We are going to enable Kerberos to allow double hop authentication between our SQL Servers. Our company is nearly 24 hours which leaves a very small window for server restarts. Is it possible to enable Kerberos without requiring a reboot of our Domain Controllers or our SQL servers?
1 Answer
Kerberos is already enabled, it's how active directory works, what I assume your talking about is enabling delegation from your web server(or other application server) to your SQL server, this does not require a reboot.
That said, as pboin mentioned, I would always try this in a test environment first.
-
Certainly a valid point. This actually did come up in discussions. I'm not sure how well we'll be able to create a test environment to mimic this. But it's definitely worth exploring more. Jul 14, 2011 at 12:05
-
Our authentication is defaulting to NTLM. We are looking to default to Kerberos. Leaving the current connections as NTLM is OK. Another note: Most of our current SQL authentication is via SQL and not through AD. So, my assumption is that our main systems will not have a problem. Currently my main concern is SQL to SQL (and custom calling apps or Access Databases). Jul 14, 2011 at 12:16
-
You likely have this query already: select session_id, net_transport, protocol_type, auth_scheme, client_net_address from sys.dm_exec_connections where session_id = @@SPID Useful in trouble-shooting authentication issues over linked servers.– jl.Jul 14, 2011 at 19:55