Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We juste had a security audit that found that, if you get access to our database (SQLInjection for example), you can easily send all the content of the database to a remote SQL Server.

The recommendation is to disable Ad Hoc Distributed Queries. I found a lot of articles on how to do that on SQL Server 2005, but not on SQL Server 2000.

Any idea ?

share|improve this question
up vote 5 down vote accepted

According to this Distributed Query Architecture page: "For each instance of SQL Server 2000, members of the sysadmin fixed server role can enable or disable the use of ad-hoc connector names for an OLE DB provider using the SQL Server DisallowAdhocAccess property."

share|improve this answer
He he, you were faster! +1 – splattne May 19 '09 at 16:20
Hey, thanks for the super-fast and correct answer ! – Sébastien Nussbaumer May 19 '09 at 16:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.