Gennady Vanin Геннадий Ванин's questions

Rob Farley in SQL Server Developer Edition versus SQL Server Standard/Enterprise excellently summarizes:

Developer Edition is just Enterprise Edition without the license to be used in a Production environment. Also, it doesn't need to be installed on a Server OS (ie, you can put it on Win7, Vista, XP).

Also, my experience shows that Developer Edition outperforms Enterprise Ed in the same equal conditions (on the same machine, etc.)

Why cannot MS SQL Server be used (or, even, installed) on workstation Windows (XP/7) in production?

I am interested in technical aspect of the issue.
Plz put licensing and ethical aspects outside of this thread (open your own if you feel up to

Coming from the questions, for ex., Sharepoint 2010 - “We did not find any results for” keyword which identified the problem (but not solution) with the help of Mike Hacker's blog Crawler Issue with SharePoint 2010 and Windows Server 2008 R2

The latter tells:

• "The one that was working was built on Windows Server 2008 and the problem farm was built on Windows Server 2008 R2. Since Windows Server 2008 R2 and Windows 7 are built on the same core code"
• "After several conversations with Microsoft it appears that the issue is related to security changes made in Windows Server 2008 R2 and Windows 7"

What are the security changes in Windows Server 2008 R2 (and Windows 7) in comparison with Windows Server 2008?

How is it that "Windows Server 2008 R2 and Windows 7 are built on the same core code" but Windows Server 2008 is built on a different one?
that is, workstation and server share the same core code but the different releases of the same Windows Server 2008 - not?

I've read a few article on AD-integrated dns zones, including an excellent DNS Stub Zones in Windows Server 2003, but I am still uncertain on grasping the whole picture:

1)

Why didn't AD (Active Directory)-integration provide possibility of secondary zones AD-integration in order to be replicated through AD (vs. why were stub zones were provided with AD-integration possibility)?

2)

Why did not MS provide synchroization for delegated zone records?

I.e there is no granularity and configurability in stub zones (stub zone contain all the NS records for a specified zone)

Added later: Stub zones are similar in functionality to delegation, but stub zones include necessarily references to all dns servers in the referenced domain while delegation not. Is delegation more granular or it unnecessarily requires more administration efforts?

3)

Why do we possibly need secondary zones at all?

if redundancy is provided by multi-master AD-integrated primary zones?

4)

Does multiple AD-integrated master domain controllers provide redundancy against failure of a computer with one of AD-integrated DCs? In other words, does each of domain controllers contain a replica of AD (and AD-integrated dns) databse?

5)

Can't a secondary zone (in case of primary zone computer failure) be copied and one of copy be promoted to primary zone?

6)

• "Also, while most DNS servers can be configured to prevent zone transfers to secondary zones from occurring, stub zones request only SOA, NS, and A records for name servers, all of which are provided without restriction by any name server since these records are essential for name resolution to function properly"
-

Does it mean that DNS servers cannot be configured to prevent transfers to stub zones?

Having been downvoted 4 times for answering in Has windows XP support multiple remote login session (RDP) at a time? that Windows XP supports multiple remote login sessions (the question did not mention RDP at the time of answering). I stayed confused and intrigued:

1. What are the cases/scenarios/examples when remote connections/sessions do not require logon (though as Anonymous user) in Windows?

2. Even if to speak about remote interactive logins, In everyday life I use multiple remote interactive logins to IIS (web) applications, shared folders (Windows Server Service), MS SQL Server, etc.

Are not those interactive logins which create login sessions?

What are the definitions of login/logon sessions?

What are definitions of login vs. logon?

MS licensing of multiple RDP sessions for non-MS products in Windows XP Pro

The purpose of my questions are to avoid misunderstanding in communication with colleagues and clients but not subverting MS licensing.

My workgroup Windows XP Pro SP3 permits (or establishes itself) a hundred of network sessions with workgroup computers, see the result of "net sessions" below [1]. NetBT (NetBIOS over TCP/IP) is disabled.

I tried to detect which service is responsible for it by disabling one service by one in services.msc, then disabling/enabling my NIC network connection, checking (by netstat -a and net view) after each disabling that sessions were being reestablished (after restarting network connection, the session list [2] is empty and then is filled up). See the list of services I disabled in [2].

After rebooting the local workgroup sessions stopped reappearing in the "net session" [1] and netstat list.

What is/are service(s) responsible for establishing sessions with workgrup computers?

Why did rebooting stopped recovering of sessions but disabling/enabling of NIC network connection NOT?!

Sure, I could have run "netstat -nb", showing executables involved in connection creation, but the names of system dll/exe do not tell me much. Anyway, what should I do - r-enable all services back and reboot computer just to see "netstat -nb" or what?

----------

[2] Disabled services:

• Acronis Scheduler Service
• Computer Browser
• Fast User Switching
• Human Interface Device Access
• Peer Name Resolution Protocol
• Peer Networking
• Peer Networking Group Authentication
• Peer Networking Identity Manager
• Print Spooler
• Remote Access Auto Connection Manager
• Remote Access Connection Manager
• Remote Desktop Help Session Manager
• RIP Listener
• Routing and Remote Access
• Secondary Logon
• TCP/IP NetBIOS Helper
• Universal Plug and Play Device Host

[1]

D:\Documents and Settings\Administrator>net sessions

Computer               User name            Client Type       Opens Idle time
------------------------------------------------------------------------------
\\10.204.27.14                              Windows 2000 2195     1 07:07:29
\\10.204.27.14                              Windows 2000 2195     1 04:52:29
\\10.204.27.14                              Windows 2000 2195     1 04:19:29
\\10.204.27.14                              Windows 2000 2195     1 06:16:29
\\10.204.39.50                              Windows 2000 2195     1 00:10:29
\\10.204.43.23                              Windows 2000 2195     1 05:37:29
\\10.204.43.23                              Windows 2000 2195     1 05:04:29
\\10.204.43.23                              Windows 2000 2195     1 00:04:29
\\10.204.43.23                              Windows 2000 2195     1 01:37:29
\\10.204.43.23                              Windows 2000 2195     1 04:28:29
\\10.204.43.23                              Windows 2000 2195     1 01:10:29
\\10.204.43.23                              Windows 2000 2195     1 01:07:29
\\10.204.43.23                              Windows 2000 2195     1 02:16:29
\\10.204.43.23                              Windows 2000 2195     1 03:55:29
\\10.204.43.23                              Windows 2000 2195     1 02:49:29
\\10.204.43.23                              Windows 2000 2195     1 03:22:29
\\10.204.45.102                             Windows 2000 2195     1 03:01:29
\\10.204.45.102                             Windows 2000 2195     1 03:31:29
\\10.204.52.121                             Windows 2000 2195     1 01:34:29
\\10.204.55.88                              Windows 2000 2195     1 00:25:29
\\10.204.56.25                              Windows 2000 2195     1 02:37:29
\\10.204.56.25                              Windows 2000 2195     1 04:19:29
\\10.204.56.25                              Windows 2000 2195     1 02:04:29
\\10.204.56.25                              Windows 2000 2195     1 04:52:29
\\10.204.56.25                              Windows 2000 2195     1 03:13:29
\\10.204.56.25                              Windows 2000 2195     1 01:25:29
\\10.204.56.25                              Windows 2000 2195     1 05:25:29
\\10.204.56.25                              Windows 2000 2195     1 06:31:29
\\10.204.56.25                              Windows 2000 2195     1 07:04:29
\\10.204.56.25                              Windows 2000 2195     1 06:55:29
\\10.204.56.25                              Windows 2000 2195     1 00:25:29
\\10.204.56.25                              Windows 2000 2195     1 03:46:29
\\10.204.57.105                             Windows 2000 2195     1 00:16:29
\\10.204.57.105                             Windows 2000 2195     1 00:10:29
\\10.204.57.105                             Windows 2000 2195     1 00:34:29
\\10.204.57.105                             Windows 2000 2195     1 00:04:29
\\10.204.57.105                             Windows 2000 2195     1 00:40:29
\\10.204.57.105                             Windows 2000 2195     1 00:01:29
\\10.204.57.105                             Windows 2000 2195     1 00:25:29
The command completed successfully.

Windows XP Pro SP3

• I can disable, for ex., RIP Listener in services.msc...

Or

• I can unistall it in ControlPanel --> Add Or Remove Programs --> Windows Components ---> Networking Services --> Rip Listener

One may think that 2) removes setup files from disk. Well, it is not. The files are still there, it is removed only from registry. Even more, I do not need to insert Windows Setup CD to install it again.

What are you doing - uninstalling or disabling?

And why?

As I understood the joined to Windows AD computers are always securely identified/authenticated before DC (using automatically changed computer accounts passwords).

Now, I read (in non-English article) that IPSec always should be configured in AD. Why is it? Suppose that AD is well secured from internet or even doesn't have internet connection in tight company environment.

When is IPSec "must" for AD?

BTW, why are the secure authentication of AD computers always needed? Can DC be configured for insecure authentication of computers (for ex., in small development/testing environment)?

----------

Update1:

Having this very secure, very flexible, very easy IPSec, how the hell to fall back to insecure AD computers?

Do I understand correctly that this secure authentication of AD computers makes impossible

• single-sign-on between workgroup users and AD user accounts
• RunAs and secondary logon with AD user account in workgroup Windows (and vice versa)

which is the pain in the ass for development or tiny companies infrastructures. This inflexibility does not make much sense (having IPSec)?

Having read in http://support.microsoft.com/kb/154501/EN-US/ (How to disable automatic machine account password changes):

"You have two separate installations of Windows NT or Windows 2000 on the same computer in a dual-boot configuration. In this case, the only way to share the same machine account between the two installations of Windows NT or Windows 2000 is to use the default machine account password that is created when you join the domain"

I have the following questions:

1. What is the process of sharing "the same machine account between the two installations of Windows"?
2. If to share account then why it cannot change password from non-default to a "normal" (automatically changed) one?

I am developer using on the same dual-bot Windows: one AD joined computer Windows (under domain user account) and another is workgroup (i.e. non-joined to domain) Windows.

It is XOR-ed, either one or another (of course) what is inconvenience. Is it possible to share AD machine account from workgroup Windows session?

Everybody tells that it is impossible> But why? Having read http://blogs.msdn.com/aaron_margosis/archive/2009/11/05/machine-sids-and-domain-sids.aspx (Machine SIDs and Domain SIDs) and other similar topics in this field, I cannot understand why it is impossible?

https://stackoverflow.com/questions/510170/the-difference-between-the-local-system-account-and-the-network-service-accou tells:

Local System : Completely trusted account, moreso than the administrator account. There is nothing on a single box that this account can not do and it has the right to access the network as the machine (this requires Active Directory and granting the machine account permissions to something)"

http://msdn.microsoft.com/en-us/library/aa274606(SQL.80).aspx (Preparing to install SQL Server 2000(64 bit) - Creating Windows Service Accounts) tells:

"The local system account does not require a password, does not have network access rights, and restricts your SQL Server installation from interacting with other servers."

http://msdn.microsoft.com/en-us/library/ms684190(v=VS.85).aspx (LocalSystem Account, Build date: 8/5/2010) tells:

"The LocalSystem account is a predefined local account used by the service control manager. This account is not recognized by the security subsystem, so you cannot specify its name in a call to the LookupAccountName function. It has extensive privileges on the local computer, and acts as the computer on the network. Its token includes the NT AUTHORITY\SYSTEM and BUILTIN\Administrators SIDs; these accounts have access to most system objects. The name of the account in all locales is .\LocalSystem. The name, LocalSystem or ComputerName\LocalSystem can also be used. This account does not have a password. If you specify the LocalSystem account in a call to the CreateService function, any password information you provide is ignored"

http://technet.microsoft.com/en-us/library/ms143504.aspx (Setting Up Windows Service Accounts) tells:

Local System is a very high-privileged built-in account. It has extensive privileges on the local system and acts as the computer on the network. > The actual name of the account is "NT AUTHORITY\SYSTEM".

Well-known security identifiers in Windows operating systems ( http://support.microsoft.com/kb/243330 ) does not have any SYSTEM at all (but only "LOCAL SYSTEM")

My Windows XP Pro SP3 (with MS SQL Server setup, developing machine in workgroup) does have SYSTEM but not LocalSystem or "Local System".

QUESTIONS:

Can somebody clear out this mess?

It is possible to burn hours after hours, day after day reading MS docs just to collect more and more contradictions and misunderstandings...

1) Has LocalSystem rights to access the network or not? What is the mechanism?

2) Are the SYSTEM and the LocalSystem (and the "Local System") synonyms?

Why they have been introduced?

What are the differences between SYSTEM and Local System

----------

Update1:

Hi, sysamin1138!

Your answers add even more confusion if to compare them to observed reality, for ex., to the fact that Fresh installed or workgroup Windows XP Pro SP3 has only SYSTEM (but not LocalSystem).

Sysadmin138 wrote:

• "Different security principles for similar problems, which allow a bit of granularity in your security design. One is local only, the other has domain visibility."

Does this phrase mean that LocalSystem is added upon joining computer to domain?

Should it be understood that SYSTEM is for "local"/internal and workgroup access (computer identification) and LocalSystem for identification of computer in domain?

----------

Update2: same workgroup Windows XP Pro SP3 if not specified otherwise

Hi, Sysadmin1138, In your Edit

"It's just that in that case SYSTEM and NT Authority/SYSTEM are equivalent in ability",

how are they (NT Authority/SYSTEM and SYSTEM) related to LocalSystem? Did not you err one of them with LocalSystem?

Greg Askew,

"Note that if you configure a service to logon as .\LocalSystem, it will still appear as logged on as NT AUTHORITY\SYSTEM in Process Explorer or System in Task Manager"

This is a little be closer. I cannot choose LocalSystem in either NTFS/share premissions, RunAs list. But in services.msc the service "SQL Server (MS SQL SERVER)" --> double-click or rc --> Properties ---> tab "Logo on as:" has radiobuttom "Local System account". This service then appears in Windows Task Manager as SYSTEM

Greg Askew and sysadmin1138,

"NT AUTHORITY" or any "xxx\" does not appear anywhere. All account names are single-labeled. Note it is Windows XP workgroup computer. Though I run an instance of ADAM (Active Directory Application Mode).

I guess "NT AUTHORITY" is from that famous "security subsystem" which is absent in workgroup(?) Would "NT Authority" appear if I join computer to a domain?

NTFS/share permission list has 2 columns:

• "Name(RDN)" colum having single-label account names
• "In Folder" column having either MyCompName (eg, for Administrator, Administrators, ASPNET, SQLServerReportServerUser$MyCompName$MSRS10_50.MSSQLSERVER, etc.) or blank (e.g., for ANONYMOUS LOGON, Authenticated Users, CREaTOR GROUP, CREAtOR OWNER, NETWORKING SERVICES,SYSTEM, etc.).

The former ones have also synonyms for coding as "MyCompName\xxxx" or ".\xxx" (i.e.

• SQLServerReportServerUser$MyCompName$MSRS10_50.MSSQLSERVER =
• = MyCompName\SQLServerReportServerUser$MyCompName$MSRS10_50.MSSQLSERVER
• = .\SQLServerReportServerUser$MyCompName$MSRS10_50.MSSQLSERVER)

Can you synchronize your answers in context of http://blogs.msdn.com/aaron_margosis/archive/2009/11/05/machine-sids-and-domain-sids.aspx (Machine SIDs and Domain SIDs)?

----------

Update3: same workgroup Windows XP Pro SP3 if not specified otherwise

Hi, Sysadmin1138,

And how to see edit-history? and dereference SID?

Breakthrough! cacls shows "NT Authority\SYSTEM"...

Though for services it is all vice versa: all services show under "Log On" tab

• the radiobutton "Local System account" which results in SYSTEM in WIndowsTaskManager and
• the "This account" radiobutton --> btn "Browse..." that doesn't show the SYSTEM account in the list

Sorry for your time, but I couldn't get yet to any LocalSystem in Windows XP! LocalSystem does not show up anywhere in XP! but the problem that all MS docs dwell only on LocalSystem...

BTW, http://support.microsoft.com/kb/120929 ("How the System account is used in Windows") tells that SYSTEM is for internal to computer logging of services, and surprise-surprise "APPLIES TO" all Windows from NT Workstation 3.1 to Windows Server 2003 except Windows XP(?!).

Is Windows XP some anomaly in Windows line?

----------

Update4: same workgroup Windows XP Pro SP3 if not specified otherwise

I couldn't detect any LocalSystem (only "local system" mentioned in text to radiobutton of services LogOn)in Windows XP though all MS docs usually dwell on LocalSystem only but not SYSTEM. I marked this question as answered having understood for me that Windows XP is anomaly/exception in Windows OS-es having some GUI usability bug and I should guess how a scenario would have appeared in other Windows (with the help of answer(s) here)

If it is not correct, please be free to prove/share another point of view

Update5: same workgroup Windows XP Pro SP3 if not specified otherwise

Venceremos!

I found "Local System" in Windows XP! It is shown in "Log On As" column in services.msc!

Huh, I completely confused by others editing my post... breaking all system of referencing and linking into a mess...

Bifurcating the question (1)

Can anybody share experience and/or links on running Samba Linux Active Directory Server, like in "Samba 4: Linux Active Directory Server", on Windows workstation (like XP Pro)?

What are pro and contra of using Cygwin vs. running Linux in virtual machine for this?

jscott wrote in question(1): "Windows, specifically its licensing philosophy, is quite antithetical to the ideals of the GPL".

I could not get: what are the problems of running GPL applications on Windows?

Besides, ComputerWorld tells us:

• "Bartlett said the Samba team now has a good relationship with Microsoft and the password bug was never in any of its documentation so "they never thought it existed". Microsoft has also provided a copy of its AD schema which can be worked around by the Samba team"

*

----------

Edit1 (concerning XP Eula):

I forked the issues of ethical use of Windows Xp as server to question Windows XP used as server

The (common) question:

• How can one access network share on workgroup computer?

usually has the (common) answer:

• One should add ("the same") local account with the same username and password on all interacting (accessing) computers

Don't all Windows have the common built-in users and groups accounts of Well-Known Security Identifiers?

Cannot these built-in accounts be used for this?

Edit1 (Added later) on domain context:

Let's say that I want to share files from workgroup computer.

Either to

(1) to workgroup computers.

or to

(2) to joined to domain computers.

Is there any difference between (1) and (2)?

If there is no difference, then it is better to avoid deviating the discussion/consideration to domain computers.

Edit2 (Added later) on security:

Workgroup computers lack security at large.

With adding of accounts or without.

I do not see any change in security additions from adding accounts.

So, the question is: WHY to add accounts?

Edit3 (Further Questions), 8/4/2010:

Ok, I simply do not have space in comments.

Hi, laurent-rpnet!

I did not quite understand "only one Domain acount for all machines in the Domain".

The question is about sharing files on workgroup computer and accessing them from workgroup computers (aka non-joined-to-domain computers which cannot be part of domain as soon as they are in workgroup).

1) Is it possible to share files in workgroup (aka non-joined-to-domain) computer with domain (or LDAP, or ADAM) account?

2) Is it possible to access shared with domain account permissions files from workgroup (non-joined-to-domain) computer (again, using domain account)?

I asked it earlier in other forums and I understood thу possibility as negative/impossible

Edit4, viii/6/2010:

It happened that I cannot mark more than 1 answer and I really do care more about my own understanding + practical conveniencies than stating to the world what is correct or wrong (answer and attitudes). That should ne simple for sysadmins, having access to resources (including domain administration), but I am developer, i.e. contaxt is workgroup (in order to fully administrate) + access to domain (in which I have NO access to administration).

Hi, laurent-rpnet!

I also understood your answer 2) to my Edit3 as possibility of file/folder sharing from workgroup computer to domain accounts by creating on workgroup computer the users coinciding by username+password with those of domain users.

Correct?

"A workgroup and domain should not be on the same network if it is then you have a problem. (Don't tell me any reson why a WG and DM should be on same network I don't care!)"

Why? What are the CONs and PROs?