I have just been given access to a new Windows Web Server 2008 R2 which has SQL Server 2008 R2 installed on it. When I open up SQL Server Management Studio and try to connect, it does so with Windows Authentication, however, it does not ask me for a password, and it successfully connects.
I am worried that (hopefully not) someone who shouldn't be accessing the server does so, and can then easily connect to SQL Server Management Studio without even being asked for a password, and then have access to the databases. For example, someone who has stolen the Windows Web Server login details. They now are logged onto the Web Server, and because the login details they used identify that user the privileges to access SQL Server with Windows Authentication (no password needed), they can then access the databases and data.
What would be the best approach here to ensure that anyone who wants access to my databases, must enter a password?
I know I can create user accounts inside SQL Server and assign users to specific databases (SQL Server Authentication), but this doesn't get around the issue of a user who shouldn't be on the server, just selecting Windows Authentication type, enter no password, and have full access to my databases.
Can someone please advice this on this?