When setting up security on SQL Server 2005 / 2008. What is the more secure option?
- Windows Authentication Mode Only
- Mixed Authentication
Does it matter if the server will be accessed by many desktop clients (thick clients) or if a handful of web servers will be accessing it?
And why is it more secure? Using Windows Authentication does mean we can avoid putting the connection string in the configuration file which is a plus.
Windows Authentication also allows us to control who gets access based on their NT credentials, which I would think is ideal when your clients connect directly to the server.
One thing I always wonder however, is how useful NT authentication is when all clients go through a proxy such as web service.