System Admin

Sql Server user with specific Privileges

9-Apr-12 9:02

I thought I'd removed all those references. Blush | :O

I'm quite impressed by the amount of information you were able to glean. FYI, I don't control the SMTP server - webhost4life.com does that. Perhaps it's time for another move, painful as the last one was.

Will Rogers never met me.

Rishi Shinde28-Mar-12 0:03

Rishi Shinde

28-Mar-12 0:03

Can I create a new sql server user who can only view(read only) a specific view in my database. I don't want to allow this user to see/read/write anything else in database.

Re: Sql Server user with specific Privileges

thatraja4-Oct-13 19:49

thatraja

4-Oct-13 19:49

Creating a SQL Server user with permission to read one view and nothing else[^]

thatraja

FREE Code Conversion VB6 ASP VB.NET C# ASP.NET C++ JAVA PHP DELPHI ColdFusion
HTML Marquee & its alternatives

Nobody remains a virgin, Life screws everyone Sigh | :sigh:

System Administration in the age of BYOD and consumerization

quinet16-Mar-12 6:48

quinet

16-Mar-12 6:48

I am coming from the business side rather than from the IT side, but I have been asked to solve a business problem that I think is totally common nowadays, and I hope you can help me with some system admin solutions.

I need to know if my idea will work and it would be very helpful if you could point out some problems areas that I need to consider.

We are a large international organization with a Microsoft infrastructure and about 200 staff who travel frequently. They typically use laptops we provide, but also they want to use their own devices (Bring Your Own Device = BYOD) such as iPads, Macintosh laptops, smartphones, Android tablets, you name it.

What I would like to say to our staff is this:

"Your work computer will be a laptop that you can take home with you or take abroad on your travels.
When you receive this computer it will come with a set of standard software installed, including anti-virus software. Thereafter you have admin rights over this laptop, you are completely responsible for everything on this computer, including backups, just as if it were your personal property. When you leave our organization, you turn your computer in.

"You store your work on your own computer, so you are responsible for backups. If you finish something that should be shared with your colleagues, you upload it to our corporate intranet online, and you let people know it’s there.

"When you come to the office, you will be able to plug your laptop into a docking station with a large-screen monitor and a keyboard. You can log into our network on your office computer, but not on any personal device.

"If you want to access the Internet or printers with any device other than your office laptop you can do so wirelessly."

What do you experienced System Administrators think of this approach. I know our staff would love me for it because they have some big problems with the security of our network, because they can't BYOD, they can install personal software on their laptops, getting software updates is a big hassle with the IT department, etc.

Thanks in advance for your help!

- Thom

Re: System Administration in the age of BYOD and consumerization

Richard MacCutchan16-Mar-12 7:14

Richard MacCutchan

16-Mar-12 7:14

quinet wrote:
I know our staff would love me for it

And I suspect your IT department and company lawyers would hate you. IT security is a very serious business and in any corporate organisation it is important to keep good control in order to protect your financial and intellectual property. If you open up your corporate network so people can hook their own systems into it whenever they like, then you are likely to face some serious issues. However many promises people make and however many rules you ask them to follow, the system will be abused.

My advice, don't do it.

Unrequited desire is character building. OriginalGriff
I'm sitting here giving you a standing ovation - Len Goodman

Re: System Administration in the age of BYOD and consumerization

Michael Martin16-Mar-12 20:24

Re: System Administration in the age of BYOD and consumerization

16-Mar-12 20:24

Richard MacCutchan wrote:
And I suspect your IT department and company lawyers would hate you. IT security is a very serious business and in any corporate organisation it is important to keep good control in order to protect your financial and intellectual property. If you open up your corporate network so people can hook their own systems into it whenever they like, then you are likely to face some serious issues. However many promises people make and however many rules you ask them to follow, the system will be abused.

My advice, don't do it.

Depends on the network setup. At the customer site I work at, the wireless and office network are 2 distinct and separate connections to the Internet. When connected to the wireless there is no connectivity to the servers available unless you connect in via the VPN or have a Domain connected laptop that uses Direct Access to connect in from anywhere.

If the Wireless and Wired network are all running off the same Internet connection and internal network, then like you say, runaway.

Michael Martin
Australia

"I controlled my laughter and simple said "No,I am very busy,so I can't write any code for you". The moment they heard this all the smiling face turned into a sad looking face and one of them farted. So I had to leave the place as soon as possible."
- Mr.Prakash One Fine Saturday. 24/04/2004

SCraw285518-Mar-12 10:14

SCraw2855

18-Mar-12 10:14

quinet wrote:
"When you come to the office, you will be able to plug your laptop into a
docking station with a large-screen monitor and a keyboard. You can log into our
network on your office computer, but not on any personal device.

In addition to our desktops we employ this setup for our laptop users. This is becoming more common as the power and memory capabilities increasingly are cheaper.

quinet wrote:
"Your work computer will be a laptop that you can take home with you or take
abroad on your travels.
When you receive this computer it will come with a
set of standard software installed, including anti-virus software. Thereafter
you have admin rights over this laptop, you are completely responsible for
everything on this computer, including backups, just as if it were your personal
property. When you leave our organization, you turn your computer in.

Again this is a great idea, but I would advise using some form of encryption. Bitlocker works well, but it depends on what OS you're currently using. They're are other software based encryption programs to use w/leagcy OS'. This still can create an issue as the user almost never do backups or willingly run AV scans. As long as you're using Active Directory you could push out Forefront and do Bitlocker key recovery. They still download willy-nilly programs like RegReviver and what not, but this gives you a stance on giving them an ultimatim. Either you behave with it, or we'll just re-image it when you screw it up. This tends to stop a lot of the BS downloaders, but not all of them.

quinet wrote:
"If you want to access the Internet or printers with any device other than your
office laptop you can do so wirelessly."

We do this as well and it works very well, as it exists on an external network. This can present some issues too if you're in a building close to other businesses or the public I guess. We're fortunate to be "out-of-town", but I think this would still be an answer for the BYOD'ers.

Something worth reading, albeit it's invincible!

Remote Desktop Connection

Roger Wright10-Mar-12 18:58

10-Mar-12 18:58

I just tried using Remote Desktop Connection today, accessing important apps on my desktop from my laptop, and it works great. But that was between rooms, using my home workgroup and the desktop computer name as the target, connecting over the wireless LAN. Now I want to go to the next level, and do the same over the Internet. The MS instruction fall a little short of covering that configuration. Here's my setup:

Internet -> cable modem/router -> Cisco/Linksys E4200 wireless router -> Wired connection to desktop, wireless to laptop.

The only routable IP address in the lot is the WAN address on the E4200, which is bridged from the cable modem. It's dynamic, and that could be a problem, but it wouldn't be too difficult to write a service on my website to allow me to look up the current IP address anytime I'm travelling. It hasn't changed in a couple of years, so that's not an immediate concern. What is a concern is that I don't know how to configure the laptop to connect to the home IP address, nor what ports and services I need to enable on the router to move RDC traffic from the router to the desktop, and back to the laptop in my hotel 300 miles away.

Can someone point me to the information I need to accomplish this?

Will Rogers never met me.

Bernhard Hiller11-Mar-12 21:38

Bernhard Hiller

11-Mar-12 21:38

Services like dyndns.org allow you to get your IP address from a name, thus you can do a ping your-computer-name.dyndns.org.
To get from the internet into your private home network, you must configure port forwarding on the router.

Roger Wright12-Mar-12 18:11

12-Mar-12 18:11

Thanks... I found a website with instructions. There wasn't a whole lot of info from MS about which ports and protocols to enable, but the site gives a few clues.

Will Rogers never met me.

Michael Martin14-Mar-12 0:24

14-Mar-12 0:24

Roger Wright wrote:
Thanks... I found a website with instructions. There wasn't a whole lot of info from MS about which ports and protocols to enable, but the site gives a few clues.

Roger, port 3389 is what you want for RDP but I would not want to open that up on my router and expose my network to the internet.

I'd seriously look at getting a little, low power, low heat output box, put a Linux Distro on it and SSH to the Linux Box (reasonably locked down) and SSH Tunnel through it to the Windows Boxen, Routers, Website stuff like your USB HDD.

I reckon you could easily work it out, but I could happily help you through, even give you a call on a landlne (if you have one) cause I can call you Yanks for free except for mobiles.

Jochen Arndt14-Mar-12 1:48

Jochen Arndt

14-Mar-12 1:48

Michael Martin wrote:
Roger, port 3389 is what you want for RDP but I would not want to open that up on my router and expose my network to the internet.

My 5 to point this out.

Jörgen Andersson14-Mar-12 1:56

Jörgen Andersson

14-Mar-12 1:56

Yesterday I would probably have pointed out that RDP is one of the safest protocols around. And that it probably isn't a safety problem to consider.
But today I think I'll pass.[^]

Light moves faster than sound. That is why some people appear bright, until you hear them speak.
List of common misconceptions

Roger Wright14-Mar-12 16:15

14-Mar-12 16:15

Quite right, Michael, but I just had to try it. I don't have the time to set up a Linux box, but I might one day.
A reasonably safe option is to set up a VPN connection to use when travelling, and Win7 supposedly supports that. But following the step-by-step instructions presented in Help simply doesn't work. I have no clue why, since Microsoft won't tell you what needs doing, but insists on providing a friendly, if retarded, "wizard" to do everything wrong for you.

Will Rogers never met me.

Michael Martin14-Mar-12 21:07

14-Mar-12 21:07

Roger Wright wrote:
I don't have the time to set up a Linux box, but I might one day

If your willing to use CentOS (Red Hat Enterprise Linux with the copyright stuff pulled out, but built from the same source) I can send you a Word document on how to set it up exactly as I have. The joy of SSH is it is completely encrypted end to end.

Roger Wright wrote:
A reasonably safe option is to set up a VPN connection to use when travelling,
and Win7 supposedly supports that. But following the step-by-step instructions
presented in Help simply doesn't work. I have no clue why, since Microsoft won't
tell you what needs doing, but insists on providing a friendly, if retarded,
"wizard" to do everything wrong for you.

The VPN Connection is easy to setup on Windows 7 (has been since XP) but do you have the VPN to connect to? Does your Router have a VPN built into it and is it activated? Otherwise you will need one running on your Windows 2008 R2 box and I'm not sure if one is built in or if it needs to be 3rd party.

Roger Wright15-Mar-12 6:17

15-Mar-12 6:17

According to the "documentation" provided by Win7 Help, a separate server shouldn't be required. One little wizard configures the host machine, the other does the remote. My router doesn't have a VPN server in it, but I've enabled VPN passthrough to let the little buggers through. On making the connection, the authentication works - at least it completes without announcing any errors - then it proceeds to invoke a couple of miniport drivers, then just times out. The most informative I've been able to get from it is that the host didn't respond. Very curious...

I do have an old PC that I could use for Linux, so if you'd like to send along your instructions I'll give them a look. Thanks, Michael! Big Grin | :-D

Will Rogers never met me.

Michael Martin16-Mar-12 20:25

16-Mar-12 20:25

I'll pull it out, clean it up and send it across in the next couple of days.

loctrice15-Mar-12 5:49

loctrice

15-Mar-12 5:49

Roger Wright wrote:
I have no clue why, since Microsoft won't tell you what needs doing, but insists on providing a friendly, if retarded, "wizard" to do everything wrong for you.

this is the funniest thing I have read today. This is the real way to complain about something!

If it moves, compile it

Richard Andrew x6414-Mar-12 17:01

Richard Andrew x64

14-Mar-12 17:01

Michael Martin wrote:
I'd seriously look at getting a little, low power, low heat output box, put a Linux Distro on it and SSH to the Linux Box (reasonably locked down) and SSH Tunnel through it to the Windows Boxen, Routers, Website stuff like your USB HDD.

Sounds like fodder for a good article!

The difficult we do right away...
...the impossible takes slightly longer.

Michael Martin14-Mar-12 21:08

14-Mar-12 21:08

Richard Andrew x64 wrote:
Sounds like fodder for a good article!

About 3 years ago I mentioned on here that I would do exactly that, including SAMBA for file sharing and such, still haven't pulled the finger out.