Encryption of Credit Card files

G/Day Forum,
We are working on complying with the Visa/MAsterCard Payment Card Industry
Data Security Standard (PCI DSS). As part of this we need to imply the
following controls on the storage of credit card data:
to encrypt data at a folder level - that is all of the containing folders
and files
to allow for split knowledge of encryption keys and management thereof
to allow for strong encryption support (algorithms like 3DES, AES, etc)
a mechanism for automating the encryption process on a daily basis - this is
coincide with a backup cycle (no clear text credit card files get backed up
onto tape)
We are looking for a File/Folder encryption solution for a Windows 2000
based file server (member of a Windows 2000 Domain) and a Windows 2003 based
FTP Server (Standalone system), that will be used for storing Credit Card
information.
Your thoughts on any products that suit my requirements?
Regards,
Steve."The Poster" <nospam@.nospam_dontyoudare.net> wrote in message
news:eYqW%23rpGGHA.1396@.TK2MSFTNGP11.phx.gbl...
> G/Day Forum,
> We are working on complying with the Visa/MAsterCard Payment Card Industry
> Data Security Standard (PCI DSS). As part of this we need to imply the
> following controls on the storage of credit card data:
> to encrypt data at a folder level - that is all of the containing folders
> and files
> to allow for split knowledge of encryption keys and management thereof
I don't follow. Do you mean so that no single person can decrypt the credit
card information alone? Is that part of the PCI DSS requirements?

> to allow for strong encryption support (algorithms like 3DES, AES, etc)
> a mechanism for automating the encryption process on a daily basis - this
is
> coincide with a backup cycle (no clear text credit card files get backed
up
> onto tape)
Why would you not always encrypt the credit card numbers immediately instead
of on a schedule? I would think this would be highly preferable.

> We are looking for a File/Folder encryption solution for a Windows 2000
> based file server (member of a Windows 2000 Domain) and a Windows 2003
based
> FTP Server (Standalone system), that will be used for storing Credit Card
> information.
Windows EFS will do this. Make sure however that you 1) configure EFS
securely according to best practices and 2) you MUST back up your encryption
keys. You can meet the requirement if necessary of no single person being
able to decrypt by encrypting using an account where two people each know
half of the password. If you want other combinations of people to be able
to decrypt the data, you could encrypt the data in different ways using
different accounts where different people share the password. PGP, GPG and
www.jetico.com are some other popular low-cost encryption programs that work
similarly and may or may not meet your needs.
Or you could have a developer program a custom solution that handles the
data encryption / decryption and has a front-end that manages user
authentication to see the decrypted data.|||You plan on storing this in files ? as opposed to in database ? and,
more surprising to me, on a machine that has FTP active ' !?
Your interpretation of the guidance does not sound right when you say
> a mechanism for automating the encryption process on a daily basis - this
> is
> coincide with a backup cycle (no clear text credit card files get backed
> up
> onto tape)
I thought it says never stored (anywhere) in the clear
"The Poster" <nospam@.nospam_dontyoudare.net> wrote in message
news:eYqW%23rpGGHA.1396@.TK2MSFTNGP11.phx.gbl...
> G/Day Forum,
> We are working on complying with the Visa/MAsterCard Payment Card Industry
> Data Security Standard (PCI DSS). As part of this we need to imply the
> following controls on the storage of credit card data:
> to encrypt data at a folder level - that is all of the containing folders
> and files
> to allow for split knowledge of encryption keys and management thereof
> to allow for strong encryption support (algorithms like 3DES, AES, etc)
> a mechanism for automating the encryption process on a daily basis - this
> is
> coincide with a backup cycle (no clear text credit card files get backed
> up
> onto tape)
> We are looking for a File/Folder encryption solution for a Windows 2000
> based file server (member of a Windows 2000 Domain) and a Windows 2003
> based
> FTP Server (Standalone system), that will be used for storing Credit Card
> information.
> Your thoughts on any products that suit my requirements?
> Regards,
> Steve.
>
>|||I'll echo Roger's comments. Aside from asking for product advice, it maybe
worthwhile to review your architecture/goals.
Storing credit card information implies that it will be retrieved for future
use. Aside from normal retail operations like allowing customers to "save"
payment information for a quicker checkout process on a subsequent sale,
either by themselves online, or via telephone with a rep, the only other
probable use is for some data mining - but I don't think you need the entire
number to run reports based on credit cards.
On a large scale, say you have multiple "local" locations that run their own
localized sales/ops and then "batch" data into a central location (my guess
for your FTP need), the question still remains, what is the purpose for
including credit card information in such a batching process? I'll assume
this is just to allow the scenario I mentioned - allowing customers
easier/faster experience on a subsequent sale, they may have bought an item
from Store A in CA, but can still have the same ease if they ordered through
your web site or call center in NY or anywhere. In this case, the question
which Roger already asked is, why FTP instead of a synchronized database? If
you are at this scale of operations, then it would only be fitting to have
the proper architecture for it.
Cheers,
Ed
"The Poster" wrote:

> G/Day Forum,
> We are working on complying with the Visa/MAsterCard Payment Card Industry
> Data Security Standard (PCI DSS). As part of this we need to imply the
> following controls on the storage of credit card data:
> to encrypt data at a folder level - that is all of the containing folders
> and files
> to allow for split knowledge of encryption keys and management thereof
> to allow for strong encryption support (algorithms like 3DES, AES, etc)
> a mechanism for automating the encryption process on a daily basis - this
is
> coincide with a backup cycle (no clear text credit card files get backed u
p
> onto tape)
> We are looking for a File/Folder encryption solution for a Windows 2000
> based file server (member of a Windows 2000 Domain) and a Windows 2003 bas
ed
> FTP Server (Standalone system), that will be used for storing Credit Card
> information.
> Your thoughts on any products that suit my requirements?
> Regards,
> Steve.
>
>

Encryption Key Errors

I got error as below:

Failure sending mail: The report server has encountered a configuration error. See the report server log files for more information.

Then i found error in log file as below:

ERROR: Throwing Microsoft.ReportingServices.Diagnostics.Utilities.ServerConfigurationErrorException: The report server has encountered a configuration error. See the report server log files for more information., AuthzInitializeContextFromSid: Win32 error: 5; possible reason - service account doesn't have rights to check domain user SIDs.;
Info:

Does that mean sth to do with SQL agent running account or SQl Server Report Service running account ?

Thanks

Nick

http://support.microsoft.com/?kbid=842423|||

Thanks for you information. Teo

when i change the Local account for running SQL Server Report Services to dominon account, then i got http://servername/reports to view report, then i got error below:

An error has occurred during report processing. (rsProcessingAborted)
The report server cannot decrypt the symmetric key used to access sensitive or encrypted data in a report server database. You must either restore a backup key or delete all encrypted content. Check the documentation for more information. (rsReportServerDisabled) (rsRPCError)
Bad Data. (Exception from HRESULT: 0x80090005)

What i am understand is that when i create this report it's under local system account , so this report doesn't work when i change the user account. is that right? and how can i handle it ?

Cheers

Nick

|||You will need to re-initialize the server. Assuming RS 2005, use the Reporting Services Configuration (found under the Configuration Tools program group in Microsoft SQL Server 2005 group) to do so. Or, you can drop the decrypted content by running rskeymgmt -d (you will need to reset your data source connection strings after this).|||

when you say re-initialize the server , does that mean i need to delete the existing isntance from reporting service configruation , and create a new one. not just click the initialize button .

is that right understanding?

Cheers

Nick

|||By just clicking on the Initialization button in the Reporting Services Configuration tool.|||

i got erroer when i click initialize button in Report service configuration tool,

"Joining report server ac553f4....... to the web farm of the local instance" The task failed.

Exception Details"

ReportServicesConfigUI.WMIProvider.WMIProviderException: The report server cannot decrypt the symmetric key used to access sensitive or encrypted data in a report server database. You must either restore a backup key or delete all encrypted content. Check the documentation for more information. (rsReportServerDisabled)
at ReportServicesConfigUI.WMIProvider.RSReportServerAdmin.ThrowOnError(ManagementBaseObject mo)
at ReportServicesConfigUI.WMIProvider.RSReportServerAdmin.InitializeReportServer(String installationId)

Thanks

Nick

|||it looks like the only option is to drop the encryption content using rskeymgmt -d. You will need to reset your data source credentials after this.|||

Hi all, I have seen that I have a similar problem with Encryption Key working with reports. My problem is that I′m working with VSt2003 and I have some reports made, but yesterday I was just testing some ASP.NET examples with VS2005. This morning when I continued working with reports in VS2003, I recieved this error:

The report server cannot decrypt the symmetric key used to access sensitive or encrypted data in a report server database. You must either restore a backup key or delete all encrypted content. Check the documentation for more information. (rsReportServerDisabled)

And it wasn′t possible to see the reports.

Do you now the way to fix this problem?

Thanks in Advance

|||I don't know what happened yesterday but somehow you managed to deactivate the server. Re-initializing ASP.NET (aspnet_regiis) will do the trick. Anyway, if you have backed up the encryption key (you did, didn't you?), now is the perfect time to use the Reporting Services Configuration utility and restore it. If you haven't, do rskeymgmt -d.sql

Encrypting non text data

I want to encrypt some audio files before inserting them in a SQL server database. I want to use the built in sql server encryption. I found that the encrypt by key function accepts only text (nchar,nvarchar,etc).
I was thinking or reading the audio file's bytes and change them to a string and then insert them in the database. I just wanted to take opinions here. Is there a better way to do this?
thanks in advance

Actually, the encryption functions are really designed for binary data, but we accept text variables directly for usability reasons.

Unfortunately you will hit a different problem because of a design limitation on our current implementation: the output cannot be greater than 8k, therefore the plaintext has to be < 8K.

I wrote an article describing the data length limitations and a TSQL-based workaround (http://blogs.msdn.com/yukondoit/archive/2005/11/24/496521.aspx), but the workaround proposed in this article has some limitations itself. I would also suggest considering using a CLR module to encrypt/decrypt large BLOBs.

I hope this information will be useful. We appreciate your feedback on this area.

Thanks a lot,

-Raul Garcia

SDE/T

SQL Server Engine

Encrypting mdf files

Hi,

We want to encrypt MS Sql Server data files - .mdf and .ldf with
logged in user certificate and make sure that MS Sql Server service
(running as Local System Account) can decrypt it.

Is it possible to encrypt data files with a certificate that resides
in logged in user's
cert store and also MS SQL Server Service 'service account's cert
store?

You can access 'service account's cert store through mmc -

Quote:

Originally Posted by

>Certificates Snap-in -Service account

Thanks,
rsm
---rsm (prakandapandit@.yahoo.com) writes:

Quote:

Originally Posted by

We want to encrypt MS Sql Server data files - .mdf and .ldf with
logged in user certificate and make sure that MS Sql Server service
(running as Local System Account) can decrypt it.
>
Is it possible to encrypt data files with a certificate that resides
in logged in user's
cert store and also MS SQL Server Service 'service account's cert
store?

No.

If you are using SQL 2005, there are encryption routines builtin,
so that you encrypt some columns. Keep in mind that encrypting key
columns will have a very serious impact on performance.

--
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx|||On 16 Feb, 04:16, "rsm" <prakandapan...@.yahoo.comwrote:

Quote:

Originally Posted by

Hi,
>
We want to encrypt MS Sql Server data files - .mdf and .ldf with
logged in user certificate and make sure that MS Sql Server service
(running as Local System Account) can decrypt it.
>
Is it possible to encrypt data files with a certificate that resides
in logged in user's
cert store and also MS SQL Server Service 'service account's cert
store?
>

No. Assuming you are using SQL Server 2005 you should read the
encryption topics in Books Online.

It is in principle possible to encrypt every bit of user data in a
database, but I can't think of any good reasons for wanting to do that
- and there are many good reasons why NOT to do it. Could you explain
a bit more about your requirements.

--
David Portas, SQL Server MVP

Whenever possible please post enough code to reproduce your problem.
Including CREATE TABLE and INSERT statements usually helps.
State what version of SQL Server you are using and specify the content
of any error messages.

SQL Server Books Online:
http://msdn2.microsoft.com/library/...US,SQL.90).aspx
--|||We are using SQL Server 2000.

We are trying to provide an encryption solution for SQL Server
database. ldf and mdf files are some thing we want to encrypt.

Problem is that if we encrypt using user cert, we need to run SQL
Server service as that user which works fine until user changes his
password. In this case, we have to some how automatically change SQL
Server service 'run as' user password. I was wondering if there is a
way to install user cert as service cert so SQL Server can decrypt the
ldf files on its own.|||"rsm" <prakandapandit@.yahoo.comwrote in message
news:1172172849.993451.142190@.t69g2000cwt.googlegr oups.com...

Quote:

Originally Posted by

We are using SQL Server 2000.
>
We are trying to provide an encryption solution for SQL Server
database. ldf and mdf files are some thing we want to encrypt.
>
Problem is that if we encrypt using user cert, we need to run SQL
Server service as that user which works fine until user changes his
password. In this case, we have to some how automatically change SQL
Server service 'run as' user password. I was wondering if there is a
way to install user cert as service cert so SQL Server can decrypt the
ldf files on its own.
>

There is no built-in encryption in SQL 2000, so I'm 99% sure the answer is
no.

Simple answer; the user SQL Server runs under shouldn't be changing its
password often and when it does, should go through a normal change
procedure.

--
Greg Moore
SQL Server DBA Consulting
sql (at) greenms.com http://www.greenms.com

encrypting data of config table

hi. i need some help please. i had a problem with using configuration files in april ctp so i moved to sql server configuration which i found as a better solution for storing connection info since it can encrypt the password. this as far as i know as i'm moving from beta 1 version.

when creating the database at the client's server, the configuration table needs to be created as well and the data manually inserted using insert statements.

in this case, how do i enter the data in a way that is encrypted?

that's my question
thanks
I'm not sure I understand your question, but I think the answer is you can't do this. We don't support encrypting SQL Server configurations.|||I believe the question is just about writing data to an encrypted column. In that case, you should be able to just write values as you were writing them before, SQL Server would take care of encrypting the contents.

Encrypted File System

Anyone have any cautions using Encrypted File System (EFS) to encrypt DB
files as a security practice? Thanks to eveyone for being there to help."coenzyme" <coenzyme@.discussions.microsoft.com> wrote in message
news:4BE42E6E-CE78-4A2B-B270-F5AEA3292D49@.microsoft.com...
> Anyone have any cautions using Encrypted File System (EFS) to encrypt DB
> files as a security practice? Thanks to eveyone for being there to help.
Don't do it!!! It cripples performance.
The biggest slow down in the database is File I/O. By encrypting the data
files, you are in essence significantly increasing the File I/O.
Follow some networking best practices to secure your server and it's data
files. Use encryption over the network (if you must).
Any of these are far better than encrypting the data files.
Rick Sawtell
MCT, MCSD, MCDBA|||Thanks for the response Rick.
"Rick Sawtell" wrote:
> "coenzyme" <coenzyme@.discussions.microsoft.com> wrote in message
> news:4BE42E6E-CE78-4A2B-B270-F5AEA3292D49@.microsoft.com...
> > Anyone have any cautions using Encrypted File System (EFS) to encrypt DB
> > files as a security practice? Thanks to eveyone for being there to help.
>
> Don't do it!!! It cripples performance.
> The biggest slow down in the database is File I/O. By encrypting the data
> files, you are in essence significantly increasing the File I/O.
>
> Follow some networking best practices to secure your server and it's data
> files. Use encryption over the network (if you must).
> Any of these are far better than encrypting the data files.
> Rick Sawtell
> MCT, MCSD, MCDBA
>
>|||Hi
And once you change the password of the service account, in the AD user
manager, your certificate gets cancelled and your data is no longer
accessible.
If a hacker is on your server, EFS does not help much anymore as he owns
your network already.
Regards
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"Rick Sawtell" <r_sawtell@.hotmail.com> wrote in message
news:%23eKmvwkhFHA.572@.TK2MSFTNGP15.phx.gbl...
> "coenzyme" <coenzyme@.discussions.microsoft.com> wrote in message
> news:4BE42E6E-CE78-4A2B-B270-F5AEA3292D49@.microsoft.com...
>> Anyone have any cautions using Encrypted File System (EFS) to encrypt DB
>> files as a security practice? Thanks to eveyone for being there to help.
>
> Don't do it!!! It cripples performance.
> The biggest slow down in the database is File I/O. By encrypting the
> data
> files, you are in essence significantly increasing the File I/O.
>
> Follow some networking best practices to secure your server and it's data
> files. Use encryption over the network (if you must).
> Any of these are far better than encrypting the data files.
> Rick Sawtell
> MCT, MCSD, MCDBA
>
>|||What do you think about column level encryption? I'm considering using
column-level encryption on a few columns of particularly sensitive data in a
database.
"Rick Sawtell" <r_sawtell@.hotmail.com> wrote in message
news:%23eKmvwkhFHA.572@.TK2MSFTNGP15.phx.gbl...
> "coenzyme" <coenzyme@.discussions.microsoft.com> wrote in message
> news:4BE42E6E-CE78-4A2B-B270-F5AEA3292D49@.microsoft.com...
>> Anyone have any cautions using Encrypted File System (EFS) to encrypt DB
>> files as a security practice? Thanks to eveyone for being there to help.
>
> Don't do it!!! It cripples performance.
> The biggest slow down in the database is File I/O. By encrypting the
> data
> files, you are in essence significantly increasing the File I/O.
>
> Follow some networking best practices to secure your server and it's data
> files. Use encryption over the network (if you must).
> Any of these are far better than encrypting the data files.
> Rick Sawtell
> MCT, MCSD, MCDBA
>
>

Encrypted .dtsconfig files

Hi all,
Is there any plans in the pipeline to provide us a way of encrypting our configuration files.

I ask because I use configuration files everywhere in order to make my packages location independant but then you have to lock down access to those configuration files because they may have passwords in them.

I'd rather they were encrypted.

Thoughts?

-JamieJamie,
Have you thought about securing the config files by setting up NTFS permissions?
As a former Network Administrator, I found that it is much easier to manage resource access if it is centralized in one location. Personally, I would setup a group in Active Directory for users that need access to the config files and grant only that group to have read/write access to the folders containing your config files. (System Administrators still have full control and Backup Operators would have read access)
I would consider Encryption if the files are being sent over the wire and you want to make sure the file contents are not captured via a sniffer. It would be relatively easy to create a utitlity to encrypt and decrypt the files using the System.Security.Cryptography class.
Larry|||Hi Larry,
Yeah, that's what we're doing. I think the encryption feature would be nice as well tho.

-Jamie|||We considered an encryption feature, but didn't have time. It's a nice feature that we didn't get to.
K|||Right. Well you know what that means :)
http://lab.msdn.microsoft.com/ProductFeedback/viewfeedback.aspx?feedbackid=aebad475-0aa6-4fce-ba06-3ef42dd7856d|||

Jamie Thomson wrote:

Hi all,
Is there any plans in the pipeline to provide us a way of encrypting our configuration files.

I ask because I use configuration files everywhere in order to make my packages location independant but then you have to lock down access to those configuration files because they may have passwords in them.

I'd rather they were encrypted.

Thoughts?

-Jamie

You can store your configuration files on SQL Server; just as an alternative.

Encrypt/Decrypt SQL Server 2005 data files

We are trying to encrypt/decrypt a SQL Server 2005 database file.
It is my understanding that you can encrypt the main database, but not
its log file. The database file was successfully encrypted, but SQL
Server failed to decrypt it on opening after a many minutes delay. The
database was subsequently decrypted with a manual command, but the
database had been damaged and couldn't be re-opened. It had to be
deleted and restored.
It appears that there is no practical way to use an encrypted SQL
database because of apparent glitches and the extremely slow decryption
process.
We have considered backing up the database, encrypting the backup copy,
deleting the database from the SQL directory on shutdown and then
restoring it on startup. Another alternative is to store the data on
removable media.
I would greatly appreciate a suggestion as to how to best protect the
data. We use SecuriKey to protect OS system startup. This works, but it
doesn't protect the data if, for example, the hard drive is moved to
another computer.
I have read the following article:
[url]http://msdn.microsoft.com/msdnmag/issues/05/06/SQLServerSecurity/default.aspx[/url
]
Thank you very much.
Robert RobinsonHave you looked at using Windows Encrypted File System? That's the supported
way of protecting your data at the filesystem level. There are a few things
to be careful with paticularly with login/permissions management when
encrypting the folder but it's not rocket science (and well document in
msdn/technet).
As for losing the drive, well, not much you can do there really. Even if you
encrypt the filesystem, that generally just delays the would-be thief. When
you lose the hardware, pretty much all bets are off. If you're thinking of
notebooks, you can implement both EFS and secure the hard disk with a
password (go to setup when you boot). That makes is REALLY hard to get
through and will probably buy you enough time to initiate all kinds of
remedial defense actions (e.g. place credit alerts, cancel credit cards,
update resume & post on monster.com, etc...) before they get to your data.
joe.
"Robert Robinson" <robbiex@.bellsouth.net> wrote in message
news:e9fdHUdDHHA.3660@.TK2MSFTNGP06.phx.gbl...
> We are trying to encrypt/decrypt a SQL Server 2005 database file.
> It is my understanding that you can encrypt the main database, but not its
> log file. The database file was successfully encrypted, but SQL Server
> failed to decrypt it on opening after a many minutes delay. The database
> was subsequently decrypted with a manual command, but the database had
> been damaged and couldn't be re-opened. It had to be deleted and restored.
> It appears that there is no practical way to use an encrypted SQL database
> because of apparent glitches and the extremely slow decryption process.
> We have considered backing up the database, encrypting the backup copy,
> deleting the database from the SQL directory on shutdown and then
> restoring it on startup. Another alternative is to store the data on
> removable media.
> I would greatly appreciate a suggestion as to how to best protect the
> data. We use SecuriKey to protect OS system startup. This works, but it
> doesn't protect the data if, for example, the hard drive is moved to
> another computer.
> I have read the following article:
> [url]http://msdn.microsoft.com/msdnmag/issues/05/06/SQLServerSecurity/default.aspx[/u
rl]
> Thank you very much.
> Robert Robinson|||Hi Joe,
Thank you very much for the reply. EFS is what we tried. There are two
unfortunate limitations. First, according to Microsoft, you cannot use
SQL if the log file is encrypted. Second, decrypt takes many minutes and
the long required time makes the technology impractical to use.
I agree that there is no absolute way to prevent access to data once an
expert has physical possession of a computer or a hard drive.
SecuriKey does work as advertised. There are ways to circumvent the
technology, but it provides some protection.
Robbie|||> Thank you very much for the reply. EFS is what we tried. There are two
> unfortunate limitations. First, according to Microsoft, you cannot use SQL
> if the log file is encrypted. Second, decrypt takes many minutes and the
> long required time makes the technology impractical to use.
> I agree that there is no absolute way to prevent access to data once an
> expert has physical possession of a computer or a hard drive.
> SecuriKey does work as advertised. There are ways to circumvent the
> technology, but it provides some protection.
Maybe you can encrypt just the snsitive part of the data? Try to look at the
EncryptByKey and other encryption functions in BOL. Together with carefully
set NTFS permissions and encrypted backup you might get what you need.
Dejan Sarka
http://www.solidqualitylearning.com/blogs/|||Hi Dejan,
Thank you very much for the suggestions.
Robbie
Dejan Sarka wrote:
> Maybe you can encrypt just the snsitive part of the data? Try to look at t
he
> EncryptByKey and other encryption functions in BOL. Together with carefull
y
> set NTFS permissions and encrypted backup you might get what you need.
>|||We decided on the following to provide a reasonable level of protection.
First, computer access is limited by using the SecuriKey.
SQL database files are protected as follows:
Setup
1. The SQL databases to be protected are backed up and are then deleted
from SQL Server.
2. PGP Desktop 9.5 is used to create a new Virtual Disk.
3. This disk is mounted.
4. A new SQL database is created with its data and log files assigned to
be resident on the virtual disk.
5. The data are restored from the backup file.
Start-Up
1. The virtual disk is mounted automatically on start-up or under manual
or programmatic control.
2. A PGP passphrase is entered manually.
3. The SQL database is attached.
Shut-Down
1. The SQL database is detached.
2. The virtual disk is unmounted under manual or programmatic control.
Note that the attach/detach steps are required because SQL Server locks
access to the Log files and the virtual disk cannot not be unmounted
until this lock is released.|||"Robert Robinson" <robbiex@.bellsouth.net> wrote in message
news:uibht4IEHHA.3600@.TK2MSFTNGP06.phx.gbl...
> We decided on the following to provide a reasonable level of protection.
> First, computer access is limited by using the SecuriKey.
> SQL database files are protected as follows:
> Setup
> 1. The SQL databases to be protected are backed up and are then deleted
> from SQL Server.
Are you concerned that fragments of unencrypted data might be lying around
on the storage device even after deletion? Just curious. Thanks.|||Hi Mike,
We are interested in providing a reasonable level of protection for
laptop data. The backup file is created on a server and doesn't have to
be installed on a laptop. The data can be transferred by LAN or
removable media. Your point is, however, well taken. There is no way to
absolutely delete data from a hard drive short of physical destruction
of the platters.
On a slightly different subject, we have run into some interesting
issues involved in using SQL Server data files that are resident in an
encrypted disk volume.
SQL Server locks a database's log file and it is not possible to unmount
a "secure" volume without first releasing this lock. The lock can be
released by an ALTER DATABASE <its name> SET OFFLINE followed by
sp_detach_db.
The database is attached by a SQL script as follows:
Use Master
GO
EXEC sp_attach_db @.dbname = N'database name',
@.filename1 = N'S:\SQLServerData\database name.mdf',
@.filename2 = N'S:\SQLServerData\database name_log.ldf'
GO
The script is executed by:
Shell("sqlcmd -i C:\AttachDetach.sql -U <owner name> -P
<password> -s <server name>")
One interesting glitch is that the above command fails if the owner
name/password precedes the command file.
Another issue is that one needs to know what is shutting down the
application program that is accessing the database. For example, it
might be a normal program exit, a logoff, a battery low warning, or a
system suspend or shutdown.
We had to do some hunting to find the appropriate events. The following
are helpful: Microsoft.Win32.SystemEvents.SessionEnding,
Microsoft.Win32.SystemEvents.PowerModeChanged
and an interesting control called sysinfo.ocx.
Robbie

encrypt database physical files?

I'm just thinking loud. I'm investigating if there are any suspicious
operations that have taken place on our databases by using Log Explorer from
Lumigent. All of a sudden, I thought that now that the databases are stored
on the server as physical files, hackers probably can just copy the files
(*.MDF, *.LDF) to their machines without connecting to and doing anything on
the SQL server itself, right? Would it be a common practice to get those
databases encrypted?
Bing
bing wrote:
> I'm just thinking loud. I'm investigating if there are any suspicious
> operations that have taken place on our databases by using Log
> Explorer from Lumigent. All of a sudden, I thought that now that the
> databases are stored on the server as physical files, hackers
> probably can just copy the files (*.MDF, *.LDF) to their machines
> without connecting to and doing anything on the SQL server itself,
> right? Would it be a common practice to get those databases
> encrypted?
> Bing
The files are kept locked by SQL Server while they are in use. How would
a hacker access the files anyway? Presumably, they are not made
accessible through Windows security to user accounts. If a hacker was
able to connect to the server as an admin, they could just stop the SQL
service and copy the database files.
David Gugick
Quest Software
www.imceda.com
www.quest.com
|||Hi,
You can use the Encrypted File System Support on Windows 2000
Windows 2000 support encrypted file system property.
Below are the steps encrypt the data files:
1) Logon with the SQL Server startup account
2) Stop SQL Server and sql agent service
3) Right click the data files, select properties, click Advance button,
check the "Encrypt contents to secure data"
4) Start the SQL Server service
See the below KB for more information:-
HOW TO: Encrypt Data Using EFS in Windows 2000
http://support.microsoft.com/dXefaul...;en-us;2305X20
Note:
If you change the SQL Server startup accout you have to redo the same,
otherwise SQL Server service will not start.
"With EFS, database files are encrypted under the identity of the account
running SQL Server. Only this account can decrypt the files. If you need to
change the account that runs SQL Server, you should first decrypt the files
under the old account, then re-encrypt them under the new account."
Thanks
Hari
SQL Server MVP
"bing" <bing@.discussions.microsoft.com> wrote in message
news:D338A20C-C191-4886-8520-35A876FFE926@.microsoft.com...
> I'm just thinking loud. I'm investigating if there are any suspicious
> operations that have taken place on our databases by using Log Explorer
> from
> Lumigent. All of a sudden, I thought that now that the databases are
> stored
> on the server as physical files, hackers probably can just copy the files
> (*.MDF, *.LDF) to their machines without connecting to and doing anything
> on
> the SQL server itself, right? Would it be a common practice to get those
> databases encrypted?
> Bing
|||Hi
If the hacker can get that far into your box, he owns every other server
already, has created himself a domain account, and has access to your SQL
Server via any tool of his choice. He has also let his 5 friends in, and
they are reading your mail before you do.
Secure your perimeter, apply proper permissioning at OS level that only SQL
Server and domain admins can touch the files on the OS. Make sure your
applications are not susceptible to SQL Injection and apply the least
permissions to users in the DB.
Regards
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"bing" <bing@.discussions.microsoft.com> wrote in message
news:D338A20C-C191-4886-8520-35A876FFE926@.microsoft.com...
> I'm just thinking loud. I'm investigating if there are any suspicious
> operations that have taken place on our databases by using Log Explorer
> from
> Lumigent. All of a sudden, I thought that now that the databases are
> stored
> on the server as physical files, hackers probably can just copy the files
> (*.MDF, *.LDF) to their machines without connecting to and doing anything
> on
> the SQL server itself, right? Would it be a common practice to get those
> databases encrypted?
> Bing

encrypt database physical files?

I'm just thinking loud. I'm investigating if there are any suspicious
operations that have taken place on our databases by using Log Explorer from
Lumigent. All of a sudden, I thought that now that the databases are stored
on the server as physical files, hackers probably can just copy the files
(*.MDF, *.LDF) to their machines without connecting to and doing anything on
the SQL server itself, right? Would it be a common practice to get those
databases encrypted?
Bingbing wrote:
> I'm just thinking loud. I'm investigating if there are any suspicious
> operations that have taken place on our databases by using Log
> Explorer from Lumigent. All of a sudden, I thought that now that the
> databases are stored on the server as physical files, hackers
> probably can just copy the files (*.MDF, *.LDF) to their machines
> without connecting to and doing anything on the SQL server itself,
> right? Would it be a common practice to get those databases
> encrypted?
> Bing
The files are kept locked by SQL Server while they are in use. How would
a hacker access the files anyway? Presumably, they are not made
accessible through Windows security to user accounts. If a hacker was
able to connect to the server as an admin, they could just stop the SQL
service and copy the database files.
--
David Gugick
Quest Software
www.imceda.com
www.quest.com|||Hi,
You can use the Encrypted File System Support on Windows 2000
Windows 2000 support encrypted file system property.
Below are the steps encrypt the data files:
1) Logon with the SQL Server startup account
2) Stop SQL Server and sql agent service
3) Right click the data files, select properties, click Advance button,
check the "Encrypt contents to secure data"
4) Start the SQL Server service
See the below KB for more information:-
HOW TO: Encrypt Data Using EFS in Windows 2000
http://support.microsoft.com/d­efault.aspx?scid=kb;en-us;2305­20
Note:
If you change the SQL Server startup accout you have to redo the same,
otherwise SQL Server service will not start.
"With EFS, database files are encrypted under the identity of the account
running SQL Server. Only this account can decrypt the files. If you need to
change the account that runs SQL Server, you should first decrypt the files
under the old account, then re-encrypt them under the new account."
Thanks
Hari
SQL Server MVP
"bing" <bing@.discussions.microsoft.com> wrote in message
news:D338A20C-C191-4886-8520-35A876FFE926@.microsoft.com...
> I'm just thinking loud. I'm investigating if there are any suspicious
> operations that have taken place on our databases by using Log Explorer
> from
> Lumigent. All of a sudden, I thought that now that the databases are
> stored
> on the server as physical files, hackers probably can just copy the files
> (*.MDF, *.LDF) to their machines without connecting to and doing anything
> on
> the SQL server itself, right? Would it be a common practice to get those
> databases encrypted?
> Bing|||Hi
If the hacker can get that far into your box, he owns every other server
already, has created himself a domain account, and has access to your SQL
Server via any tool of his choice. He has also let his 5 friends in, and
they are reading your mail before you do.
Secure your perimeter, apply proper permissioning at OS level that only SQL
Server and domain admins can touch the files on the OS. Make sure your
applications are not susceptible to SQL Injection and apply the least
permissions to users in the DB.
Regards
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"bing" <bing@.discussions.microsoft.com> wrote in message
news:D338A20C-C191-4886-8520-35A876FFE926@.microsoft.com...
> I'm just thinking loud. I'm investigating if there are any suspicious
> operations that have taken place on our databases by using Log Explorer
> from
> Lumigent. All of a sudden, I thought that now that the databases are
> stored
> on the server as physical files, hackers probably can just copy the files
> (*.MDF, *.LDF) to their machines without connecting to and doing anything
> on
> the SQL server itself, right? Would it be a common practice to get those
> databases encrypted?
> Bing

encrypt database physical files?

I'm just thinking loud. I'm investigating if there are any suspicious
operations that have taken place on our databases by using Log Explorer from
Lumigent. All of a sudden, I thought that now that the databases are stored
on the server as physical files, hackers probably can just copy the files
(*.MDF, *.LDF) to their machines without connecting to and doing anything on
the SQL server itself, right? Would it be a common practice to get those
databases encrypted?
Bingbing wrote:
> I'm just thinking loud. I'm investigating if there are any suspicious
> operations that have taken place on our databases by using Log
> Explorer from Lumigent. All of a sudden, I thought that now that the
> databases are stored on the server as physical files, hackers
> probably can just copy the files (*.MDF, *.LDF) to their machines
> without connecting to and doing anything on the SQL server itself,
> right? Would it be a common practice to get those databases
> encrypted?
> Bing
The files are kept locked by SQL Server while they are in use. How would
a hacker access the files anyway? Presumably, they are not made
accessible through Windows security to user accounts. If a hacker was
able to connect to the server as an admin, they could just stop the SQL
service and copy the database files.
David Gugick
Quest Software
www.imceda.com
www.quest.com|||Hi,
You can use the Encrypted File System Support on Windows 2000
Windows 2000 support encrypted file system property.
Below are the steps encrypt the data files:
1) Logon with the SQL Server startup account
2) Stop SQL Server and sql agent service
3) Right click the data files, select properties, click Advance button,
check the "Encrypt contents to secure data"
4) Start the SQL Server service
See the below KB for more information:-
HOW TO: Encrypt Data Using EFS in Windows 2000
http://support.microsoft.com/d_efau...b;en-us;2305_20
Note:
If you change the SQL Server startup accout you have to redo the same,
otherwise SQL Server service will not start.
"With EFS, database files are encrypted under the identity of the account
running SQL Server. Only this account can decrypt the files. If you need to
change the account that runs SQL Server, you should first decrypt the files
under the old account, then re-encrypt them under the new account."
Thanks
Hari
SQL Server MVP
"bing" <bing@.discussions.microsoft.com> wrote in message
news:D338A20C-C191-4886-8520-35A876FFE926@.microsoft.com...
> I'm just thinking loud. I'm investigating if there are any suspicious
> operations that have taken place on our databases by using Log Explorer
> from
> Lumigent. All of a sudden, I thought that now that the databases are
> stored
> on the server as physical files, hackers probably can just copy the files
> (*.MDF, *.LDF) to their machines without connecting to and doing anything
> on
> the SQL server itself, right? Would it be a common practice to get those
> databases encrypted?
> Bing|||Hi
If the hacker can get that far into your box, he owns every other server
already, has created himself a domain account, and has access to your SQL
Server via any tool of his choice. He has also let his 5 friends in, and
they are reading your mail before you do.
Secure your perimeter, apply proper permissioning at OS level that only SQL
Server and domain admins can touch the files on the OS. Make sure your
applications are not susceptible to SQL Injection and apply the least
permissions to users in the DB.
Regards
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
IM: mike@.epprecht.net
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"bing" <bing@.discussions.microsoft.com> wrote in message
news:D338A20C-C191-4886-8520-35A876FFE926@.microsoft.com...
> I'm just thinking loud. I'm investigating if there are any suspicious
> operations that have taken place on our databases by using Log Explorer
> from
> Lumigent. All of a sudden, I thought that now that the databases are
> stored
> on the server as physical files, hackers probably can just copy the files
> (*.MDF, *.LDF) to their machines without connecting to and doing anything
> on
> the SQL server itself, right? Would it be a common practice to get those
> databases encrypted?
> Bing

Encription for MDF files

Dear Friends
I want to use the encryption for the MDF files so that no one can just copy
the data and attach the MDF files to access the database.
When i have done the same the database is in Suspect Mode. Please suggest
what can be the reason.
I also have the following questions.
1. Can another user restore the database backup for the encrypted MDF files.
Thanks in advance.
Best regards
ShaileshI don't believe SQL Server supports encrypted files. If you don't want
someone to get ahold of your files then set the security on the box so that
only the people who need access have it. As for backups you should look at
SQL LiteSpeed from www.imceda.com . It allows you to encrypt the backup on
the fly.
Andrew J. Kelly SQL MVP
"Sharad2005" <niitmalad@.yahoo.co.uk> wrote in message
news:9667DEDF-C6BD-4817-BC5E-88941ABE10D2@.microsoft.com...
> Dear Friends
> I want to use the encryption for the MDF files so that no one can just
> copy
> the data and attach the MDF files to access the database.
> When i have done the same the database is in Suspect Mode. Please suggest
> what can be the reason.
> I also have the following questions.
> 1. Can another user restore the database backup for the encrypted MDF
> files.
> Thanks in advance.
> Best regards
> Shailesh|||Hi
Did you encrypt the file/directory when logged in as the SQL Server Service
Account? If not, you need to as the encryption/decryption can only be done b
y
one account.
Just be aware, if you change the user's password from Computer Manager / AD
User Manager, the encryption certificate becomes invalid and you loose total
access to the data on the encrypted file/directory.
If you do a SQL Server BACKUP, the resultant backup can be restored by
someone else, as long as it is not encrypted.
Copying the encrypted file to a different location, will result in it being
decrypted.
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"Sharad2005" wrote:

> Dear Friends
> I want to use the encryption for the MDF files so that no one can just cop
y
> the data and attach the MDF files to access the database.
> When i have done the same the database is in Suspect Mode. Please suggest
> what can be the reason.
> I also have the following questions.
> 1. Can another user restore the database backup for the encrypted MDF file
s.
> Thanks in advance.
> Best regards
> Shailesh|||Hi,
You can use the Encrypted File System Support on Windows 2000
Windows 2000 support encrypted file system property.
Below are the steps encrypt the data files:
1) Logon with the SQL Server startup account
2) Stop SQL Server and sql agent service
3) Right click the data files, select properties, click Advance button,
check the "Encrypt contents to secure data"
4) Start the SQL Server service
See the below KB for more information:-
HOW TO: Encrypt Data Using EFS in Windows 2000
http://support.microsoft.com/defaul...kb;en-us;230520
Note:
If you change the SQL Server startup accout you have to redo the same,
otherwise SQL Server service will not start.
"With EFS, database files are encrypted under the identity of the account
running SQL Server. Only this account can decrypt the files. If you need to
change the account that runs SQL Server, you should first decrypt the files
under the old account, then re-encrypt them under the new account."
Thanks
Hari
SQL Server MVP
"Sharad2005" <niitmalad@.yahoo.co.uk> wrote in message
news:9667DEDF-C6BD-4817-BC5E-88941ABE10D2@.microsoft.com...
> Dear Friends
> I want to use the encryption for the MDF files so that no one can just
> copy
> the data and attach the MDF files to access the database.
> When i have done the same the database is in Suspect Mode. Please suggest
> what can be the reason.
> I also have the following questions.
> 1. Can another user restore the database backup for the encrypted MDF
> files.
> Thanks in advance.
> Best regards
> Shailesh|||Respectfully, EFS by itself is not a complete solution.
If the box is stolen - including the EFS recovery keys, then you are no
better off as the system administrator password can be hacked, the filestore
accessed and viola!
If you want to protect against this, then research the syskey command and
also read up about EFS recovery agents and make sure you know the full in's
and out's of it as otherwise it could cost you all your data. It is common
for people to lose data by losing EFS keys.
If some of your data is critical - e.g. columns containing say credit card
numbers, then encrypt it before it is stored and decrypt it when retrieving.
It is easy to code using .Net. This is not an easy solution tho' as you also
have to protect the keys used for encryption and decryption here. If you
want to store some type of passwords - use hashing instead - it is a one way
process. Research SHA1, SHA256 etc.
HTH
"Hari Prasad" <hari_prasad_k@.hotmail.com> wrote in message
news:ut72iu6kFHA.2396@.TK2MSFTNGP12.phx.gbl...
> Hi,
> You can use the Encrypted File System Support on Windows 2000
> Windows 2000 support encrypted file system property.
> Below are the steps encrypt the data files:
> 1) Logon with the SQL Server startup account
> 2) Stop SQL Server and sql agent service
> 3) Right click the data files, select properties, click Advance button,
> check the "Encrypt contents to secure data"
> 4) Start the SQL Server service
> See the below KB for more information:-
>
> HOW TO: Encrypt Data Using EFS in Windows 2000
> http://support.microsoft.com/defaul...kb;en-us;230520
> Note:
> If you change the SQL Server startup accout you have to redo the same,
> otherwise SQL Server service will not start.
>
> "With EFS, database files are encrypted under the identity of the account
> running SQL Server. Only this account can decrypt the files. If you need
> to
> change the account that runs SQL Server, you should first decrypt the
> files under the old account, then re-encrypt them under the new account."
> --
> Thanks
> Hari
> SQL Server MVP
>
> "Sharad2005" <niitmalad@.yahoo.co.uk> wrote in message
> news:9667DEDF-C6BD-4817-BC5E-88941ABE10D2@.microsoft.com...
>

Empty Log files and Data files

Hi!
I'm using replication with two database on SQL 2000,when begin, the log files size is 50mb and the data files size is 150mb. But now the log files size is 2Gb and the data files size is 4Gb. I would like to decrease the log files and the data files ? How do i do this?
(I using Truncate and shrink doesn't change )
Thanks!!!For log file, after replicating, take a full backup of your database, then truncate log.. This must reduce the log file..

I have no other idea about reducing the data file size.

Regards|||Is this on the source, destination or distribution?
Backup the log or change the recovery model to simple then shrink the log.

For data - shrink the data file.

Are you sure that the data is replicating and it's not building up because transactions can't be cleared?
That would end up with a lot of data in the distribution database and log space used.

empty files to another files

Hi
Q1: I want to empty file into another file group. Is it possible?
Q2: What command does empty of the files. I do not see any command from
T-SQL doc but I may be wrong.
Q2: Is the table which are getting moved to another files are available for
transaction?
Thanks
Mangesh
Keep in mind that the primary file in the primary filegroup contains the
system table definitions and can not be moved. Moreover, no matter how many
other files or filegroups you have defined, the primary file can never be
removed from the database definition.
That being said, having multiple files within a filegroup will allow you to
mark any of these secondary files as EMPTYFILE and then have the data moved
to the remaining files within the same filegroup. To get the index data to
move, you could rebuild the indexes defined within the group or the
clustered index to move the data. You could also preform a database shrink
operation that would move data and index pages from one file to the others.
The only way to move index or data files from one filegroup to another, is
to rebuild the index(es) and define them to reside in the new filegroup.
This will only work on the user tables and indexes.
Sincerely,
Anthony Thomas

"Mangesh Deshpande" <MangeshDeshpande@.discussions.microsoft.com> wrote in
message news:F0A7AF64-0C5C-4AD8-BCAC-8C57B451B7F6@.microsoft.com...
Hi
Q1: I want to empty file into another file group. Is it possible?
Q2: What command does empty of the files. I do not see any command from
T-SQL doc but I may be wrong.
Q2: Is the table which are getting moved to another files are available for
transaction?
Thanks
Mangesh

empty files to another files

Hi
Q1: I want to empty file into another file group. Is it possible?
Q2: What command does empty of the files. I do not see any command from
T-SQL doc but I may be wrong.
Q2: Is the table which are getting moved to another files are available for
transaction?
Thanks
MangeshKeep in mind that the primary file in the primary filegroup contains the
system table definitions and can not be moved. Moreover, no matter how many
other files or filegroups you have defined, the primary file can never be
removed from the database definition.
That being said, having multiple files within a filegroup will allow you to
mark any of these secondary files as EMPTYFILE and then have the data moved
to the remaining files within the same filegroup. To get the index data to
move, you could rebuild the indexes defined within the group or the
clustered index to move the data. You could also preform a database shrink
operation that would move data and index pages from one file to the others.
The only way to move index or data files from one filegroup to another, is
to rebuild the index(es) and define them to reside in the new filegroup.
This will only work on the user tables and indexes.
Sincerely,
Anthony Thomas
"Mangesh Deshpande" <MangeshDeshpande@.discussions.microsoft.com> wrote in
message news:F0A7AF64-0C5C-4AD8-BCAC-8C57B451B7F6@.microsoft.com...
Hi
Q1: I want to empty file into another file group. Is it possible?
Q2: What command does empty of the files. I do not see any command from
T-SQL doc but I may be wrong.
Q2: Is the table which are getting moved to another files are available for
transaction?
Thanks
Mangesh

empty files to another files

Hi
Q1: I want to empty file into another file group. Is it possible?
Q2: What command does empty of the files. I do not see any command from
T-SQL doc but I may be wrong.
Q2: Is the table which are getting moved to another files are available for
transaction?
Thanks
MangeshKeep in mind that the primary file in the primary filegroup contains the
system table definitions and can not be moved. Moreover, no matter how many
other files or filegroups you have defined, the primary file can never be
removed from the database definition.
That being said, having multiple files within a filegroup will allow you to
mark any of these secondary files as EMPTYFILE and then have the data moved
to the remaining files within the same filegroup. To get the index data to
move, you could rebuild the indexes defined within the group or the
clustered index to move the data. You could also preform a database shrink
operation that would move data and index pages from one file to the others.
The only way to move index or data files from one filegroup to another, is
to rebuild the index(es) and define them to reside in the new filegroup.
This will only work on the user tables and indexes.
Sincerely,
Anthony Thomas
"Mangesh Deshpande" <MangeshDeshpande@.discussions.microsoft.com> wrote in
message news:F0A7AF64-0C5C-4AD8-BCAC-8C57B451B7F6@.microsoft.com...
Hi
Q1: I want to empty file into another file group. Is it possible?
Q2: What command does empty of the files. I do not see any command from
T-SQL doc but I may be wrong.
Q2: Is the table which are getting moved to another files are available for
transaction?
Thanks
Mangesh

Empty data files completely?

Hi,
Is there a way to completely empty some data files in the same filegroup so
I can delete them?
thanx
--
remove RmEaMkOnViEoTHvIoS from my email
svi komentari i razmisljanja su moja kao pojedinca i nikako se ne smiju
povezivati sa tvrtkom u kojoj radim
Yep. DBCC SHRINKFILE using the EMPTYFILE option. Then you can use ALTER DATABASE to drop the
file(s).
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Zarko Jovanovic" <RmEaMkOnViEoTHvIoSmind_less@.bigfoot.com> wrote in message
news:1092738725.466707@.internet.fina.hr...
> Hi,
> Is there a way to completely empty some data files in the same filegroup so
> I can delete them?
> thanx
> --
> --
> remove RmEaMkOnViEoTHvIoS from my email
> svi komentari i razmisljanja su moja kao pojedinca i nikako se ne smiju
> povezivati sa tvrtkom u kojoj radim
>

Empty data files completely?

Hi,
Is there a way to completely empty some data files in the same filegroup so
I can delete them?
thanx
--
remove RmEaMkOnViEoTHvIoS from my email
svi komentari i razmisljanja su moja kao pojedinca i nikako se ne smiju
povezivati sa tvrtkom u kojoj radimYep. DBCC SHRINKFILE using the EMPTYFILE option. Then you can use ALTER DATA
BASE to drop the
file(s).
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Zarko Jovanovic" <RmEaMkOnViEoTHvIoSmind_less@.bigfoot.com> wrote in message
news:1092738725.466707@.internet.fina.hr...
> Hi,
> Is there a way to completely empty some data files in the same filegroup s
o
> I can delete them?
> thanx
> --
> --
> remove RmEaMkOnViEoTHvIoS from my email
> svi komentari i razmisljanja su moja kao pojedinca i nikako se ne smiju
> povezivati sa tvrtkom u kojoj radim
>

Empty data files completely?

Hi,
Is there a way to completely empty some data files in the same filegroup so
I can delete them?
thanx
--
--
remove RmEaMkOnViEoTHvIoS from my email
svi komentari i razmisljanja su moja kao pojedinca i nikako se ne smiju
povezivati sa tvrtkom u kojoj radimYep. DBCC SHRINKFILE using the EMPTYFILE option. Then you can use ALTER DATABASE to drop the
file(s).
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Zarko Jovanovic" <RmEaMkOnViEoTHvIoSmind_less@.bigfoot.com> wrote in message
news:1092738725.466707@.internet.fina.hr...
> Hi,
> Is there a way to completely empty some data files in the same filegroup so
> I can delete them?
> thanx
> --
> --
> remove RmEaMkOnViEoTHvIoS from my email
> svi komentari i razmisljanja su moja kao pojedinca i nikako se ne smiju
> povezivati sa tvrtkom u kojoj radim
>