Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I need to know in which file SQL Server 2008 actually stores the passwords. This is a question being asked by a security auditor.

I know I can get password hashes with LOGINPROPERTY('bbellomo', 'PasswordHash'), but that doesn't help me; I need to know how they are stored.

share|improve this question

migrated from stackoverflow.com Jul 20 '11 at 15:53

This question came from our site for professional and enthusiast programmers.

3 Answers 3

Try to look into sys.server_principals user names and passwords are in the master database. But the passwords are not stored in plaintext.

share|improve this answer
    
Give him SELECT * FROM SYSLOGINS if he/she really needs output –  jl. Jul 20 '11 at 16:02

The passwords aren't stored in plaintext. If the auditor really needs the file in which they're stored, point them at the master.mdf file. This is, of course, for SQL logins. For Windows logins, SQL doesn't even know what the password is; Active Directory handles the authentication.

share|improve this answer

The execution plan from 'SELECT password FROM syslogins' shows the passwords are stored in sys.sysxlgns in the master database.

Take a look at: System Base Tables

Here are the passwords, in the only 2 formats SQL Server will show them to us:

SELECT name, password, LOGINPROPERTY(name, 'PasswordHash' ) hash
FROM syslogins
WHERE password IS NOT NULL
ORDER BY name

You can probably convert between the formats easily, but I don’t know how off hand.

share|improve this answer
    
this works only if you have enough rights on the server. According to BOL it requires CONTROL SERVER permission. (see msdn.microsoft.com/en-us/library/ms345412(v=sql.120).aspx) –  Henrik Staun Poulsen Mar 27 at 7:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.