Skip to content

Commit 96f878e

Browse files
HaiyingYuHaiyingYu
authored
Merge pull request #8637 from MicrosoftDocs/updatePSscript_pijocoder040225
AB#5317: SQL authentication: update Powershell script formatting
2 parents 269c210 + 562e58b commit 96f878e

File tree

1 file changed

+102
-75
lines changed

1 file changed

+102
-75
lines changed

‎support/sql/database-engine/connect/determine-the-authentication-type.md‎

Lines changed: 102 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -1,53 +1,59 @@
11
---
22
title: Determine the authentication type
33
description: This article explains about how to determine the type of authentication that's used when you connect to SQL Server.
4-
ms.date: 02/20/2024
4+
ms.date: 04/03/2025
55
ms.reviewer: jopilov, haiyingyu, prmadhes, v-jayaramanp
66
ms.custom: sap:Database Connectivity and Authentication
77
ms.topic: how-to
88
---
99

1010
# How to determine if the authentication type is Kerberos
1111

12-
This article provides a query to help you determine the type of authentication that's used when you connect to Microsoft SQL Server. Make sure that you run the query on a client computer, not on the SQL Server that you're testing. Otherwise the query returns `auth_scheme` as **NTLM** even if Kerberos is configured correctly. This occurs because of a per-service SID security hardening feature that was added in Windows 2008. This feature forces all local connections to use NTLM regardless of whether Kerberos is available.
13-
14-
```sql
15-
SELECT auth_scheme FROM sys.dm_exec_connections WHERE session_id=@@SPID
16-
```
12+
This article provides step-by-step instructions to help you determine the type of authentication that's used when you connect to Microsoft SQL Server. Make sure that you run the steps on a client computer, not on the server where the SQL Server instance you are testing is installed. Otherwise, the *auth_scheme* value in the output will always be *NTLM*, even if Kerberos is configured correctly. This occurs because of a per-service SID security hardening feature that was added in Windows 2008. This feature forces all local connections to use NTLM regardless of whether Kerberos is available.
1713

1814
## Use SQL Server Management Studio
1915

20-
Run the following query in SQL Server Management Studio:
16+
1. Open SQL Server Management Studio and connect to the SQL Server instance.
17+
1. Run the following query:
2118

22-
```sql
23-
SELECT c.session_id, c.net_transport, c.encrypt_option,
24-
c.auth_scheme, s.host_name, @@SERVERNAME as "remote_name",
25-
s.program_name, s.client_interface_name, s.login_name,
26-
s.nt_domain, s.nt_user_name, s.original_login_name,
27-
c.connect_time, s.login_time
28-
FROM sys.dm_exec_connections AS c
29-
JOIN sys.dm_exec_sessions AS s ON c.session_id = s.session_id
30-
WHERE c.session_id=@@SPID
31-
```
19+
```sql
20+
SELECT auth_scheme FROM sys.dm_exec_connections WHERE session_id = @@SPID
21+
```
22+
1. Alternatively, to retrieve additional connection details, run the following query:
23+
24+
```sql
25+
SELECT c.session_id, c.net_transport, c.encrypt_option,
26+
c.auth_scheme, s.host_name, @@SERVERNAME AS "remote_name",
27+
s.program_name, s.client_interface_name, s.login_name,
28+
s.nt_domain, s.nt_user_name, s.original_login_name,
29+
c.connect_time, s.login_time
30+
FROM sys.dm_exec_connections AS c
31+
JOIN sys.dm_exec_sessions AS s ON c.session_id = s.session_id
32+
WHERE c.session_id = @@SPID
33+
```
34+
1. Review the *auth_scheme* column in the results to determine the authentication type.
3235

3336
## Use the command line
3437

35-
Run the following query at a command prompt:
38+
1. Open a command prompt.
39+
1. Run the following command, replacing `<ServerName>` with your server's name:
3640

37-
```sql
38-
C:\Temp>sqlcmd -S SQLProd01 -E -Q "select auth_scheme from sys.dm_exec_connections where session_id=@@SPID"
39-
auth_scheme
40-
----------------------------------------
41-
NTLM
42-
43-
(1 rows affected)
44-
```
41+
```cmd
42+
sqlcmd -S <ServerName> -E -Q "SELECT auth_scheme FROM sys.dm_exec_connections WHERE session_id = @@SPID"
43+
```
44+
1. The result similar to the following output will indicate the authentication type:
4545

46-
## Alternative method
46+
```output
47+
auth_scheme
48+
----------------------------------------
49+
NTLM
50+
51+
(1 rows affected)
52+
```
4753

48-
If either of the previous options aren't available, consider using the following alternative procedure:
54+
## Use VBScript
4955

50-
1. Copy the following script into a text editor, such as Notepad, and save it as *getAuthScheme.vbs*:
56+
1. Copy the following VBScript code into a text editor, such as Notepad, and save it as *getAuthScheme.vbs*:
5157

5258
```vbscript
5359
' Auth scheme VB script.
@@ -72,75 +78,96 @@ If either of the previous options aren't available, consider using the following
7278
'
7379
' Run the query and display the results
7480
'
75-
set rs = cn.Execute("select auth_scheme from sys.dm_exec_connections where session_id=@@SPID")
81+
set rs = cn.Execute("SELECT auth_scheme FROM sys.dm_exec_connections WHERE session_id = @@SPID")
7682
WScript.Echo "Auth scheme: " & rs(0)
7783
rs.close
7884
cn.close
7985
```
86+
2. Run the following command from the command prompt, replacing `<ServerName>` with your server's name:
8087

81-
1. Run the *getAuthScheme.vbs* PowerShell script at a command prompt:
82-
83-
```powershell
84-
C:\Temp>cscript getAuthScheme.vbs SQLProd01
88+
```cmd
89+
cscript getAuthScheme.vbs <ServerName>
8590
```
86-
87-
You should see the following output:
91+
1. The result similar to the following output will indicate the authentication type:
8892

8993
```output
9094
Microsoft (R) Windows Script Host Version 5.812
9195
Copyright (C) Microsoft Corporation. All rights reserved.
9296
Auth scheme: NTLM
9397
```
9498

95-
## Use PowerShell
99+
## Use Windows PowerShell
96100

97-
You can use PowerShell to test the SqlClient .NET provider to try to isolate the issue from your application:
101+
You can use Windows PowerShell to test the SqlClient .NET provider to try to isolate the issue from your application:
98102

99-
1. Copy the following script into a text editor, such as Notepad, and save it as *get-SqlAuthScheme.ps1*.
100-
1. Run the following script at a command prompt:
103+
1. Copy the following PowerShell script into a text editor, such as Notepad, and save it as *get-SqlAuthScheme.ps1*.
101104

102105
```powershell
103-
#-------------------------------
104-
#
105-
# get-SqlAuthScheme.ps1
106-
#
107-
# PowerShell script to test a System.Data.SqlClient database connection
108-
#
109-
# USAGE: .\get-SqlAuthScheme tcp:SQLProd01.contoso.com,1433 ' explicitly specify DNS suffix, protocol, and port # ('tcp' must be lower case)
110-
# USAGE: .\get-SqlAuthScheme SQLProd01 ' let the driver figure out the DNS suffix, protocol, and port #
111-
#
112-
#-------------------------------
113-
param ([string]$server = "localhost")
114-
Set-ExecutionPolicy Unrestricted-Scope CurrentUser
115-
$connstr = "Server=$server;Database=master;Integrated Security=SSPI"
116-
[System.Data.SqlClient.SqlConnection] $conn = New-Object System.Data.SqlClient.SqlConnection
117-
$conn.ConnectionString = $connstr
118-
[System.DateTime] $start = Get-Date
119-
$conn.Open()
120-
[System.Data.SqlClient.SqlCommand] $cmd = New-Object System.Data.SqlClient.SqlCommand
121-
$cmd.CommandText = "select auth_scheme from sys.dm_exec_connections where session_id=@@spid"
122-
$cmd.Connection = $conn
123-
$dr = $cmd.ExecuteReader()
124-
$result = $dr.Read()
125-
$auth_scheme = $dr.GetString(0)
126-
$conn.Close()
127-
$conn.Dispose()
128-
[System.DateTime] $end = Get-Date
129-
[System.Timespan] $span = ($end - $start)
130-
"End time: " + $end.ToString("M/d/yyyy HH:mm:ss.fff")
131-
"Elapsed time was " + $span.Milliseconds + " ms."
132-
"Auth scheme for " + $server + ": " + $auth_scheme
106+
#-------------------------------
107+
#
108+
# get-SqlAuthScheme.ps1
109+
#
110+
# PowerShell script to test a System.Data.SqlClient database connection
111+
#
112+
# USAGE:
113+
# .\get-SqlAuthScheme tcp:SQLProd01.contoso.com,1433 # Explicitly specify DNS suffix, protocol, and port ('tcp' must be lowercase)
114+
# .\get-SqlAuthScheme SQLProd01 # Let the driver figure out the DNS suffix, protocol, and port
115+
#
116+
#-------------------------------
117+
# Define a parameter for the server name, defaulting to "localhost" if not provided
118+
param ([string]$server = "localhost")
119+
120+
# Set the execution policy for the current user to Unrestricted
121+
Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser -Force
122+
123+
# Build the connection string for the SQL Server connection
124+
$connstr = "Server=$($server);Database=master;Integrated Security=SSPI"
125+
126+
# Create a new SQL connection object
127+
$conn = New-Object System.Data.SqlClient.SqlConnection
128+
$conn.ConnectionString = $connstr
129+
130+
# Record the start time of the operation
131+
$start = Get-Date
132+
133+
# Open the SQL connection
134+
$conn.Open()
135+
136+
# Create a new SQL command object
137+
$cmd = $conn.CreateCommand()
138+
$cmd.CommandText = "SELECT auth_scheme FROM sys.dm_exec_connections WHERE session_id = @@SPID" # Query to get the authentication scheme
139+
140+
# Execute the query and retrieve the result
141+
$dr = $cmd.ExecuteReader()
142+
$dr.Read() | Out-Null # Read the first row of the result set
143+
$auth_scheme = $dr.GetString(0) # Get the authentication scheme from the first column
144+
145+
# Close and dispose of the SQL connection
146+
$conn.Close()
147+
$conn.Dispose()
148+
149+
# Record the end time of the operation
150+
$end = Get-Date
151+
152+
# Calculate the elapsed time
153+
$span = $end - $start
154+
155+
# Output the results
156+
Write-Output "Elapsed time was $($span.TotalMilliseconds) ms." # Display the elapsed time in milliseconds
157+
Write-Output "Auth scheme for $($server): $auth_scheme" # Display the authentication scheme for the server
133158
```
159+
1. Open Windows PowerShell, navigate to the folder containing the script, and run the following command:
134160

135-
You should see the following output:
161+
```powershell
162+
.\get-sqlauthscheme <ServerName> # Replace "<ServerName>" with your server name.
163+
```
164+
1. The result similar to the following output will indicate the authentication type:
136165

137166
```output
138-
C:\temp> .\get-sqlauthscheme sqlprod01
139-
End time: 10/26/2020 18:00:24.753
140167
Elapsed time was 0 ms.
141-
Auth scheme for sqlprod01: NTLM
168+
Auth scheme for <ServerName>: NTLM
142169
```
143170

144171
## More information
145172

146-
[Consistent authentication issues in SQL Server](consistent-authentication-connectivity-issues.md)
173+
- [Consistent authentication issues in SQL Server](consistent-authentication-connectivity-issues.md)

0 commit comments

Comments
 (0)