about autentisering

Hello!

I have two questions

I just wonder if I use window autentisering for a SQL server on a server
where I can log in to
how can SQL Server let me do so. I assume that SQL Server will not insert
any kind of window account into the SQL Server database. So I can't
understand how SQL Server can use my window account to give me permission to
use SQL Server

Which autentisering is most safe between Window autentisering and SQL
autentisering.
I assume the right answer is SQL autentisering because that you must have an
account in the SQL server database?

//Tony

Tony Johansson (johansson.andersson@telia.com) writes:
> I just wonder if I use window autentisering for a SQL server on a server
> where I can log in to how can SQL Server let me do so. I assume that SQL
> Server will not insert any kind of window account into the SQL Server
> database. So I can't understand how SQL Server can use my window account
> to give me permission to use SQL Server
>
> Which autentisering is most safe between Window autentisering and SQL
> autentisering. I assume the right answer is SQL autentisering because
> that you must have an account in the SQL server database?

To start with it's "authentication" in this weird foreign language
they use in this newsgroup.

To be able to log in with Windows authentication, your Windows account
must have been granted access to SQL Server. This can be done in two
ways: directly, or indirectly through a Windows group of which you are
a member. This can be very practical, as user membership then only needs
to be administered in Active Directory.

Note also that to be able to access a certain database, you need to be
granted access to the database, which again can be done per Windows
login or per Windows group.

Windows authentication is generally considered more secure than SQL
authentication. This is particularly true for SQL 2000 and earlier versions
where the password was sent over the wire in a fashion that was fairly
simple to eavesdrop. Furthermore SQL 2000 had no protection whatsoever
against brute-force attacks.

The situation in SQL 2005 is better, but Windows authentication is still
seen as preferrable. SQL authentication should mainly be used when Windows
authentication is difficult to get to work, for instance in a workgroup or
if you need to accept users from a non-trusted domain.

--
Erland Sommarskog, SQL Server MVP, esquel RemoveThis @sommarskog.se

Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/prodtechnol/sql/2005/downloads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodinfo/previousversions/books.mspx