If your DBA is still adding Windows logins to your database servers then they are doing it wrong.

Using logins (versus Windows groups) is an inefficient method that hasn’t been considered a favorable practice for almost ten years. Oh…sure…it works. I won’t argue that point. But if you are administering hundreds of database servers and you are using logins instead of groups then you are making your environment more complex than it needs to be. When shops exploded with exponential growth in the past decade Microsoft recognized this by publishing guidelines around security best practices that reflect the preference for using groups. Here’s one from 2005 that states simply at the top:

“Because it is inefficient to maintain user accounts directly, assigning permissions on a user basis should be the exception.”

Exception. As in “not the norm”. And say what you want about SQL 2000, but even they knew that using groups was the way to a simpler life.

Here are three reasons why you should be using Windows groups.

Audit compliance

Since those best practices guidelines were published there has been an ever tightening of a grip on systems with regards to security and audits. Most companies that have to be in compliance with government legislation of some type will prefer to use Windows groups to access there database servers. Why? Three words: separation of duties.

The DBA should not be the person that is adding or removing individuals from groups within Active Directory. Those actions should be handled by a security team, and only after being given an approval by the IT custodian (or manager) responsible for the application (also, not the DBA). In other words, security in your company should have two parts. One part is handled by the DBA who, working with the database developers, creates the necessary roles, schemas, and Windows group logins on the database instance. The other part is the security team who controls the people added (or removed) from the Active Directory group(s) so that the users can access the applications as needed.

That is the separation: the DBA doesn’t control the users in the groups, just the structure the groups are allowed to access. Likewise the security team has no say in how the structure inside the database instance is built, they just fulfill the requests for access after the IT custodian has approved.

Reduce your administrative overhead

Besides the likely compliance issues you will face, if you are adding in Windows logins by hand your actions will not be able to scale to hundreds of instances. I’m certain that someone will leave a comment telling me that Powershell can get the job done with just a few lines of code. This would be where I remind people that automation is a wonderful way to make mistakes faster than ever before.

Let’s consider the case of a developer who needs different levels of access for development, test, QA, and production servers. That would mean you need to keep four copies of your scripts for each environment, and server, and person. That is a lot of scripts to maintain and troubleshoot. I can’t even imagine trying to add or modify those scripts as needed.

Even with just a handful of servers the idea of trying to maintain the correct permissions on a per-user level is more overhead than I would want. Every time a new person joins the company I would need to recreate all the permissions necessary for that person to access the databases they need. And the minute a person gets an ‘access denied’ error message returned it would be in my lap to figure out what was missed.

I can’t imagine why anyone would prefer to spend their time making things more difficult than they need to be. With Windows groups your could have all the permissions, roles, and groups defined in advance and then the security team (remember them?) could add and remove users as needed.

Less mess to clean up afterwards

One area I see customers and clients struggle with centers around the removal of logins after a person has left the company or even changed jobs within the company. When there is no defined removal process the end result is a glut of logins defined on an instance of SQL Server and most DBAs have no idea who should stay or who should go.

When companies have a defined access process that is tied to Windows groups it helps to avoid the issue of having logins lingering around for months and possibly years. We’re talking about one step versus hundreds of steps. Which would you prefer?

If you think not having separation of duties would make an auditor have cause for concern just sit across from the table and look them in the eye and say “those logins have been there for years, we rarely go back to remove them, we wouldn’t know which ones are no longer valid”. Good times.

Exceptions are not the rule

There are always going to be exceptions to using Windows groups. And for those exceptions you will have the extra overhead, you will need a defined cleanup process, and you will likely need to file for an audit exception. But they are exceptions, not the rule. Exceptions always introduce complexity into your environment. Unless you enjoy having an environment more complex than necessary, unless you enjoy having failed audits, you should start using Windows groups as your standard.

If you only have a handful of servers, and your shop doesn’t need to comply with audit guidelines, then you can get away with continuing to use Windows logins versus groups. But at some point you will cross a threshold where the overhead for maintaining your environment outweighs the usefulness. And it is then, at the precise moment, when you will look back and say “crap, I should have listened.”

You’ll thank me then. And you’re welcome.

If I were you, I wouldn't dare interrupt him.

Big words and long sentences will likely not serve you well as a writer. When it comes to making presentations the same holds true: don’t ramble on hoping to find the words that will have everyone in the room thinking you are the smartest person to ever grace their presence.

I’ve learned a few things along the way. First: use short sentences when writing. Second, eliminate the “jelly” when writing and when speaking. Third, it’s hard to do those first two things when you are told to “write naturally, as if you were speaking” and you tend to ramble anyway like your whole life is one long run-on sentence. But I digress…

I came across the following two links recently and so I wanted to share them with you.

First we have a link to a memo written by David Ogilvy to his employees titled “How to Write” and it was a list of tips that included the following gems:

• Use short words, short sentences and short paragraphs.
• Never use jargon words like reconceptualize, demassification,attitudinally, judgmentally. They are hallmarks of a pretentious ass.
• If it is something important, get a colleague to improve it.
• If you want ACTION, don’t write. Go and tell the guy what you want.

This isn’t the first time I have heard suggestions about how writing should be kept to short sentences. The most notable reference example I have been told about came from Hemingway. I believe that he knew a thing or two about writing, especially the whole “write drunk, edit sober” part.

Second we have a link to an article about presentations, “In Presentations, Learn To Say Less”. This post ties well to the earlier reference I had to the jelly effect: focus on the important details when speaking to someone. Eliminate the jelly. The classic example is when you describe your company to someone and the first thing you say is “we were founded in 1986″. Nobody cares when you were founded. Nintendo was founded in 1889 but didn’t start making video games until the mid 1970′s and OMG nobody cares about any of that. They only want to know when the next game will be released so stop wasting their time!

The article has some nice points that I have been using when putting together my outlines like I am doing for TechEd at the moment:

• Work backwards. Start with the key points and fill in the details on how to get to the key points.
• Practice your presentation without slides. This will help with your delivery, especially with transitions.
• Imagine the questions that your audience may ask.

If you learn to write less it will also translate to your presentation style. This will help you be an effective communicator, someone who others will want to read more frequently, or attend your presentations more often.

Last week I published two posts that had people wondering why I was so anti-Oracle. I’m not anti-Oracle. I am, however, against poor “research” that ends up in marketing materials. And I also believe that Oracle needs to shift their focus a bit in the near future otherwise it may find itself left behind by a growing market segment that looks for service providers (and I don’t see Oracle providing those same service for the same price as others currently).

So when I was reading this over the weekend (Microsoft’s Biggest Miss) it got me thinking about how others can view Microsoft in the same way that I viewed Oracle’s focus. The author here feels that Microsoft made a huge miss by not trying to shove Office onto every device. I don’t agree. I believe that Microsoft simply decided that their long-term future wasn’t going to be on client software and devices.

Instead they are betting on (1) entertainment and (2) cloud services.

Years ago Microsoft started pushing money into Xbox. They have done a great job getting into the entertainment markets. The Xbox is not just video games, you can stream movies with Netflix (while they are still alive, but that is a different blog post), you can watch sports through the ESPN widget, you can do so many things with your Xbox these days. Does Oracle have anything similar to this? Are they making a push into the gaming and media markets? If so, let me know, because I don’t see anything. And those markets are cash cows, forever. Even Nintendo is still alive after almost 40 years of switching to making toys in order to survive.

As for the author’s point about Office I would remind them that Office is being moved to Office365, which is a cloud based service. Microsoft doesn’t want you to stop using Office, they just want you to be able to use it in the cloud. So, if you were Microsoft a few years ago, would you have spent the money on building standalone apps for other companies devices or would you have rather spent the money on building the Office365 service first? Microsoft made it clear they were going “all-in” to the cloud, and every step they have been taking has been in that direction. Now, has Oracle been doing those same things? I only recently heard about Oracle looking to the cloud, almost three or four years after everyone else. I still don’t know what services they provide there, if you do please leave a comment as I would be interested in seeing the solutions they offer.

Did Microsoft miss by not putting Office on every device possible? You could argue that point, sure.

But I would say that Microsoft was aiming for a much bigger target.

Eventually everything will come to and end. For some the end comes surprisingly quickly (see Brothers, Lehman), for others the end comes a bit more slowly (see Oldsmobile) but the end comes. It always does.

I was reading an article today where the author suggests that Oracle may be doomed. I have no doubt they are doomed. The question is: how long do they have?

A few things from that article stand out to me. First is that six years ago Oracle tried to buy their way into everything possible and yet they completely missed the mark when it came to software services (platform as a service, or software as a service). Instead of spending their money on building their own services to be used by the masses they focused on technologies that would be bought by large corporations (Peoplesoft, Siebel). But what becomes of those contracts and maintenance fees when the large corporations decide that they don’t need to spend money on a CRM when it would be easier to use Salesforce?

I suspect this is one of the reasons that Larry Ellison recently called Salesforce the “roach motel” of cloud services. I’m not sure where Larry has been hanging out, but every cloud service is a roach motel. I’m in bed with Google, Apple, Microsoft, Salesforce, and even Dropbox. Each of them is a modern version of a public utility company. And guess which company isn’t on that list?

Oracle.

I think Oracle is doomed if it keeps doing business in the same way. But Ellison didn’t get to where he is by not being able to adapt and overcome. I’m sure he sees that he is behind and made some mistakes. Same as Microsoft not embracing open source earlier than it did. I am also sure that Ellison will figure out a way to get caught up in the utility game.

If not, then he will just sail away on one of his yachts.

This is why Oracle costs so much more than SQL Server.

Wanted to do a quick follow-up from my post earlier this week. If you recall, I mentioned how the Books Online entry for managing the suspect_pages table inside of the MSDB database was slightly misleading. I decided to use this as an opportunity to show you how easy it is to submit feedback to Microsoft about their products by using Microsoft Connect.

I’m not sure how well know Connect is for most people. I know that I am often asked the question “how do you provide feedback to Microsoft” and I usually answer “I email them”. That doesn’t work for most people who don’t have access to my email contacts (and this, despite my using Facebook, Twitter, Foursquare, and Instagram) so that’s when I say to use Connect and most folks stare at me and wonder why they need Kinect and Xbox in order to submit a simple request.

You don’t. Yes, I know the names are the same. But they are spelled differently. One of them makes you more hip than the other. I’ll let you decide which is which.

Anyway, here is the video, in all it’s glory. Watch me type into a text box.

Yep, it was that easy. I would urge you to use Connect early and often, especially with SQL 2012 coming any day now.

Notice they don't list "facts" anywhere?

Last year I wrote a book review about The Cult of the Amateur: How Today’s Internet is Killing Our Culture. The short of it is this: there is a shortage of fact checkers. And no, having facts checked by a community of users (AKA: Wikipedia) doesn’t work because those are the same amateurs that are running all the blogs that are passing around Miss Information like she was a bong in a room full of Libertarians. I once had a person tell me that they trust a Wikipedia entry on transaction logs more than a blog post from some guy named Paul Randal (blog | @PaulRandal), and I couldn’t believe what I heard. That’s like saying your teacher in high school knew more about The Great Gatsby than F. Scott Fitzgerald because she participated in a book club a few years ago.

The other day I found an interesting article on an Oracle blog. Yes, I read Oracle blogs, mostly for the humor. The article was comparing Oracle 11g to SQL Server 2008R2. You need to register if you want to access or download the PDF…or you can save yourself the hassle of giving Oracle your contact information and download it for yourself right now.

Go ahead and read it. I can wait.

That PDF is pure comedic gold. At least I am hoping that they were looking for something funny to be produced. If they meant for this to be a serious comparison then they fell short of the mark. If I had submitted research like this as part of my work in graduate school I would have been asked to leave the program. And to be fair not all of their statements are lies. We all know that SQL 2008 won’t run on Linux, for example. And therefore the cost of SQL Server is more than just SQL itself. But instead of sticking to the facts they decided to pick up that bong and get to testing.

Let’s look at some of the highlights. I present for your enjoyment Table 6:

I know what you are thinking. You are thinking “how the hell does it take 17 steps to create a table inside of SSMS”? That’s a great question. Let me help you understand it a bit more by showing you Task 6:

There, I hope that clears things up for you. What’s that? You dare to question the Oracle? I’m guessing you have many of the same questions that I have, such as:

• How does “Expand database – comptst, right click tables, select New Table” count as zero steps?
• Why did zero steps for Oracle take one second to complete?
• Why don’t they tell me the tables they are trying to create? Why not show me the DDL?
• Why are we comparing the GUI tools for two different platforms? That’s like comparing apples to oranges to pears to a bottle of wine and saying “wow, things sure taste different”.
• I thought Oracle DBAs didn’t use the GUI? So where did they find people to perform these tasks?
• What is the O/S in use for each of these tests?
• Doesn’t Oracle use nHibernate to generate all their statements? (OK, that’s not fair…to anyone)

To be fair, I understand that we are talking about marketing here. That is part of the problem for me. When people see this they say “that’s just marketing, which is always full of lies”. Well, I am in marketing, and I wouldn’t ever allow something like this to be published. But the truth is that other people don’t have the same moral compass as I do. Marketing materials such as this cast a bad light on all of us.

Competitive analysis documents are wonderful things for people to digest when they need to make a decision. But documents such as this have little in the way of actual facts. It makes me wonder who their target market is, because most DBAs I know have half a brain and would see right through something like this. My guess is this is meant for people with less than half a brain.

Don’t believe me about the half a brain part? May I submit to evidence Table 13:

Yes, that’s right. Oracle backups take less time, especially when you schedule them to be run later and don’t record the amount of time they take to run as part of your “facts” and also don’t tell me about the hardware and network configurations used in your testing. But hey, why bother with such details at this point?

I could go on dissecting this document, one sentence at a time, but I would rather you judge for yourself at this point. Also, don’t think Oracle only does this against SQL Server. No, they like to go after IBM and DB2 as well.

Enjoy the laugh today.

This week I had to take a step back and reflect on some things in my life. Some personal, some career oriented. I think it is good to spend the time reflecting on where you are, where you are heading, and where you want to be.

This time around I did something different: I watched myself give a talk…

I don’t normally watch myself speak. I can’t stand it. Honestly, I don’t know why anyone would ever come to listen to me talk. But I watched my Someday talk because I needed a reminder. I needed to stop for a moment and reflect on everything. Where I was, where I am, and where I want to be heading. I needed to remind myself about all the somedays that have already happened, and the ones that will never happen…and the ones that will happen.

I strongly believe that “you get what you give”. To me that is how the Universe works. Every now and then I think we all need to be reminded of that.

You never see the termites, you only see the damage they have done. And by then it is often too late.

Same with corruption inside of your database. Often time most folks have no idea there is any issue until it is too late.

Wouldn’t it be nice if there was a quick and easy way to determine if your database was corrupted?

Turns out there are some quick and easy tools for SQL Server but they are buried so deep inside you are likely to never even know they exist. Just like termites under your doorstep, or unicorn bacon.

These tools are the policies that ship with SQL Server, but are not installed by default. They are on your servers right now, doing nothing, except waiting for you to discover them. The one I am going to show you today is named ’Database Page Status’. It relies on a couple of things. First, that your databases have the page verify set to CHECKSUM. Second, that a corruption has happened and an entry has been written to the suspect_pages table.

I made a video to show you how entries get written to the suspect_pages table, how they get removed (or how Microsoft believes they get removed), and how to find those hidden policies.

If you aren’t the type that enjoys using policies then you could use a different method such as Powershell in order to check all of your instances for corruption. The key is to build your process to check the msdb..suspect_pages table.

But you should do something. Before it is too late.

It’s the night before Valentine’s Day and I know what you are thinking: “What would Tim Berners-Lee be doing right about now?”

I’ll tell you what he is doing. He is linking data. After all, that is what drove him to create HTML over 20 years ago. No, he didn’t invent the web. He wasn’t the first to dream up the idea of linking together documents and information between computers and systems.

But what he does do is to see the potential in things. And for the past few years he has been seeing the potential in connecting open data sources from around the web.

His ultimate goal is simple enough: to connect all data being created, everywhere, in real-time.

Piece of cake.

Big data is not new. It is not a passing fancy. Linked data  is, quite simply, the Egg McMuffin of future opportunities.

If you are planning on attending TechEd this year then you will have a chance to see myself and Denny Cherry (blog | @mrdenny) deliver a precon seminar. The title is “Microsoft SQL Server Performance Tuning and Optimization” and we are very excited to have this opportunity. And apparently Microsoft is excited to have us as well, because they are also sending the two of us to Amsterdam to do a repeat performance two weeks later for TechEd Europe.

Denny and I have been working on the precon now for a couple of weeks. It’s tough since we both have full time jobs and live on opposite ends of the country, but we manage to meet at least once a week over Skype to discuss the session. Here are just a few of the performance tuning items we are planning to discuss:

• Table Partitioning
• Filtered Indexes
• Columnstore

In addition to those items, we are also going to discuss how you can implement AlwaysOn read only replicas to help scale your system for performance as well as walk you through some general troubleshooting techniques with regarding to execution plans.

The last registration update had our precon in the lead for attendees, in both countries. We’d like to keep that trend going.

Go and get yourself registered for Orlando, Amsterdam, or both!