It On?
Which MAXDOP? - Comments posted to this topic are about the item Which MAXDOP?
SQL Server 2022 - Administration
SSL certificate to connect Google Looker Studio to on-prem SQL Server - We have been asked to connect Google's Looker Studio to an on-prem instance of SQL Server 2022. Our instance has "Force Encryption" enabled, and uses a private domain CA certificate. In the connection string dialog for Looker Studio, there is an "Enable SSL" checkbox and an option to upload a Microsoft SQL Server SSL Configuration […]
SQL Server 2022 - Development
where did my topic on a new ssms 21 bug go - Hi should i repost my latest ssms 21 bug, the one in which sql agent now doesnt show property details on steps in the gui but does show them when the job is scripted?   It disappeared a couple of hrs ago because it was under eval.
 

 

RSS FeedTwitter

This email has been sent to {email}. To be removed from this list, please click here. If you have any problems leaving the list, please contact the webmaster@sqlservercentral.com. This newsletter was sent to you because you signed up at SQLServerCentral.com.
©2019 Redgate Software Ltd, Newnham House, Cambridge Business Park, Cambridge, CB4 0WZ, United Kingdom. All rights reserved.
webmaster@sqlservercentral.com

 

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -