SQL Server Authentication Mode

Check Description

This check determines the authentication mode used on the computer running Microsoft® SQL Server™ that is being scanned.

SQL Server provides two modes for securing access to the server: Windows Authentication Mode and Mixed Mode.

In Windows Authentication Mode, SQL Server relies solely on the Windows® authentication of the user. Windows users or groups are then granted access to the computer running SQL Server. In Mixed Mode, users may be authenticated by Windows or by SQL Server. Users that are authenticated by SQL Server have their user name and password pairs maintained within the computer running SQL Server.

Windows Authentication Mode

This security mode allows SQL Server to rely on Windows to authenticate users in the same way as other applications. Connections made to the server using this mode are called trusted connections.

When you use Windows Authentication Mode, the database administrator allows users to access the computer running SQL Server by granting them the right to log on to SQL Server. Windows security identifiers (SIDs) are used to track Windows authenticated users. As Windows SIDs are used, the database administrator can grant access directly to Windows users or groups.

Mixed Mode

In SQL Server, Mixed Mode relies on Windows to authenticate users when the client and server are capable of using NTLM or Kerberos logon authentication protocols. If either party is incapable of using a standard Windows logon, SQL Server requires a user name and password pair, and compares this pair against those stored in its system tables. Connections that rely on user name and password pairs are called non-trusted.

Mixed Mode is supplied for two reasons:

Backward compatibility with older versions of SQL Server
Compatibility when SQL Server is installed on Windows 95 and Windows 98 operating systems
(Trusted connections are not supported on computers running Windows 95 or Windows 98 when they are acting as the server.)

Additional Information

SQL Server 7.0 Security

Microsoft SQL Server 2000 Security

Microsoft Security Bulletin (MS00-035): Frequently Asked Questions