dsccommunity / dsccommunity/SqlServerDsc

SqlSetup: Avoiding Password Complexity Requirements for 'sa' account

Open
#452 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement help wanted
Dominant language
PowerShell
Stars
385
Forks
224
PR merge metrics
No merged PRs in 30d

Description

In the SqlSetup properties, SecurityMode is set to "SQL" and SAPwd is set to a PSCredential object where the password associated with the latter is weak. Installation of SQLENGINE fails. It succeeds when password meets complexity requirements.

What I don't understand is: Everything I read indicates that SQL Server's password policy is inherited from Windows. Going to Local Security Policy >> Security Settings >> Account Policies >> Password Policy clearly shows that 'Password must meet complexity requirements' is set to Disabled and 'Minimum Password Length' is set to zero. These relaxed requirements are in effect for this test machine as a whole at the Windows level. But for some reason, xSQLServer (or SQL Server itself) refuses to honor this decision.

The test machine is not a member of a domain.

Any idea what's causing the problem?

UPDATE: I've found that I can circumvent the issue by creating an additional account using xSqlServerLogin and making it a sysadmin using xSqlServerRole. The password complexity problem doesn't crop up for that newly created account. It's only for 'sa' that the problem manifests, apparently.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue provides no repository file or test to start from. Reproduce the installation with SqlSetup using SecurityMode "SQL" and a weak SAPwd on a standalone machine, then compare it with xSqlServerLogin and xSqlServerRole. Done means the cause of the sa-specific password rejection is identified and the affected behavior is corrected or clearly documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell, sql
Domain
databases, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.