1

We are going to enable Kerberos to allow double hop authentication between our SQL Servers. Our company is nearly 24 hours which leaves a very small window for server restarts. Is it possible to enable Kerberos without requiring a reboot of our Domain Controllers or our SQL servers?

2
  • 1
    You're changing authentication schemes on a 24-hour company without a test environment?
    – pboin
    Jul 13, 2011 at 19:11
  • point taken! I'll have to check with the hardware/network folks about this. Jul 14, 2011 at 12:04

1 Answer 1

1

Kerberos is already enabled, it's how active directory works, what I assume your talking about is enabling delegation from your web server(or other application server) to your SQL server, this does not require a reboot.

That said, as pboin mentioned, I would always try this in a test environment first.

3
  • Certainly a valid point. This actually did come up in discussions. I'm not sure how well we'll be able to create a test environment to mimic this. But it's definitely worth exploring more. Jul 14, 2011 at 12:05
  • Our authentication is defaulting to NTLM. We are looking to default to Kerberos. Leaving the current connections as NTLM is OK. Another note: Most of our current SQL authentication is via SQL and not through AD. So, my assumption is that our main systems will not have a problem. Currently my main concern is SQL to SQL (and custom calling apps or Access Databases). Jul 14, 2011 at 12:16
  • You likely have this query already: select session_id, net_transport, protocol_type, auth_scheme, client_net_address from sys.dm_exec_connections where session_id = @@SPID Useful in trouble-shooting authentication issues over linked servers.
    – jl.
    Jul 14, 2011 at 19:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .