13 Jul 2012

Configure SQL Server 2008 for Sharepoint 2010 and Project Server 2010 installation

Configure SQL Network Settings for SQL Server 2008
To configure the network settings for SQL Server 2008 complete the following steps:
1. From the computer console click the Start button  >> All Programs  >> Microsoft SQL Server 2008 2.  2. Expand Configuration Tools and select SQL Server Configuration
The system displays the SQL Server Configuration Manager.
3. In the left pane, expand SQL Server Network Configuration, and then select the target SQL Server instance for your Project Server databases.
4. Verify that the TCP/IP option is enabled in the right frame.

Add a SQL Server Login for the Farm Administrator Account
 Project Server 2010 requires that the Farm Administrator Role Account have a SQL Server login with public, dbcerator, securityadmin and sysadmin roles in SQL Server. To create a SQL Server login and add the roles for the login, complete the following steps:
1.       Open SQL Server Management Studio.
2.         Connect to the database engine for your Project Server 2010 target instance
3.         Expand the Security node, then right-click on Logins and select the New Login option



4. The system displays the New Login dialog
5. Enter the domain account you created for the Farm Administrator in the Login Name field. From the Select a page list on the left, select Server Roles.

6. In the Server roles list, select the dbcreator, securityadmin, and sysadmin check boxes. The public roles checkbox is selected by default. Leave this setting selected.
7. Click the OK button to continue.


Enable the Common Language Runtime 
Enabling the Common Language Runtime (CLR) for SQL Server improves Project Server 2010 performance by 30% on average, according to Microsoft. To enable the common language runtime, click on the New Query button in the SQL Server Management Studio window and copy the following query into the SQL Query pane

sp_configure ‘clr enabled’, 1; 
go 
reconfigure; 
go





Click the Execute button to execute the query and enable the CLR. After executing the query the output section should report a success message like the one shown in Code Sample below. Note that the Query includes the RECONFIGURE statement, and it is not necessary to run this again.  

Configuration option 'clr enabled' changed from 0 to 1. Run the RECONFIGURE statement to install.  

Set SQL Server Database Collation 
Your SQL Server collation must be configured for case-insensitive. In a default English language version, the default collation (SQL_Latin1_General_CP1_CI_AS) is compliant with this requirement. If you are not working with a default English SQL Server installation, you may need to change your SQL Server database collation to case-insensitive, accent-sensitive, Kana-sensitive, and width-sensitive.

Prepare SQL Server Analysis Services for Project Server
You must complete two simple configuration steps to prepare your instance of SQL Server Analysis Services for Project Server 2010:
1) Add the Farm Administrator Role account to the OLAP Users Local Group on the server, and
2) Configure the Farm Administrator Role account permissions in SQL Server Analysis services. To add the Farm Administrator account to the OLAP Users Local Group, complete the following steps:  1. Log in to the computer running Analysis Services and select
Administrative Tools from the Start menu and select Computer Management from the submenu.
2. On the Computer Management page, in the left pane under System Tools, expand the Local Users and Groups item. Click to expand the Groups folder and locate the OLAP Users Local Group for your Analysis Services instance as shown for SQL Analysis Services 2008
3. Double-click on the group name to open the group Properties dialog

4. In the Properties dialog, click the Add button. The system displays the Select Users, Computers, or Groups dialog
5. In the Select Users, Computers, or Groups dialog, enter the name of your Farm Administrator account. You may click the Check Names button to verify your entry, or click the OK button to accept your entry. The account now appears in the Members section of the Group Properties dialog shown previously. Click the OK button to close the Group Properties dialog and then close the Computer Management page to continue.

To add the Farm Administrator as an Analysis Services server administrator complete the following steps: 
1. Open SQL Server Management Studio. In the Connect to Server window, select or browse to connect to the SQL Server Analysis Services instance for your Project Sever 2010 deployment.
2. In Microsoft SQL Server Management Studio Object Explorer, right-click on your SQL Server 2005 Analysis Services instance name, and then click Properties from the pop-up menu. The system displays the Analysis Services Properties dialog. From the Select a page pane, click the Security item. Your Analysis Server Properties dialog should look like the
3. Click the Add button. The system displays the Select Users or Groups dialog
4. On the Select Users or Groups dialog, type the name of the Farm Administrator account.
5. Click the OK button to add the Farm Administrator account to the Server Administrators list
6. Click the OK button on the Analysis Server Properties page to exit the operation.

11 Jul 2012

Managed Service Account–SQL Server 2012

As you know there are so many security measures are taken during every release of SQL Server. This version of SQL Server will be using Managed Service account to run SQL server related services. In other terms earlier versions we used Local system account as service account for all SQL Server related services however in this version we be will using individual local accounts for all SQL server related services. In this case whatever application runs on local system are allowed to access SQL Server. So to overcome this MS team has started using managed service accounts in SQL Server.

Let me give you a brief about Manage service account then we will discuss about the new changes related to service account in SQL Server 2012.

What is Managed Service Account?

Managed Service Account (MSA) is a new type of account that’s supported in Windows 7 & Windows 2008 R2. Main reason for this new account type is to isolate one service from another. In earlier operating systems we will run the services either in Localsystem or Domain accounts. Let’s assume you run SQL Server using Local system that means any other service running in Local system can connect to SQL Server and retrieve the data, this seems to be a loop hole when you run it in localsystem. We can use domain account to avoid this scenario however maintaining these domain accounts will take considerable time. In addition to this most of the organizations won’t change domain service account password in a period of time that means if someone knows the password he will be able to connect to SQL Server anytime as the password remains the same forever.
Considering all these things in mind they have added the new account feature in Windows 7 & Windows 2008 R2. Below are the advantages of Managed service account
  • Automatic password management. Password for MSA will be automatically changed every 30 days. However there is a known issue when the password gets changed it can cause a failed authentication attempt using old password, to overcome this you need to install a patch, refer KB article http://support.microsoft.com/kb/2494158 for more details.
  • SPN management is made simpler (domain need to be in Windows 2008 R2 functional level) for these accounts, which allows service administrators to set SPN’s for these accounts. For windows 2003 and windows 2008 functional level, you can update the schema to support this.
You can also create MSA for your own application service. Crucial part is that you don’t have a GUI to create \ configure a MSA for your service, you need to work with powershell cmdlets. For further information on MSA check the KB articles below
http://technet.microsoft.com/en-us/library/dd548356.aspx
http://technet.microsoft.com/en-us/library/ff641729%28v=ws.10%29.aspx

What’s added in SQL Server 2012

In earlier versions (from SQL 2005) of SQL Server, as part of Service account security standards they created local groups in the computer and granted necessary permission for the groups where ever applicable. However in SQL Server 2012 that’s not applicable, they will create individual managed service account for each SQL Server service. This means all SQL Server related services will run on their own service account there by isolating each services. You can see from the image below each service have different service account and each of these account have their own SID
service_account_sql_2012_1
Naming convention for the service accounts is as below
Service Name
Instance
Service Account Naming Convention
Database Engine Default MSSQLServer
Agent Service Default SQLSERVERAgent
Reporting Server Default ReportServer
Analysis Service Default MSSQLServerOLAPService
Fulltext Service Default MSSQLFDLauncher
Database Engine InstanceName MSSQL$InstanceName
Agent Service InstanceName SQLAgent$InstanceName
Reporting Server InstanceName ReportServer$InstanceName
Analysis Service InstanceName MSOLAP$InstanceName
Fulltext Service InstanceName MSSQLFDLauncher$InstanceName
Integration Service Not applicable MSDtsServer110
I have a curiosity to check admin permission associated to these accounts, I could see SA access granted only to SQL agent service account and not to database engine, that’s a classic example how they grant only required permission
service_account_sql_2012_2
Finally I’ve checked the administrators group in computer to check is any SQL related groups got created. Yes there are couple of groups still get created in computer for Browser service and analysis services. Analysis service account and browser service account are part of  analysis group & browser group respectively.
service_account_sql_2012_3
From the screenshot above it’s clear that analysis groups are created per instance. Thus MSA is a added security hardening step in SQL Server 2012 to isolate all SQL server related services, thus no more access using local system account.

Total Pageviews