SQL and/or AD Security to Query AD Database?

W

wildman

On my new test AD server I can query the AD from SQL server when
logged in with integrated security logged in as the box administrator.
However, when on my client which is on the production domain where I
don't have Administrator rights and becuase my test AD is on a
different Domain, I'm having to log into the DB using SQL
authentication.

the below script works on the server when Administrator

select * from openquery
(
DEVPLAYADSI,'SELECT samaccountname
FROM ''LDAP://dc=xxxxxxxxx,dc=zzzzzz''
WHERE objectCategory = ''Person'' AND objectClass = ''user''
')

But gives me this error when loggined in SA remotely:

Msg 7399, Level 16, State 1, Line 1
The OLE DB provider "ADsDSOObject" for linked server "DEVPLAYADSI"
reported an error. The provider indicates that the user did not have
the permission to perform the operation.
Msg 7321, Level 16, State 2, Line 1
An error occurred while preparing the query "SELECT samaccountname
FROM 'LDAP://dc=xxxxxxxxxxxx,dc=yyyyyyyyyyy'
WHERE objectCategory = 'Person' AND objectClass = 'user'
" for execution against OLE DB provider "ADsDSOObject" for linked
server "DEVPLAYADSI".


I guess my question is.. what do I need to do or create in my Test AD
so that a particular SQL user can query it? Will a domain account be
requred and then authentication into that account?

thanks for any help or information.
 
P

Paul Bergson [MVP-DS]

You will need a domain account if you are going to make a call against AD
(LDAP). The SA account is a local machine account and has no rights into
AD. Most basic AD users can do reads against AD for basic information.

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top