30/1/2019 Librería

Lab Answer Key: Module 9: Configuring Security for

SQL Server Agent
Es
te
do
cu
Lab: Configuring
me
nto
pe
Security for SQL Server Agent
rte
No lui ne
es sg ce
tán uille aL
pe rm uis
rm oc G
Exercise 1: Analyzing
as ea
@
uSecurity
ille
rm Problems in SQL Server Agent
itid orr
las gm oC
co ail orr
pia .co ea
ss m Lo
in pe
au ra.
tor
Task 1: Prepare the Lab Environment
iza
c ión
.

1. Ensure that the 20764C-MIA-DC and 20764C-MIA-SQL virtual machines are

Eboth
ste
running, and then log on to 20764C-MIA-SQL as
do
ADVENTUREWORKS\Student
cu
me
with the password Pa55w.rd.
nto
pe
rte
2. Ino ethe D:\Labfiles\Lab09\Starter
N l u isg ne
ce folder, right-click Setup.cmd, and then click
stá uil aL
np ler uis
Run aseradministrator.
mi
mo
co Gu
tid rre ille
as a @ rm
las gm oC
co a orr
3. In the User Account pia
ss
Control
il.c
om dialog
ea box, click Yes, and then wait for the script
Lo
in pe
to finish. au
tor
ra.
iza
ció
n.
4. Press any key to close the window.

Es
te
do
cu
m
Task 2: Examine
en
to the Job History for the Failing Job
pe
rte
No lui ne
es sg ce
tán uille aL
pe uis
rm
rm Guoc
1. Start Microsoft
itid
as
SQL
o rre Server
a@
ille
rm
Management Studio, and then connect to the MIA-
las gm oC
SQL Database cEngine op aiinstance
l.c orr by using Windows authentication.
ea
ias om Lo
sin pe
au ra.
tor
2. In Object Explorer, expand iza SQL Server Agent, expand Jobs, right-click
ció
n.
Generate Sales Log, and then click View History.

3. In the Log File Viewer - MIA-SQL window, expand the first job execution by
https://skillpipe.com/?lang=es-ES#/reader/book/24820548-a5cd-4cbe-80fd-0658d7f0f8c4 1/5
30/1/2019 Librería

clicking the plus sign on a row in the right pane, and then scroll the window to
the right so that the Message column is visible. (The job is started on a
schedule, so one or more rows of job history might be visible.)

4. Notice that the failure message for the job step reads as follows:
Es
te
do
cu
en m
Non-SysAdmins
to
p have been denied permission to run DTS Execution
ert
Njob lui en
oe stepssg ec
without a proxy account. The step failed.
stá uil ea
np ler L uis
erm mo
co Gu
itid rre ille
as a@ rm
las gm oC
co ail orr
pia .co ea
5. Click Close. ss m Lo
in pe
au ra.
tor
iza
6. In Object Explorer, right-click ció Generate Sales Log, and then click Properties.
n.

7. In the Job Properties - Generate Sales Log window, notice that the owner of
the job is the PromoteApp09 login, and then click Cancel.
Es
te
do
cu
8. Leave mSQL
en Server Management Studio open for the next exercise. The job step
to
pe
is
N
failing
lu
because
rte
n the job is owned by a login who is not a member of the
oe isg ec
stá uil ea
sysadmin
np role.
ler
m Lu
is
erm oc Gu
itid orr ille
as ea rm
las @ oC
gm
co ail orr
pia .co ea
ss m Lo
in pe
. au ra
tor
Result: After completing this iexercise,
za you should have identified the cause of the
ció
job failure. n.

Exercise
Es
t
2: Configuring a Credential
ed
oc
um
en
to
pe
en rt
Task N1:o eCreate
lui a Credential
sg
u
ec
e
stá ille aL
np rm uis
erm oc Gu
itid orr ille
as ea rm
las @ o
Co gm
1. In Object Explorer,
co under
pi
ail MIA-SQL,
.c rre
a
expand Security, right-click Credentials,
as om Lo
in s pe
and then click New Credential.
au
t
ra.
ori
za
ció
n.
2. In the New Credential dialog box, in the Credential name box, type
ExtractUser.

https://skillpipe.com/?lang=es-ES#/reader/book/24820548-a5cd-4cbe-80fd-0658d7f0f8c4 2/5
30/1/2019 Librería

3. In the Identity box, click the ellipsis (…) button.

4. In the Select User or Group dialog box, click Locations.

5. In the Locations dialog box, click Entire Directory, and then click OK.

Es
6. Intethe
d Select User, Service Account, or Group dialog box, in the Enter the
oc
u
objectmname
en
to to select box, type Student, click Check Names, and then click
pe
rte
OK.
No lui
sg
ne
ce
es u aL
tán ille
pe uis
rm
rm oc
Gu
7. In the Newi o
tid Credential
r rea iwindow,
lle in the Password and Confirm password
as @ rm
las gm oC
boxes, type Pa55w.rd, co
pia
aiand
l.c
om
then
orr click OK.
ea
ss Lo
in pe
au ra.
tor
8. In Object Explorer, expand iza Credentials to verify that ExtractUser appears.
ció
n.

9. Leave SQL Server Management Studio open for the next exercise.

Es
te
do
cu
m
en completing this exercise, you should have created a credential that
Result: After to
pe
references rte
No luthe
is
ADVENTUREWORKS\Student
ne Windows account.
es guc ea
tán ille Lu
pe rm is
rm oc Gu
itid orr ille
as ea rm
las @ oC
gm
orr
Exercise 3: Configuring
pia
s
.coa Proxy
m
ea
L
Account co ail
sin op
au era
tor .
iza
ció
n.
Task 1: Create a Proxy Account

1. EIn
ste
Object Explorer, under SQL Server Agent, right-click Proxies, and then click
d
NewocProxy.
um
en
to
pe
rte
N l u ne
2. Ino ethe
stá
New isg Proxy
uil
ce Account window, on the General page, in the Proxy name
l erm aL
np uis
box, type erm ExtractProxy.
itid
oc
o rre
Gu
ille
as a@ rm
las gm oC
co ail orr
3. In the Credential iname p as . cbox,
om click
ea the ellipsis (…) button.
Lo
sin pe
au ra.
tor
iza
4. In the Select Credential dialog ció
n.
box, click Browse.

5. In the Browse for Objects dialog box, select ExtractUser, and then click OK.

https://skillpipe.com/?lang=es-ES#/reader/book/24820548-a5cd-4cbe-80fd-0658d7f0f8c4 3/5
30/1/2019 Librería

6. In the Select Credential dialog box, click OK.

7. In the New Proxy Account window, in the Active to the following

subsystems box, select SQL Server Integration Services Package.

8. On the Principals page, click Add.

Es
te
do
cu
9. In the mAdd
en Principal dialog box, verify that Principal type has the value SQL
to
pe
rte
Login,
No luselect
is nPromoteApp09,
ec and then click OK.
es gu ea
tán ille Lu
pe rm is
rm oc G
10. In the New orr Account
itid Proxy uil window, click OK.
a ea ler
m sl @ oC
as gm
orr
co ail
.co pia
ea
11. s
In Object Explorer, expand m Proxies, pe and then expand SSIS Package
sin Lo
au ra.
tor
Execution to verify that ExtractProxy
iza
ció appears.
n.

12. Leave SQL Server Management Studio open for the next exercise.

Es
te
do
cu
m
en completing this exercise, you should have created a proxy account
Result: After to
pe
that Niso suitable forrte correcting the problem with the SQL Server Agent job called
lui ne
es s gu ce
Generaten pSales
t á i l ler Log.a Lu
erm m oc is
orr Gu
itid ea ille
as @ rm
las gm oC
co ail orr
pia .co ea
op ss m L
Exercise 4: Configuring
au and Testing
to
era
.
the Security Context of the Job
in
riz
ac
ión
.

Task 1: Configure the Job to Use a Proxy Account

Es
te
1. do
In Object Explorer, under SQL Server Agent, under Jobs, right-click Generate
cu
m en
to
Sales Log, peand then click Properties.
r
No lui ten
sg ec
es u ea
tán Lu ille
2. In the pJob
erm Properties
rm
oc is - Generate Sales Log window, on the Steps page, click
G
itid orr uil
as ea ler
Edit. las @
gm
m oC
co ail orr
pia .co ea
ss m Lo
era in p
3. On the Job Step Properties
au
to - Execute. Package page, in the Run as box, click
riz
ció a
ExtractProxy, and then click nOK.
.

4. In the Job Properties - Generate Sales Log window, click OK.

https://skillpipe.com/?lang=es-ES#/reader/book/24820548-a5cd-4cbe-80fd-0658d7f0f8c4 4/5
30/1/2019 Librería

Task 2: Test the Configuration

1. ERight-click
ste
Generate Sales Log, and then click Start Job at Step.
do
cu
me
2. In the Start nto Jobs - MIA-SQL dialog box, make sure that the job ran
pe
rte
successfully,
N oe l uis ne then click Close.
and
g ce
stá uil aL
np ler uis
erm m oc
orr Gu
itid illeto D:\Labfiles\Lab09\Starter\SalesLog, and then
3. In File Explorer, as browse
ea
@ rm
las gm oC
co ail o
verify that sales_log.csv pia .co has rrbeenea generated.
ss m Lo
in pe
au ra.
tor
iza
4. Close File Explorer, and then ció close SQL Server Management Studio without
n.
saving any changes.

Es
te
d
Result: oAfter
cu
me completing this exercise, the Generate Sales Log SQL Server
nto
Agent job should pe be working correctly, and the sales_log.csv file should be
rte
No lui ne
generated
es
t
to s D:\Labfiles\Lab09\Starter\SalesLog
gu
i
ce
a
each time the job runs.
án lle Lu
pe rm is
rm oc Gu
itid orr ille
as ea rm
las @ oC
gm
co ail orr
pia .co ea
ss m Lo
in pe
au ra.
tor
iza
ció
n.

Es
te
do
cu
me
nto
pe
rte
No lui ne
es sg ce
tán u ille aL
pe rm uis
rm oc Gu
itid orr ille
as ea rm
las @ oC
gm
co ail orr
pia .co ea
ss m Lo
in pe
au ra.
tor
iza
ció
n.

https://skillpipe.com/?lang=es-ES#/reader/book/24820548-a5cd-4cbe-80fd-0658d7f0f8c4 5/5