<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Everyday SQL</title>
	<atom:link href="https://www.patrickkeisler.com/feed/" rel="self" type="application/rss+xml" />
	<link>https://www.patrickkeisler.com</link>
	<description></description>
	<lastBuildDate>Wed, 11 Dec 2024 13:37:56 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=5.8.13</generator>

<image>
	<url>/wp-content/uploads/2019/04/cropped-azuresqlsquaretransparent1-32x32.png</url>
	<title>Everyday SQL</title>
	<link>https://www.patrickkeisler.com</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>Trace Flag 3625 Follow Up</title>
		<link>http://www.patrickkeisler.com/2024/12/trace-flag-3625-follow-up/</link>
					<comments>http://www.patrickkeisler.com/2024/12/trace-flag-3625-follow-up/#comments</comments>
		
		<dc:creator><![CDATA[Patrick Keisler]]></dc:creator>
		<pubDate>Tue, 10 Dec 2024 11:00:00 +0000</pubDate>
				<category><![CDATA[Configuration]]></category>
		<category><![CDATA[Security]]></category>
		<guid isPermaLink="false">https://www.patrickkeisler.com/?p=4134</guid>

					<description><![CDATA[Several months ago, I discussed my customer&#8217;s intention to enable trace flag 3625. Since that time, we have observed an intriguing phenomenon when encountering a login failure. To demonstrate this, our initial step is to ensure we are capturing failed login attempts. In Server Properties, select the Security tab, click on Failed Logins Only, and then click OK. Next, we need to test the login failure. We can also verify the failure in the SQL Server error log. Now we need to enable Trace Flag 3625. Refer to my previous article for detailed instructions. We know that failed logins will&#46;&#46;&#46;]]></description>
		
					<wfw:commentRss>http://www.patrickkeisler.com/2024/12/trace-flag-3625-follow-up/feed/</wfw:commentRss>
			<slash:comments>1</slash:comments>
		
		
			</item>
		<item>
		<title>How to Convert FileTime to DateTime</title>
		<link>http://www.patrickkeisler.com/2024/11/how-to-convert-filetime-to-datetime/</link>
					<comments>http://www.patrickkeisler.com/2024/11/how-to-convert-filetime-to-datetime/#comments</comments>
		
		<dc:creator><![CDATA[Patrick Keisler]]></dc:creator>
		<pubDate>Tue, 05 Nov 2024 11:00:00 +0000</pubDate>
				<category><![CDATA[Audit]]></category>
		<category><![CDATA[PowerShell]]></category>
		<category><![CDATA[TSQL Code]]></category>
		<guid isPermaLink="false">https://www.patrickkeisler.com/?p=4102</guid>

					<description><![CDATA[One of my customers recently wanted to rename each of the SQL audit files will the datetime stamp of when it was created. I explained to them the filename already contains a datetime stamp. While it does not look like a typical timestamp, it is based on the Windows Filetime data structure that is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601 (UTC). Nonetheless, they still wanted a traditional datetime stamp in the file name. According to the documentation, the audit file naming convention is this: and if we use this file as an example:&#46;&#46;&#46;]]></description>
		
					<wfw:commentRss>http://www.patrickkeisler.com/2024/11/how-to-convert-filetime-to-datetime/feed/</wfw:commentRss>
			<slash:comments>1</slash:comments>
		
		
			</item>
		<item>
		<title>Convert SQL Audit Files to a CSV Using Read-SqlXEvent</title>
		<link>http://www.patrickkeisler.com/2024/10/convert-sql-audit-files-to-a-csv-using-read-sqlxevent/</link>
					<comments>http://www.patrickkeisler.com/2024/10/convert-sql-audit-files-to-a-csv-using-read-sqlxevent/#comments</comments>
		
		<dc:creator><![CDATA[Patrick Keisler]]></dc:creator>
		<pubDate>Tue, 15 Oct 2024 10:00:00 +0000</pubDate>
				<category><![CDATA[Audit]]></category>
		<category><![CDATA[PowerShell]]></category>
		<guid isPermaLink="false">https://www.patrickkeisler.com/?p=4081</guid>

					<description><![CDATA[SQL Server Audit is an efficient way to track and log events that occur within the database engine. For on-premises or IaaS environments, those audits can only be stored in a binary file, the Windows Application log, or the Windows Security log. Most customers I have worked with over the years store the audits in a binary file because of the limitations of the Windows Event logs. Reading the contents of an audit event file can be accomplished using either Management Studio or the T-SQL function, sys.fn_get_audit_file. However, sometimes a customer may want to use a third-party tool to read&#46;&#46;&#46;]]></description>
		
					<wfw:commentRss>http://www.patrickkeisler.com/2024/10/convert-sql-audit-files-to-a-csv-using-read-sqlxevent/feed/</wfw:commentRss>
			<slash:comments>1</slash:comments>
		
		
			</item>
		<item>
		<title>How to Test Trace Flag 3625</title>
		<link>http://www.patrickkeisler.com/2023/12/how-to-test-trace-flag-3625/</link>
					<comments>http://www.patrickkeisler.com/2023/12/how-to-test-trace-flag-3625/#comments</comments>
		
		<dc:creator><![CDATA[Patrick Keisler]]></dc:creator>
		<pubDate>Tue, 12 Dec 2023 11:00:00 +0000</pubDate>
				<category><![CDATA[Configuration]]></category>
		<category><![CDATA[Security]]></category>
		<guid isPermaLink="false">https://www.patrickkeisler.com/?p=4041</guid>

					<description><![CDATA[UPDATED Jan 4, 2024 &#8211; Several people had mentioned they could not get the example code to work. This was because I chose to overflow a text column which only outputs the detailed error messages for SQL Server 2017 and above. I have since updated the code to use a numeric value which has been verified to work on SQL Server 2012 through 2022. Recently, one of my customers considered enabling Trace Flag 3625 on one of their SQL Servers, but they wanted a way to quickly test its functionality beforehand. For those of you that are unfamiliar with that&#46;&#46;&#46;]]></description>
		
					<wfw:commentRss>http://www.patrickkeisler.com/2023/12/how-to-test-trace-flag-3625/feed/</wfw:commentRss>
			<slash:comments>5</slash:comments>
		
		
			</item>
		<item>
		<title>Get Certificate Details for SQL Encryption In-Transit Using PowerShell &#8211; UPDATED</title>
		<link>http://www.patrickkeisler.com/2023/11/get-certificate-details-for-sql-encryption-in-transit-using-powershell-updated/</link>
					<comments>http://www.patrickkeisler.com/2023/11/get-certificate-details-for-sql-encryption-in-transit-using-powershell-updated/#respond</comments>
		
		<dc:creator><![CDATA[Patrick Keisler]]></dc:creator>
		<pubDate>Tue, 14 Nov 2023 11:00:00 +0000</pubDate>
				<category><![CDATA[Configuration]]></category>
		<category><![CDATA[PowerShell]]></category>
		<category><![CDATA[Security]]></category>
		<guid isPermaLink="false">https://www.patrickkeisler.com/?p=4023</guid>

					<description><![CDATA[In a previous blog post, I showed you how to use PowerShell to retrieve the details of the certificate being used for encryption-in-transit, aka TLS encryption. I have received a lot of feedback about that script and one of the most common requests was how to run it remotely. I have finally modified the script to do just that. The previous version required you to run it locally on a server. It would return the certificate information for each SQL instance that it detected. The new version can be run remotely, but it will expect you to pass in a&#46;&#46;&#46;]]></description>
		
					<wfw:commentRss>http://www.patrickkeisler.com/2023/11/get-certificate-details-for-sql-encryption-in-transit-using-powershell-updated/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
		<item>
		<title>Create Service Principal Names Along with a Managed Service Account</title>
		<link>http://www.patrickkeisler.com/2022/11/create-service-principal-names-along-with-a-managed-service-account/</link>
					<comments>http://www.patrickkeisler.com/2022/11/create-service-principal-names-along-with-a-managed-service-account/#respond</comments>
		
		<dc:creator><![CDATA[Patrick Keisler]]></dc:creator>
		<pubDate>Tue, 01 Nov 2022 10:00:00 +0000</pubDate>
				<category><![CDATA[Managed Service Accounts]]></category>
		<guid isPermaLink="false">https://www.patrickkeisler.com/?p=3867</guid>

					<description><![CDATA[In a few previous articles, I have talked a lot about Managed Service Accounts (MSA) and Service Principal Names (SPN) and given examples of managing the separately. As a DBA prepping for a new SQL Server installation, you most likely already know the MSA account name(s) and what is needed to create the associated SPN, so why not create them at the same time? This example uses the PowerShell cmdlet New-ADServiceAccount to create both in the same command. The ServicePrincipalNames parameter can accept an array of strings, so just specify each SPN separated by a comma. We can even run&#46;&#46;&#46;]]></description>
		
					<wfw:commentRss>http://www.patrickkeisler.com/2022/11/create-service-principal-names-along-with-a-managed-service-account/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
		<item>
		<title>How to Logon Interactively with a Group Managed Service Account</title>
		<link>http://www.patrickkeisler.com/2022/03/how-to-logon-interactively-with-a-group-managed-service-account/</link>
					<comments>http://www.patrickkeisler.com/2022/03/how-to-logon-interactively-with-a-group-managed-service-account/#comments</comments>
		
		<dc:creator><![CDATA[Patrick Keisler]]></dc:creator>
		<pubDate>Tue, 15 Mar 2022 10:00:00 +0000</pubDate>
				<category><![CDATA[Internals]]></category>
		<category><![CDATA[Managed Service Accounts]]></category>
		<guid isPermaLink="false">https://www.patrickkeisler.com/?p=3601</guid>

					<description><![CDATA[Managed Service Accounts (MSA) are intended to run as a service and not to be used by an end user to logon interactively; however, there are some cases where it is necessary for troubleshooting. From the Start Menu, if you right click on the PowerShell icon, select More and then click on “Run as a different user”, it will pop up a credential box. Enter in the gMSA account name and click OK. You will immediately get an error. This is because Active Directly manages the account for you, so we have no way of knowing what the password is&#46;&#46;&#46;]]></description>
		
					<wfw:commentRss>http://www.patrickkeisler.com/2022/03/how-to-logon-interactively-with-a-group-managed-service-account/feed/</wfw:commentRss>
			<slash:comments>6</slash:comments>
		
		
			</item>
		<item>
		<title>Setup Resource-Based Kerberos Constrained Delegation for Group Managed Service Accounts</title>
		<link>http://www.patrickkeisler.com/2022/03/setup-resource-based-kerberos-constrained-delegation-for-group-managed-service-accounts/</link>
					<comments>http://www.patrickkeisler.com/2022/03/setup-resource-based-kerberos-constrained-delegation-for-group-managed-service-accounts/#respond</comments>
		
		<dc:creator><![CDATA[Patrick Keisler]]></dc:creator>
		<pubDate>Tue, 01 Mar 2022 11:00:00 +0000</pubDate>
				<category><![CDATA[Managed Service Accounts]]></category>
		<guid isPermaLink="false">https://www.patrickkeisler.com/?p=3577</guid>

					<description><![CDATA[In my previous post, I discussed how to setup Kerberos constrained delegation and a limitation of using that method. This post will discuss how we can used resource-based Kerberos constrained delegation to do the same thing. Resource-based KCD was introduced in Windows Server 2012, and is defined as… Windows Server 2012 and later gives service administrators the ability to configure constrained delegation for their service. This model is known as resource-based KCD. With this approach, the back-end service administrator can allow or deny specific front-end services from using KCD. Kerberos Constrained Delegation Overview &#124; Microsoft Docs Our environment will be&#46;&#46;&#46;]]></description>
		
					<wfw:commentRss>http://www.patrickkeisler.com/2022/03/setup-resource-based-kerberos-constrained-delegation-for-group-managed-service-accounts/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
		<item>
		<title>Is There a Limit to msDS-AllowedToDelegateTo</title>
		<link>http://www.patrickkeisler.com/2022/02/is-there-a-limit-to-msds-allowedtodelegateto/</link>
					<comments>http://www.patrickkeisler.com/2022/02/is-there-a-limit-to-msds-allowedtodelegateto/#respond</comments>
		
		<dc:creator><![CDATA[Patrick Keisler]]></dc:creator>
		<pubDate>Tue, 15 Feb 2022 11:00:00 +0000</pubDate>
				<category><![CDATA[Internals]]></category>
		<category><![CDATA[Managed Service Accounts]]></category>
		<guid isPermaLink="false">https://www.patrickkeisler.com/?p=3550</guid>

					<description><![CDATA[For those of you that need to setup Kerberos constrained delegation for Group Managed Service Accounts, you will likely get more familiar with msDS-AllowedToDelegateTo. This attribute stores a list of SPNs that are used to configure a service so that it can obtain tickets used for constrained delegation. In my previous post on setting up Kerberos constrained delegation, I walked you through how we used it to overcome the authenticaiton double hop issue. In that example, we needed to define which SQL Servers the PowerBI Report Server was able to delegate permisisons to. The command below demonstrates how we did&#46;&#46;&#46;]]></description>
		
					<wfw:commentRss>http://www.patrickkeisler.com/2022/02/is-there-a-limit-to-msds-allowedtodelegateto/feed/</wfw:commentRss>
			<slash:comments>0</slash:comments>
		
		
			</item>
		<item>
		<title>Setup Kerberos Constrained Delegation for Group Managed Service Accounts</title>
		<link>http://www.patrickkeisler.com/2022/02/setup-constrained-delegation-for-group-managed-service-accounts/</link>
					<comments>http://www.patrickkeisler.com/2022/02/setup-constrained-delegation-for-group-managed-service-accounts/#comments</comments>
		
		<dc:creator><![CDATA[Patrick Keisler]]></dc:creator>
		<pubDate>Tue, 01 Feb 2022 11:00:00 +0000</pubDate>
				<category><![CDATA[Managed Service Accounts]]></category>
		<guid isPermaLink="false">https://www.patrickkeisler.com/?p=3480</guid>

					<description><![CDATA[Kerberos delegation is not a new concept in Active Directory; however, setting it up for Group Managed Service Accounts (gMSA) can be a bit confusing. Unlike normal domain accounts, gMSAs do not have a GUI for configuring delegation. Those configuraitons will need to be handled through PowerShell. A common use for Kerberos delegation is to solve the authentication double hop. For example, a user accesses a report which is configured to use a remote data source. That&#8217;s one hop from the user&#8217;s workstation to the webserver and then a second hop from the webserver to the data source. Our environment&#46;&#46;&#46;]]></description>
		
					<wfw:commentRss>http://www.patrickkeisler.com/2022/02/setup-constrained-delegation-for-group-managed-service-accounts/feed/</wfw:commentRss>
			<slash:comments>4</slash:comments>
		
		
			</item>
	</channel>
</rss>
