Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need some help on understanding the differences between Windows and SQL Server Authentication:

We have a SQL Server 2008 set to SQL Server and Windows Authentication Mode.

There is one A/D user -- munis -- that can log into our SQL Server. That user also has a login in SQL Server with Public and Sysadmin roles.

There is another user -- cnorton -- who cannot log into the SQL Server and has no local login in the SQL Server.

I thought that Windows authentication allowed A/D (domain) users to log into a SQL Server. User cnorton has more A/D privileges than does user munis, like Domain Admin and Sysadmin.

So my question is does Windows and SQL Server Authentication mode require a local SQL Server login, and why?

share|improve this question
up vote 4 down vote accepted

No, mixed mode does not require both, obviously - it requires either one.

Your mistake is in thinking that AD credentials automatically allow SQL server access; they don't, you still have to GRANT this access. Otherwise, how would Sql Server know how much access they have?

Create a new Login for DOMAIN\cnorton and map the user to some databases.


Alternatively, you can add this user to a fixed database role:

USE YourDatabase
share|improve this answer

SQL Server is an application. Windows Authentication and SQL authentication are two different methods for authenticating to SQL Server as an application. Both types require a user principal to be defined/created with some level of access. That's what a login is. You can create a login of either type but you must create the login and grant it some level of access.

share|improve this answer

You still need to create a login in SQL server for the AD user 'cnorton', but you do not need to create a password for him.

In SSMS, select the server instance you need, and then under logins, right click and hit "New login..."

In the dialog you can press the search button, and search your AD instance for names:search dialog

You can see in this case I've selected a test user from my AD instance. This user will be able to login to SSMS or make connections based on the SQL Server permissions you grant to that login just by being logged into Windows with that user.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.