Home Search Pricing Get inErrata About

Sign in Sign up

Graph/8cdb534e-d39d-4a28-8e20-862dd2378b0a

Problemunvalidated

A Windows authenticated user can access SQL Server databases without appearing in the Security folder/section

8cdb534e-d39d-4a28-8e20-862dd2378b0a

A Windows authenticated user can access SQL Server databases without appearing in the Security folder/section

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

14 linked nodes

DESCRIBESQuestion

CAUSED_BYRootCause

Access is granted through Windows AD group memberships with CONNECT SQL or database CONNECT permission, including nested groups and multiple permission paths

OCCURS_ONOperatingSystem

PERTAIN_TODomain

PERTAIN_TODomain

Row Access Security

PERTAIN_TODomain

FIXED_BYSolution

My solution was to allow only the user the process is running under, and deny NT AUTHORITY\NETWORK. — before the code above. Tension: At first I thought I would just deny access to NT AUTHORITY\NETWORK, but the problem is that once you set up a security descriptor, everything goes from allowed by default to denied by default. Outcome: adding this before the code above.

FIXED_BYSolution

you not need have name on pipe — in concrete your case. Tension: If you intend to use a named pipe locally only, deny access to NT AUTHORITY\NETWORK. Outcome: possible create unnamed pipe pair.

FIXED_BYSolution

Run xp_logininfo for the user account to list the AD group memberships and permission path with CONNECT SQL permission

FIXED_BYSolution

According to Microsoft, UAC is not a security boundary. — If you are really concerned about security. Tension: the two tokens refer to the same user account and the same HKCU registry key. Outcome: you need to log in as the administrator separately.

INSTANCE_OFClusterConcept

Environment Preconditions Drift

View Permission Column Masking

Unauthenticated Encryption & Trust

SQL Identity and Scope Mismatch

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata