Sql-server – Disabling protocols using SQL Server Configuration Manager or ENDPOINTs

Networksql server

Besides SQL Server Configuration Manager, it's possible to disable access to specific SQL Server protocols by disabling the default ENDPOINTs, but what's the difference between the two options?

Are there security concerns regarding disabling one and not the other? (Should I disable both?)

Best Answer

If you disable the endpoint another endpoint of that connection type could be created. If you disable the protocol in the config manager no endpoints for that connection type will ever work.

There's no security issue as normal authentication is required for all connection types.

Related Solutions

Sql-server – How to change SQL sever configuration manager settings using TSQL

Most settings that can't be done via sp_configure are registry based

So, you can use xp_instance_regread etc to change them. You'll have to find a list of registry keys yourself sorry but most are under HKLM\Software\Microsoft\Microsoft SQL Server

One examples , protocols is under

...
...(instancename)\MSSQLServer\SuperSocketNetLib\Tcp
...(instancename)\MSSQLServer\SuperSocketNetLib\Sm
...

and each of these has an Enabled value

One important note: you can stop SQL Server from xp_cmdshell or using SHUTDOWN but not start it of course...

SQL Server Security – Reasons to Prefer Windows Authentication Over SQL Server Authentication

An example, separation of duties

On a web server, the password for the service account is only known by one team. It isn't required to lie around in web.config or source control.

One team sets up the IIS App Pool (password is known here)
One team deploys code
One team manages the SQL Server Instance

If you want to pass an audit where PCI or SoX is involved, then you need to have this

Best Answer

Related Solutions

Sql-server – How to change SQL sever configuration manager settings using TSQL

SQL Server Security – Reasons to Prefer Windows Authentication Over SQL Server Authentication

Related Question