Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We are going to enable Kerberos to allow double hop authentication between our SQL Servers. Our company is nearly 24 hours which leaves a very small window for server restarts. Is it possible to enable Kerberos without requiring a reboot of our Domain Controllers or our SQL servers?

share|improve this question
1  
You're changing authentication schemes on a 24-hour company without a test environment? –  pboin Jul 13 '11 at 19:11
    
point taken! I'll have to check with the hardware/network folks about this. –  Clownish Carnage Jul 14 '11 at 12:04

1 Answer 1

up vote 1 down vote accepted

Kerberos is already enabled, it's how active directory works, what I assume your talking about is enabling delegation from your web server(or other application server) to your SQL server, this does not require a reboot.

That said, as pboin mentioned, I would always try this in a test environment first.

share|improve this answer
    
Certainly a valid point. This actually did come up in discussions. I'm not sure how well we'll be able to create a test environment to mimic this. But it's definitely worth exploring more. –  Clownish Carnage Jul 14 '11 at 12:05
    
Our authentication is defaulting to NTLM. We are looking to default to Kerberos. Leaving the current connections as NTLM is OK. Another note: Most of our current SQL authentication is via SQL and not through AD. So, my assumption is that our main systems will not have a problem. Currently my main concern is SQL to SQL (and custom calling apps or Access Databases). –  Clownish Carnage Jul 14 '11 at 12:16
    
You likely have this query already: select session_id, net_transport, protocol_type, auth_scheme, client_net_address from sys.dm_exec_connections where session_id = @@SPID Useful in trouble-shooting authentication issues over linked servers. –  jl. Jul 14 '11 at 19:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.