We recently moved our main application from a work group environment, to a
server environment.

What are the trade offs in having our users becoming part of our new domain
or to remain in their work group and access SQL Server through Server
Authentication?

Hope to hear from you soon

Robert Mernick

As far as SQL Server 2000 is concerned, Domain users are the way to go.
Windows authentication provides better security, better password control,
less 'user' maintenance for the DBA, etc..

It really is a 'no-brainer'.

--
Arnie Rowland, Ph.D.
Westwood Consulting, Inc

Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous


"Mernick" <Mernick (AT) discussions (DOT) microsoft.com> wrote

Thank you so much for the quick reply.

I was hoping to keep the users in the workgroup rather than as domain
members because this is a fairly mature system and they have two years worth
of work under there current user name setup. Contacts, word processor
documents, etc.. Moving everything over seems like quite a job.

Also during our testing I was getting a fair amount of sporatic system type
error messages if we went a couple of hours without using a work station.
Something like "Could not generate a SPSI context". It required rebooting to
reconnect to the domain.

I have a friend who has a system with 120 users, and he strongly recommends
staying away from enrolling everyone in the domain, since it will add so much
complexity to the system.

You thoughts would be greatly appreciated.

Thanks again,

Robert Mernick

"Arnie Rowland" wrote:

What is your current infrastructure setup? Are there specific Domain
Administrators or would you be administering the domain? How many SQL
Servers are there - are they joined to the domain or part of the
workgroup?

You will need to consider the value of migrating your users and
workstations to the domain. The initial setup of the migration may be
a lot of work, but after it has been set up and moves to maintenance
mode, it may be easier to maintain than your current setup if you have
the expertise to do so in-house. There are some methods and tools that
can assist you with this migration should you decide to do so.

As far as the error message (should read SSPI) that is likely a DNS or
name resolution issue. Seeing as your infrastructure seems disparate,
this could be for any number of reasons.


Mernick wrote:

Actually, when properly installed, Domains are more robust and provide a
'simpler' set of maintenance issues, with a concomitant higher level of
security. But it may require having someone with more expertise available to
get it set up and staff 'trained' on the differences. I have clients with
both small and large domains, and the total maintenance for all computers on
the network dropped significantly after converting from Peer-Peer to a
Domain infrastructure.

The "...SSPI context" message is probably due to an application attempting
to connect to a server and not being properly configured.

About moving 'things' over... There is an issue around keeping user
profiles -but there are tools that will take care of that for us. Normally,
there is nothing to 'move over'. Sometimes, however, when a domain is
installed, since better security is now available, file storage may be
revised in order to take advantage of the increased security and possibly
even centralized backup.

Robert, I guess the key question is: "Do you have someone available to
assist with the proper installation, configuration, and training, and that
could be 'on call' for ongoing assistance?"

--
Arnie Rowland, Ph.D.
Westwood Consulting, Inc

Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous


"Mernick" <Mernick (AT) discussions (DOT) microsoft.com> wrote

Must be a huge consulting firm that you run out of your home address.

Thanks for restating what I mentioned.
Arnie Rowland wrote:

OR a very nice condo I have in the same building as my business address...
;-)

--
Arnie Rowland, Ph.D.
Westwood Consulting, Inc

Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous


"10001110101" <G10001110101 (AT) gmail (DOT) com> wrote

That seemed like a very uncalled for attempt at belittlement, very
'un-professional', and I didn't appreciate it.

--
Arnie Rowland, Ph.D.
Westwood Consulting, Inc

Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous


"10001110101" <G10001110101 (AT) gmail (DOT) com> wrote

Much like many of your other comments in this newsgroup. Treat others
as you expect to be treated and you won't have that problem.

People come to this group for guidance and suggestions. Adding
comments which contradict others' suggestions or material in a
demeaning manner will make you unpopular very quickly.

With that said, I apologize. I should not have stooped to your level.

Arnie Rowland wrote:

Let's take this off line.



Apparently, for some reason, you feel that I 'contradicted a response you
made.



Rather than continuing this childish and unprofessional banter:



Much like many of your other comments in this newsgroup. Treat others
as you expect to be treated and you won't have that problem.

People come to this group for guidance and suggestions. Adding
comments which contradict others' suggestions or material in a
demeaning manner will make you unpopular very quickly.

With that said, I apologize. I should not have stooped to your level.



How about providing some specifics.



If you felt 'belittled', it certainly wasn't intentional. If I offered
contradictory information to an OP, then I obviously thought that there was
merit in providing additional information. I have no problem with that.



At least I have enough self confidence to publicly identify myself.


--
Arnie Rowland, Ph.D.
Westwood Consulting, Inc

Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous


"10001110101" <G10001110101 (AT) gmail (DOT) com> wrote