摘自http://www.microsoft.com/china/technet/sysinternals/utilities/NewSid.mspx
1 NewSID 4.10 版
作者：Mark Russinovich 和 Bryce Cogswell
发布日期： 2006年11月01日
1.1 重要信息：
关于 SID，Microsoft 不支持使用 NewSID 准备的映像，我们只支持使用 SysPrep 准备的映像。Microsoft 尚未针对所有部署克隆选项测试 NewSID。
有关 Microsoft 的官方策略的详细信息，请参阅下面的知识库文章：
• 有关 Windows XP 安装的磁盘复制的 Microsoft 策略
返回页首
1.2 简介
许多组织使用磁盘映像克隆技术来大规模部署 Windows。此方法要求将完全安装和配置的 Windows 计算机的磁盘复制到其他计算机的磁盘驱动器。其他这些计算机似乎已经有效地完成了相同的安装过程，并且可以立即使用。
虽然此方法节省了数小时的工作量并且比其他部署方法有效，但是它存在一个严重问题，即每个克隆的系统都具有一个完全相同的计算机安全标识符 (SID)。这一因素会损害工作组环境的安全性，并且在具有多个相同计算机 SID 的网络中，还可能损害可移动媒体安全性。
来自 Windows 社区的要求已经促使多家公司开发可以在克隆系统后更改计算机的 SID 的程序。但是，Symantec 的 SID Changer 和 Symantec 的 Ghost Walker 仅作为每家公司的高端产品出售。而且，它们都从 DOS 命令提示窗口中运行（Altiris 的更改器类似于 NewSID）。
NewSID 是我们开发的可更改计算机的 SID 的程序。它是一个免费的 Win32 程序，这意味着它可以容易地在以前克隆的系统上运行。NewSID 可在 Windows NT 4、Windows 2000、Windows XP 和 Windows .NET Server 上运行。
使用该程序之前，请先完整阅读此文章。
版本信息：
• 版本 4.0 引入了对 Windows XP 和 .NET Server 的支持、向导样式的界面（可以通过该界面指定您要应用的 SID）、注册表压缩以及用于重命名计算机的选项（该选项可用来更改 NetBIOS 名称和 DNS 名称）。
• 版本 3.02 更正了以下程序缺陷：在将具有旧 SID 的项重命名为新 SID 时，NewSid 无法正确复制具有无效值类型的默认值。实际上，NT 某些时候在 SAM 中使用了这些无效值。此程序缺陷的症状是：当授权用户更新帐户信息时，错误消息报告访问权限被拒绝。
• 版本 3.01 为由 Microsoft Transaction Server 创建的无法访问的注册表项添加了解决方法。不使用该解决方法，NewSID 会过早退出。
• 版本 3.0 引入了 SID 同步功能，该功能指示 NewSID 从另一台计算机获取要应用的 SID。
• 版本 2.0 具有自动模式选项，而且还使您可以更改计算机名称。
• 版本 1.2 修复了在版本 1.1 中引入的未更新某些文件系统安全描述符的程序缺陷。
• 版本 1.1 更正了仅影响某些安装的相对次要的程序缺陷。对它也进行了更新，以便更改与文件和打印机共享的权限设置相关联的 SID。
返回页首
1.3 克隆和备用部署方法
在企业环境中执行大规模 Windows 部署（通常为数百台计算机）的最常见方法之一基于磁盘克隆技术。系统管理员可以在样本计算机上安装公司使用的基本操作系统和附加软件。在配置该计算机以便在公司网络中进行操作后，可以使用自动化磁盘或系统复制工具（如 Symantec 的 Ghost、PowerQuest 的 Image Drive 和 Altiris 的 RapiDeploy）将样本计算机的驱动器复制到数十台或数百台计算机上。然后，对这些克隆计算机进行最后的调整（如分配唯一名称），然后由公司员工使用。
另一种比较流行的部署方法是使用 Microsoft sysdiff 实用工具（Windows 资源工具包的一部分）。此工具需要系统管理员在每台计算机上执行完全安装（通常是无人参与的脚本安装），然后 sysdiff 自动应用附加软件安装映像。
由于跳过安装并且磁盘扇区复制比文件复制更有效等原因，基于克隆的部署与类似的 sysdiff 安装相比可以节省数十小时的时间。另外，系统管理员不必了解如何使用无人参与的安装或 sysdiff，也无需创建并调试安装脚本。单这一项就可以节省数小时的工作。
返回页首
1.4 SID 重复问题
克隆的问题在于它仅由 Microsoft 提供非常有限的支持。Microsoft 已经声明，只支持在到达 Windows 安装程序的 GUI 部分之前获得到克隆系统。在安装到达此步骤时，将为计算机分配名称和唯一的计算机 SID。如果系统是在完成此步骤之后克隆的，则克隆的所有计算机都将具有完全相同的计算机 SID。请注意，只更改计算机名称或将计算机添加到不同的域不会更改计算机 SID。如果计算机先前与某个域相关联，则更改名称或域时只能更改域 SID。
要了解克隆可能引起的问题，首先需要了解如何为计算机上的各个本地帐户分配 SID。本地帐户的 SID 由计算机的 SID 和附加的 RID（相对标识符）组成。RID 从某个固定值开始，并且每创建一个帐户就会增加 1。这意味着一台计算机上的第二个帐户会被分配与克隆计算机上的第二个帐户相同的 RID。结果是这两个帐户具有相同的 SID。
重复的 SID 在基于域的环境中不是问题，因为域帐户具有基于域 SID 的 SID。但是，根据 Microsoft 知识库文章 Q162001“不要硬盘复制安装的 Windows NT 的各个版本”，在工作组环境中，安全是基于本地帐户 SID 的。因此，如果两台计算机的用户具有相同的 SID，则工作组将无法区分这些用户。对于所有资源（包括文件和注册表项）而言，如果一个用户对其具有访问权限，则另一个用户也对其具有访问权限。
重复 SID 可能引起问题的另一个场合是存在使用 NTFS 格式化的可移动媒体，并且将本地帐户安全属性应用于文件和目录。如果将这样的媒体移动到具有相同 SID 的另一台计算机，则当本地帐户的帐户 ID 恰巧与安全属性中的帐户 ID 匹配时，这些帐户将能够访问本来无法访问的文件。如果计算机具有不同的 SID，则不可能发生这种情况。
Mark 撰写的题为“NT Rollout Options”（NT 部署选项）的文章已在《Windows NT 杂志》的 6 月刊中发表。这篇文章更加详细地讨论了重复 SID 问题，而且表明了 Microsoft 对于克隆的官方立场。要查看您的网络中是否有重复 SID 问题，请使用 PsGetSid 来显示计算机 SID。
返回页首
1.5 NewSID
NewSID 是我们开发的可用来更改计算机 SID 的程序。它首先为计算机生成一个随机的 SID，然后更新它在注册表和文件安全描述符中找到的现有计算机 SID 的实例，并用新 SID 替换旧 SID。NewSID 要求使用管理权限运行。它有两个功能：更改 SID 和更改计算机名称。
要使用 NewSID 的自动运行选项，请在命令行中指定“/a”。您还可以通过在“/a”开关后面包含新名称来指示它自动更改计算机的名称。例如：
newsid /a [newname]
将使 NewSID 无提示运行，将计算机名称更改为“newname”，并且在一切正常的情况下重新启动计算机。
注意：如果要运行 NewSID 的系统正在运行 IISAdmin，则必须在运行 NewSID 之前停止 IISAdmin 服务。使用以下命令可停止 IISAdmin 服务：net stop iisadmin /y
NewSID 的 SID 同步功能使您可以指定从另一台计算机获取新 SID 而不是随机生成 SID。使用此功能，可以将备份域控制器 (BDC) 移动到一个新域，因为根据 BDC 与其他域控制器 (DC) 具有相同的计算机 SID，可以确定该 BDC 与某个域的关系。只需选择“Synchronize SID”按钮并输入目标计算机的名称。您必须具有更改目标计算机的注册表项的安全设置的权限，这通常意味着您必须以域管理员身份登录才能使用此功能。
请注意，当您运行 NewSID 时，注册表的大小将会增长，因此请确保注册表最大大小能够适应这一增长。我们已发现这一增长对系统性能没有明显影响。注册表增长的原因是：当 NewSID 应用临时安全设置时，注册表变零碎了。删除这些设置后，注册表不受影响。
重要信息：请注意，虽然我们已经对 NewSID 进行了全面测试，但是您必须自行承担使用它所带来的风险。像使用任何能够更改文件和注册表设置的软件一样，强烈建议您在运行 NewSID 前，对计算机进行完全备份。
返回页首
1.6 移动 BDC
将 BDC 从一个域移动到另一个域时，需要遵循以下步骤：
1. 启动您要移动的 BDC，然后登录。使用 NewSID 将该 BDC 的 SID 与要将该 BDC 移动到的域的 PDC 进行同步。
2. 重新启动更改了 SID 的系统 (BDC)。因为现在与该 BDC 相关联的域已经具有一个活动的 PDC，所以该 BDC 将作为其新域中的 BDC 启动。
3. 该 BDC 将显示为服务器管理器中的工作站，因此可以使用“添加到域”按钮将该 BDC 添加到其新域中。添加时一定要指定“BDC”单选按钮。
返回页首
1.7 工作原理
NewSID 首先读取现有计算机 SID。计算机的 SID 存储在注册表的 SECURITY\SAM\Domains\Account 下的 SECURITY 配置单元中。此项包含一个名为 F 的值和一个名为 V 的值。V 值是一个将计算机 SID 嵌入到其数据末尾的二进制值。NewSID 能够确保此 SID 具有标准格式（三个 32 位子颁发机构位段的前面带有三个 32 位颁发机构位段）。
接下来，NewSID 为计算机生成一个新的随机 SID。NewSID 的生成过程竭力创建了一个真正的 96 位随机值，该值将替换组成计算机 SID 的 3 个子颁发机构值（共 96 位）。
计算机 SID 的替换分为以下三个阶段。在第一阶段中，扫描 SECURITY 和 SAM 注册表配置单元，以便在项名称以及项值中查找旧的计算机 SID。如果在值中找到 SID，则用新的计算机 SID 替换它；如果在名称中找到 SID，则会将相应的项及其子项复制到与替换旧 SID 的新 SID 具有相同名称的新子项。
最后两个阶段涉及到更新安全描述符。注册表项和 NTFS 文件具有与自身相关联的安全性。安全描述符包含以下部分：一个标识了哪个帐户拥有资源，哪个组是主要组所有者的条目；一个可选列表（称为自由访问控制列表 - DACL），其中的条目指定了用户或组所允许的操作；以及另外一个可选列表，其中的条目指定了特定用户或组所执行的哪些操作将在系统事件日志（系统访问控制列表 - SACL）中生成条目。用户或组在这些安全描述符中通过其各自的 SID 进行标识，而且如前所述，本地用户帐户（内置帐户，如 Administrator、Guest 等除外）的 SID 由计算机 SID 和 RID 组成。
安全描述符更新的第一部分发生在计算机中的所有 NTFS 系统文件上。将扫描每个安全描述符以查找计算机 SID。当 NewSID 找到一个 SID 时，就会用新的计算机 SID 替换它。
安全描述符更新的第二部分在注册表上执行。首先，NewSID 必须确保已经扫描了所有配置单元，而不只是扫描了已加载的那些配置单元。当用户登录时，每个用户帐户都具有一个作为 HKEY_CURRENT_USER 加载的注册表配置单元，而当用户未登录时，该注册表配置单元将保留在磁盘的用户配置文件目录中。NewSID 标识所有用户配置单元位置的方法是枚举 HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList 项，该项指向存储了这些配置单元的目录。然后，它使用 RegLoadKey 将这些配置单元加载到注册表中 HKEY_LOCAL_MACHINE 的下面，并且扫描整个注册表，检查每个安全描述符以查找旧的计算机 SID。这些更新的执行方式与文件更新相同，而且在更新完成时，NewSID 将卸载它所加载的用户配置单元。最后一步，NewSID 扫描 HKEY_USERS 项，该项包含 .Default 配置单元以及当前登录用户的配置单元。这一步是必要的，因为一个配置单元不能加载两次；所以，当 NewSID 正在加载其他用户配置单元时，不会将登录用户配置单元加载到 HKEY_LOCAL_MACHINE 中。
最后，NewSID 必须更新 ProfileList 子项以便引用新的帐户 SID。为了使 Windows NT 帐户能够在更改 SID 以反映新的计算机 SID 后正确地将配置文件与用户帐户相关联，需要执行此步骤。
NewSID 通过给予自身以下权限，确保它能够访问和修改系统中的每个文件和注册表项：系统、备份、还原和取得所有权。
返回页首
1.8 使用源代码
本文作者已提供了 NewSID 的完整源代码，以便用于教学目的。禁止在商业产品和免费的 SID 更改软件产品中使用这些代码，但允许在其他专用或商用程序中使用其技术。
http://download.sysinternals.com/Files/NewSid.zip
2008年12月4日星期四
修改系统SID的方法
1 前言
SID也就是安全标识符（Security Identifiers），是标识用户、组和计算机帐户的唯一的号码。在第一次创建该帐户时，将给网络上的每一个帐户发布一个唯一的 SID。Windows 2003 中的内部进程将引用帐户的 SID 而不是帐户的用户或组名。如果创建帐户，再删除帐户，然后使用相同的用户名创建另一个帐户，则新帐户将不具有授权给前一个帐户的权力或权限，原因是该帐户具有不同的 SID 号。安全标识符也被称为安全 ID 或 SID。
2 SID的作用
用户通过验证后，登陆进程会给用户一个访问令牌，该令牌相当于用户访问系统资源的票证，当用户试图访问系统资源时，将访问令牌提供给 Windows NT，然后 Windows NT 检查用户试图访问对象上的访问控制列表。如果用户被允许访问该对象，Windows NT将会分配给用户适当的访问权限。
访问令牌是用户在通过验证的时候有登陆进程所提供的，所以改变用户的权限需要注销后重新登陆，重新获取访问令牌。
3 SID号码的组成
如果存在两个同样SID的用户，这两个帐户将被鉴别为同一个帐户，原理上如果帐户无限制增加的时候，会产生同样的SID，在通常的情况下SID是唯一的，他由计算机名、当前时间、当前用户态线程的CPU耗费时间的总和三个参数决定以保证它的唯一性。
一个完整的SID包括：
用户和组的安全描述
48-bit的ID authority
修订版本
可变的验证值Variable sub-authority values
例：S-1-5-21-310440588-250036847-580389505-500
我们来先分析这个重要的SID。第一项S表示该字符串是SID；第二项是SID的版本号，对于2000来说，这个就是1；然后是标志符的颁发机构（identifier authority），对于2000内的帐户，颁发机构就是NT，值是5。然后表示一系列的子颁发机构，前面几项是标志域的，最后一个标志着域内的帐户和组。
4 SID重复引发的域管理问题
如果使用镜像工具拷贝建立的系统，会因为SID重复而导致加入到域后出现异常，如下图所示：
这样登录就会出现问题，故此，需要修改SID。
注：引发的其他问题及详细说明请参考NewSID4.1
5 修改SID
微软为了提供对批量安装操作系统（比如RIS、BDD）的支持，在收购SysInternals之后，推出了基于NTSID、修改SID及相关引用的工具――NewSID，目前最新版本是4.1。
下载地址：http://download.sysinternals.com/Files/NewSid.zip
关于4.1的说明请参考另外一篇帖子NewSID4.1，这里仅给出如何使用基于GUI的操作过程。
可以使用自己指定的SID，建立规则参考前面部分，默认是使用随机生成的SID，推荐使用。
附带了修改机器名称的功能。
修改完成后，NewSID会把系统中引用该SID的地方一一修改，安装的软件越多，修改时间就会越长；默认完成后自动重起。
6 注意事项
尽量在副本系统创建之后就进行SID修改工作，不要等到加入域后再修改
对已建立成为域控制器的机器（DC）未作过有效测试，使用要慎重。
SID也就是安全标识符（Security Identifiers），是标识用户、组和计算机帐户的唯一的号码。在第一次创建该帐户时，将给网络上的每一个帐户发布一个唯一的 SID。Windows 2003 中的内部进程将引用帐户的 SID 而不是帐户的用户或组名。如果创建帐户，再删除帐户，然后使用相同的用户名创建另一个帐户，则新帐户将不具有授权给前一个帐户的权力或权限，原因是该帐户具有不同的 SID 号。安全标识符也被称为安全 ID 或 SID。
2 SID的作用
用户通过验证后，登陆进程会给用户一个访问令牌，该令牌相当于用户访问系统资源的票证，当用户试图访问系统资源时，将访问令牌提供给 Windows NT，然后 Windows NT 检查用户试图访问对象上的访问控制列表。如果用户被允许访问该对象，Windows NT将会分配给用户适当的访问权限。
访问令牌是用户在通过验证的时候有登陆进程所提供的，所以改变用户的权限需要注销后重新登陆，重新获取访问令牌。
3 SID号码的组成
如果存在两个同样SID的用户，这两个帐户将被鉴别为同一个帐户，原理上如果帐户无限制增加的时候，会产生同样的SID，在通常的情况下SID是唯一的，他由计算机名、当前时间、当前用户态线程的CPU耗费时间的总和三个参数决定以保证它的唯一性。
一个完整的SID包括：
用户和组的安全描述
48-bit的ID authority
修订版本
可变的验证值Variable sub-authority values
例：S-1-5-21-310440588-250036847-580389505-500
我们来先分析这个重要的SID。第一项S表示该字符串是SID；第二项是SID的版本号，对于2000来说，这个就是1；然后是标志符的颁发机构（identifier authority），对于2000内的帐户，颁发机构就是NT，值是5。然后表示一系列的子颁发机构，前面几项是标志域的，最后一个标志着域内的帐户和组。
4 SID重复引发的域管理问题
如果使用镜像工具拷贝建立的系统，会因为SID重复而导致加入到域后出现异常，如下图所示：
这样登录就会出现问题，故此，需要修改SID。
注：引发的其他问题及详细说明请参考NewSID4.1
5 修改SID
微软为了提供对批量安装操作系统（比如RIS、BDD）的支持，在收购SysInternals之后，推出了基于NTSID、修改SID及相关引用的工具――NewSID，目前最新版本是4.1。
下载地址：http://download.sysinternals.com/Files/NewSid.zip
关于4.1的说明请参考另外一篇帖子NewSID4.1，这里仅给出如何使用基于GUI的操作过程。
可以使用自己指定的SID，建立规则参考前面部分，默认是使用随机生成的SID，推荐使用。
附带了修改机器名称的功能。
修改完成后，NewSID会把系统中引用该SID的地方一一修改，安装的软件越多，修改时间就会越长；默认完成后自动重起。
6 注意事项
尽量在副本系统创建之后就进行SID修改工作，不要等到加入域后再修改
对已建立成为域控制器的机器（DC）未作过有效测试，使用要慎重。
[转载]扩大esx上vm的硬盘空间
在esx上如果你的vm，使用空间不够，最简单的办法，就是给这个vm添加块硬盘，就和普通机器一样。这个过程vm是不需要关机的。
通常我的做法是，创建一个2003的vm，给他6G的空间，就一个盘，作为系统盘，把它做成模板。这样你就可以通过模板发布了。可以通过给这个vm添加硬盘的方式解决空间问题。
不过现在如果我希望扩大我的系统盘的空间，那么我们可以这样做
ssh到服务器上，进入那个vm的目录下
vmkfstools -X 10G aaa.vmdk
容易犯的错误，认为增加4g就可以到10G
vmkfstools -X 4G aaa.vmdk
结果是错误的，所以大家记住，X后的那个是最终的大小。
运行完命令后，那个文件就改成10G
盘是扩大了，但系统盘还是原来的大小，怎么调整系统盘的大小呢。有2种方法
方法1，使用调整分区大小的软件
http://hi.baidu.com/chenshake/blog/item/2b004a2cc0fac2ee8a139998.html
启动vm，安装这个软件，你就可以调整了。
方法2，使用微软自带的工具diskpart
但这个工具是不能调整启动盘的大小的，所以采用变通的办法，把这个vm的disk，挂到另外一个vm上，启动另外一个vm，在上面运行diskpart,来调整这个vm的第二块硬盘的空间。再删除第二块硬盘。
http://www.vmprofessional.com/index.php?content=2k3resize
下面是过程截图
看看结果，启动vm
通常我的做法是，创建一个2003的vm，给他6G的空间，就一个盘，作为系统盘，把它做成模板。这样你就可以通过模板发布了。可以通过给这个vm添加硬盘的方式解决空间问题。
不过现在如果我希望扩大我的系统盘的空间，那么我们可以这样做
ssh到服务器上，进入那个vm的目录下
vmkfstools -X 10G aaa.vmdk
容易犯的错误，认为增加4g就可以到10G
vmkfstools -X 4G aaa.vmdk
结果是错误的，所以大家记住，X后的那个是最终的大小。
运行完命令后，那个文件就改成10G
盘是扩大了，但系统盘还是原来的大小，怎么调整系统盘的大小呢。有2种方法
方法1，使用调整分区大小的软件
http://hi.baidu.com/chenshake/blog/item/2b004a2cc0fac2ee8a139998.html
启动vm，安装这个软件，你就可以调整了。
方法2，使用微软自带的工具diskpart
但这个工具是不能调整启动盘的大小的，所以采用变通的办法，把这个vm的disk，挂到另外一个vm上，启动另外一个vm，在上面运行diskpart,来调整这个vm的第二块硬盘的空间。再删除第二块硬盘。
http://www.vmprofessional.com/index.php?content=2k3resize
下面是过程截图
看看结果，启动vm
[转载]网络未连接或启动
互联网可以上去，但是局域网访问会出现“网络未连接或启动”的错误提示，
也无法更改网络标识，这种故障是网络服务没有启动所致。
可以通过开始-运行-services.msc进入“服务”窗口，启动Server、workstation和
computer browser服务。
如果“服务”窗口窗口找不到这两项服务，那么就需要在网络邻居-本地连接的
属性里面卸载并重装“microsoft 网络客户端”，“microsoft 网络的文件和
打印机共享”，“internet 协议（tcp/ip)”三项组件。
也无法更改网络标识，这种故障是网络服务没有启动所致。
可以通过开始-运行-services.msc进入“服务”窗口，启动Server、workstation和
computer browser服务。
如果“服务”窗口窗口找不到这两项服务，那么就需要在网络邻居-本地连接的
属性里面卸载并重装“microsoft 网络客户端”，“microsoft 网络的文件和
打印机共享”，“internet 协议（tcp/ip)”三项组件。
[转载]XP下使用2003的“管理工具”中的“远程桌面”
方法一：
安装2003中的adminpak.msi，远程桌面可用了，但是附带也安装了一大堆
的管理工具；
方法二：
1、从Windows Server 2003 %systemroot%\system32\下拷贝 mstsmmc.dll
和 mstsmhst.dll 到 Windows XP System32目录下；
2、在Windows XP 上运行： Regsvr32 mstsmmc.dll 和 Regsvr32
mstsmhst.dll，确认注册DLL文件成功；
3、在Windows XP 上运行 MMC，然后添加“远程桌面”管理单元即可使用
，可以保存MSC文件以备后用。
方法三：
用远程桌面连接输入了完全的信息和设置后，你可以将其另存为rdp文件，
然后用记事本或者其他文本编辑程序直接打开该rdp程序，修改rdp文件，将头
部几行替换为
screen mode id:i:1
desktopwidth:i:1000
desktopheight:i:700
session bpp:i:15
winposstr:s:0,1,1,11,9999,9999
保存后，然后打开这个rdp文件就能够直接连接到服务器，并且用自己指定
长宽度，像这个信息里面就是让远程桌面连接窗口为1000*700,这样在1024*768
的桌面环境上，打开一堆1000*700的窗口还是挺方便切换的
注意上文中“远程桌面”和“远程桌面连接”是两个不同的工具。
安装2003中的adminpak.msi，远程桌面可用了，但是附带也安装了一大堆
的管理工具；
方法二：
1、从Windows Server 2003 %systemroot%\system32\下拷贝 mstsmmc.dll
和 mstsmhst.dll 到 Windows XP System32目录下；
2、在Windows XP 上运行： Regsvr32 mstsmmc.dll 和 Regsvr32
mstsmhst.dll，确认注册DLL文件成功；
3、在Windows XP 上运行 MMC，然后添加“远程桌面”管理单元即可使用
，可以保存MSC文件以备后用。
方法三：
用远程桌面连接输入了完全的信息和设置后，你可以将其另存为rdp文件，
然后用记事本或者其他文本编辑程序直接打开该rdp程序，修改rdp文件，将头
部几行替换为
screen mode id:i:1
desktopwidth:i:1000
desktopheight:i:700
session bpp:i:15
winposstr:s:0,1,1,11,9999,9999
保存后，然后打开这个rdp文件就能够直接连接到服务器，并且用自己指定
长宽度，像这个信息里面就是让远程桌面连接窗口为1000*700,这样在1024*768
的桌面环境上，打开一堆1000*700的窗口还是挺方便切换的
注意上文中“远程桌面”和“远程桌面连接”是两个不同的工具。
2008年12月2日星期二
FAQ: SQL2000 - Log shipping
http://support.microsoft.com/kb/314515/EN-US/
Frequently asked questions - SQL Server 2000 - Log shipping
View products that this article applies to.
This article was previously published under Q314515
On This PageSUMMARY
MORE INFORMATION
Log shipping set up
Log shipping security considerations
Log shipping monitoring
Log shipping role change
Log shipping removal
REFERENCES
Expand all | Collapse all
SUMMARYThis article discusses several aspects of log shipping and answers the most comm...This article discusses several aspects of log shipping and answers the most commonly asked questions regarding setup, security, monitoring, role-change and the removal of log shipping in SQL Server 2000 Enterprise Edition.
Back to the top
MORE INFORMATIONLog shipping in SQL Server 2000 provides a means of establishing a warm back up...Log shipping in SQL Server 2000 provides a means of establishing a warm back up solution by using the SQL Server Maintenance Plan Wizard. Transaction log backups from a database can be automatically shipped to a different server and applied to a standby database. You can use the standby database to perform read-only operations (depending on the load state).
Log shipping set up
Q1: What edition of SQL Server do I have to have to set up log shipping?
A1: The following matrix shows the edition of SQL Server that is required for the three components that participate in log shipping:
Collapse this tableExpand this table
Component Edition of SQL Server required
Primary Server Enterprise or Developer Edition
Secondary Server Enterprise or Developer Edition
Monitor Server Any Edition
Q2: What do I have to do before I start the log shipping set up through SQL Server Enterprise Manager?
A2: Here is the list of what you must do before you start log shipping in SQL Server 2000.
Either start SQL Server and SQL Server Agent services under a domain account or configure the relevant primary, secondary and monitor servers for pass-through security (see question three in this heading for more information).
You can set up log shipping from any computer that has SQL Server Enterprise Manager (SEM) installed. You must register all computers that are running SQL Server that function as servers, which are intended to be the secondary servers, through SEM, on the computer from which log shipping is going to be set up.
Create a folder on the primary server for the transaction log back ups. You can create this folder anywhere on the primary computer. There must be enough free disk space on the drive on which you place the folder to hold at least one days worth of transaction log back ups. The exact space required is not easy to predict because it depends on the size and frequency of the transaction log back ups for the database. Microsoft recommends that you create a different folder for each database that you log ship.
Share the folders you created in the previous step. Make sure that you grant READ and CHANGE permissions to the Microsoft Windows NT accounts under which SQL Server and SQL Server Agent services are started for the servers that participate in log shipping. If you use pass-through security, grant these permissions to the local Windows NT account, under which the SQL Server related services are started.
Remove or disable any transaction log back up jobs on the databases that will be log shipped. This includes any third party back up jobs.
Q3: Do I have to start SQL Server related services under a domain account as opposed to a local Windows NT account?
A3: It is possible to configure SQL Server services to start under a local Windows NT account, unless SQL Server is configured to run as a virtual server in conjunction with Microsoft Cluster Service. You can use Windows NT pass-through security for this purpose. Follow these steps to configure pass-through security:
Create a Windows NT account on the primary, secondary and monitor computers with the same name and passwords.
Configure SQL Server related services to start under these Windows NT accounts on all computers.
The SQL Server services must be started under a domain account if SQL Server is configured to run as a virtual server with Microsoft Cluster Service. Even if SQL Server is a virtual server, Microsoft recommends that you use a domain account to start the services when SQL Server computers are in a domain. You gain the following advantage by having SQL Server related services start under a domain account:
Change of password for the SQL Server start up account will not result in a failure of log shipping jobs. To successfully continue log shipping in a pass-through security situation, all the servers must have the password changed for the Windows NT start up account, at the same time.
Q4: Where can I set up log shipping from?
A4: In SQL Server Enterprise Manager, right-click the database for which log shipping has to be set up, and then click Maintenance Plan. In the Welcome dialog box, click Next. Click to select the Ship the transaction log to other SQL Servers (log shipping) check box. The check box indicates to the SQL Server Maintenance Plan Wizard that this database must have log shipping. You can perform this step from a client that has SQL Server Enterprise Manager installed.
Q5: Why is the log shipping check box sometimes dimmed in the Maintenance Plan dialog box?
A5: The check box can be dimmed for one of the following reasons:
Multiple databases might be selected for the Maintenance Plan.
The database that is selected is not in the Full or Bulk Logged Recovery model.
SQL Server 2000 Enterprise Edition is not installed on the server.
Q6: Why does the log shipping set up fail while performing the initial configuration?
A6: There are several reasons that may cause the log shipping set up to fail. At this time there is at least one known problem that causes this behavior. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
298743 (http://support.microsoft.com/kb/298743/ ) BUG: All changes may not be rolled back when Log Shipping Maintenance Wizard fails
Q7: Are the table schema and database file structure changes propagated to the secondary server?
A7: In SQL Server 2000, all table schema and database file structure changes are logged operations. However, if a new NDF or LDF file is added to the primary database, the transaction log restore job fails while loading the transaction log backup that was performed immediately after the database file was added to the primary database. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
286280 (http://support.microsoft.com/kb/286280/ ) Description of the effect to database recovery after you add or remove database files
Q8: Can I script log shipping?
A8: No. Currently, it is not possible to script log shipping. The only supported means of setting up log shipping is through the wizard as described in question 4 of this section.
Q9: Can I set up log shipping between servers in multiple domains?
A9: Yes. It is possible to set up log shipping between servers that are in separate domains. There are two ways to do this:
Use pass-through security. Configure Windows NT accounts with the same name and passwords on the primary, secondary and monitor servers. Configure SQL Server related services to start under these accounts on all servers and use SQL authentication while setting up log shipping to connect to the monitor server. -or-
Use conventional Windows NT security. You must configure the domains with two-way trusts. SQL Server related services can be started under domain accounts. Either SQL authentication or Windows authentication can be used by jobs on the primary and secondary servers to connect to the monitor server. All other requirements are the same as explained in question 2 of this section.
Q10: Can I configure primary and secondary servers to use SQL authentication to connect to the monitor server?
A10: Yes. It is possible to use either Windows or SQL authentication for primary and secondary servers to connect to the monitor server. Microsoft recommends that you use Windows authentication for this purpose. However, if it is not possible to use Windows authentication, you can use SQL authentication. SQL Server will create a "log_shipping_monitor_probe" account on the primary, secondary and monitor servers, if it does not already exist, with the password specified when you set up log shipping. If SQL authentication is used for log shipping, you must configure SQL Server on the primary, secondary and monitor servers to use Mixed Mode authentication.
Log shipping security considerations
Q1: If I make the "guest" account unavailable before setting up log shipping, and I want my secondary database to be in a standby state, how can I allow users to have access to the secondary database (enforcing the same security model as the primary server)?
A1: The "guest" account must not be removed from SQL Server for any reason. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
315523 (http://support.microsoft.com/kb/315523/ ) Removal of the guest account may cause a 916 error in SQL Server 2000 SP4 or a handled exception access violation in earlier versions of SQL Server 2000
However, you can can make the "guest" account unavailable for databases where there might be security concerns. Because the secondary database is in a standby state, it is not possible to use the sp_change_users_login (http://msdn2.microsoft.com/en-us/library/aa259633(SQL.80).aspx) stored procedure to re-map the logins appropriately. To enforce the same security model on a standby database, create the logins on the secondary server by using the same security identifier (SID) value as the primary server. Read the following Microsoft Knowledge Base article for more information about creating logins with the same SID values:
303722 (http://support.microsoft.com/kb/303722/ ) How to grant access to SQL logins on a standby database when the guest user is disabled in SQL Server
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
321247 (http://support.microsoft.com/kb/321247/ ) How to configure security for SQL Server log shipping
Q2: What does sp_resolve_logins do?
A2: At the time of the log shipping role change, the sp_resolve_logins (http://msdn2.microsoft.com/en-us/library/aa238877(SQL.80).aspx) stored procedure requires a BCP file of the syslogins system table from the primary server. This stored procedure loads the BCP file into the temporary table and loops through each login to verify if a login with the same name exists in the secondary server's syslogins system table. It then checks to see if the SID value for this login exists in the secondary database's sysusers system table. It finally checks to see if the SID value in secondary database's sysusers system table is not the same as the SID value in the secondary server's syslogins table. If these checks are satisfied, the sp_resolve_logins stored procedure runs the sp_Change_users_login stored procedure for that login, and fixes the SID in the secondary database's sysusers system table. Execution of this stored procedure is required only if there are new logins created on the primary server after log shipping has been initialized and those same logins are not created on the secondary servers with the same SID (as described in Microsoft Knowledge Base article Q303722).
Q3: The sp_resolve_logins stored procedure runs successfully; however, it does not perform the expected modifications to the security on the secondary server. Why?
A3: The sp_resolve_logins stored procedure requires an up-to-date BCP file of the primary server's syslogins system table. These logins must already by created on the secondary server. If these two conditions are met, the sp_resolve_logins stored procedure performs the modifications to the sysusers system table in the secondary database.
Q4: Do I have to run a Transfer Logins DTS task in conjunction with the sp_resolve_logins stored procedure before performing the role change?
A4: Yes. You must use the Transfer Logins task to make sure that the logins exist in the syslogins system table on the secondary server. This does not guarantee that the user can use the secondary database (if the secondary database is loaded in standby mode). If the user has to use the secondary database before performing the log shipping role change, see question 1 in this section.
Q5: Does the sp_resolve_logins stored procedure work for remote logins in SQL Server?
A5: No. The sp_resolve_logins stored procedure only works for typical logins. Any remote logins must be created manually on the secondary server.
Log shipping monitoring
Q1: Log Shipping Backup and Out of Sync alerts are firing, even when the secondary server is updated with the transaction log backups. Is this possible?
A1: Yes. It is possible that the alerts might fire even when the secondary database is being updated. If the alert threshold is set to a value less than double the time between back up and copy or restore jobs, the alerts might be raised. If the alerts are being raised and the threshold is close to or less than two times the time between subsequent backup and copy or restore jobs, go ahead and increase the threshold.
Q2: Why do the transaction log backups fail to restore on the secondary server?
A2: Transaction Log backups can only be restored if they are in a sequence. This sequence is determined by the LastLSN and FirstLSN fields that are returned by the RESTORE HEADERONLY (http://msdn2.microsoft.com/en-us/library/aa238455(SQL.80).aspx) command. If the LastLSN field and the FirstLSN field do not display the same number on consecutive transaction log backups, they are not restorable in that sequence. There may be several reasons for transaction log backups to be out of sequence. Some of the most common reasons are:
There are redundant transaction log backup jobs on the primary server that are causing the sequence to be broken.
There are non-logged operations performed in the database. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
272093 (http://support.microsoft.com/kb/272093/ ) Description of the effects of nonlogged and minimally logged operations on transaction log backup and the restore process in SQL Server
The recovery model of the database was probably toggled between transaction log backups.
The Data Transformation Services (DTS) task on the primary server might be causing this problem. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
308267 (http://support.microsoft.com/kb/308267/ ) FIX: DTS Copy Objects Task (DMO) breaks transaction log backup chain by switching recovery mode to Simple during transfer
Q3: Where can I find information about errors while performing back up, copy or restore operations?
A3: To get more information about a particular log shipping pair, follow these steps:
Open SQL Server Enterprise Manager, and then connect to the monitor server.
Under Management, click Log Shipping Monitor. In the right window pane, all the log shipping pairs are displayed (that have been configured with this server as the monitor server). If the log shipping pair is not visible, right-click the Log Shipping Monitor (under Management), and then click Refresh.
Right-click the log shipping pair that you want information about, and then click View Backup History to view the back up job history.
Right-click the log shipping pair, and then click View Copy/Restore History to view the history for copy and restore jobs.
Right-click the log shipping pair, and then click Properties to view the current log shipping status, Source, and Destination alert status.
Q4: Does the file name first_file_000000000000.trn indicate that the copy or restore job was unsuccessful?
A4: Each run of the copy and restore job is associated with at least one file. By default, if no files are copied or restored in a certain run of any of these two jobs, SQL Server places first_file_000000000000.trn in the file name field. This may or may not indicate a problem. For example, the very first time that copy or restore jobs are run on the secondary server, there might not be any files available to copy or restore. In this case, first_file_000000000000.trn does not necessarily represent an error. However, under certain circumstances, this might represent a problem. Read the following Microsoft Knowledge Base article for more information:
292586 (http://support.microsoft.com/kb/292586/ ) Backup, copy, and load job information is not updated on the log shipping monitor
Q5: Is it possible to modify the frequency and destination of the transaction log backups, on the primary server, after log shipping has been operational for a while?
A5: Yes. This information is in the Maintenance Plan on the primary server. To view the information, follow these steps:
Double-click the Maintenance Plan on the primary server for the database for which this information must be modified.
Click the Transaction Log Backup tab. Modify the destination and frequency in the dialog box.
Because the copy job on the secondary server is expecting to copy transaction log backups from the share specified at the time log shipping was set up, this job might fail after modifying the target folder for the transaction log back ups. For more information about how to work around this problem, read the following article in the Microsoft Knowledge Base:
314570 (http://support.microsoft.com/kb/314570/ ) Cannot modify backup network share after you change the transaction log backup folder
Log shipping role change
Q1: How do I perform a log shipping role change?
A1: Click the following link to read the SQL Server 2000 Books Online topic about performing a log shipping role change:
How to set up and perform a log shipping role change (Transact-SQL) (http://msdn2.microsoft.com/en-us/library/aa215392(SQL.80).aspx)
Q2: Can I perform a role change while the primary server is offline or unavailable?
A2: Yes. Running the sp_change_primary_role (http://msdn2.microsoft.com/en-us/library/aa259617(SQL.80).aspx) stored procedure on the primary server is optional.
Q3: Why does the sp_resolve_logins stored procedure fail with error message 208 when run from the secondary database at the time of a role change?
A3: The sp_resolve_logins stored procedure does not qualify the sysusers system table with the master database prefix. This is a known problem with the code for the sp_resolve_logins stored procedure. For more information about this problem, read the following article in the Microsoft Knowledge Base:
310882 (http://support.microsoft.com/kb/310882/ ) BUG: sp_resolve_logins stored procedure fails if executed during log shipping role change
Q4: Is there a problem when promoting a secondary server to be a primary server, when there are multiple secondary servers involved in a role change?
A4: Read the following Microsoft Knowledge Base article about a known problem that can cause errors while performing a role change that involves multiple secondary servers:
300497 (http://support.microsoft.com/kb/300497/ ) FIX: Log shipping: Cannot change role from secondary to primary when database names are different
Q5: How can I re-establish log shipping after promoting the secondary server to be the primary server?
A5: If the Allow database to assume Primary role check box is selected, while setting up log shipping, in the Add Destination Database dialog box, follow these steps to add a new secondary server after performing a role change. If the setting was not selected, use the Maintenance Plan Wizard to set up log shipping after a role change.
Open SQL Server Enterprise Manager, and then connect to the promoted primary server. Register the server that you intend to add as the secondary server.
Expand Management (in SQL Server Enterprise Manager), and then click Maintenance Plans. Right-click the appropriate Maintenance Plan from the list, and then click Properties.
Click the Log Shipping tab, and then click Add.
Provide the appropriate information regarding the secondary server about this dialog box, and then click OK. This will add the new secondary server to log shipping.
Q6: How can I continue to log ship to the former primary server without restoring a database backup?
A6: It is possible to log ship between two servers repeatedly without having to restore the complete database backup. The requirement is that both the primary and secondary servers are available when you perform the role change procedure. As part of performing the role change, you must run the sp_change_primary_role (http://msdn.microsoft.com/en-us/library/aa259617.aspx) stored procedure. You must run the sp_change_primary_role stored procedure with a @final_state parameter of either 2 or 3. This will leave the primary database in an unrecovered state after performing the transaction log back up. Because the database is left in an unrecovered state, this database can be selected when the log shipping destination is added (as explained in the previous question). This way you do not have to reload a database backup.
Log shipping removal
Q1: How can I stop log shipping for a particular log shipping pair?
A1: Follow these steps to remove a log shipping pair:
Open the SQL Server Enterprise Manager on the primary server. Expand Management, and then click Maintenance Plan. Right-click the Maintenance Plan, and then click Properties.
Click the Log Shipping tab, and then click to select the log shipping pair that you want to remove.
Click the Delete command button to remove this pair from log shipping. If this is the last pair in log shipping, clicking Delete removes log shipping. If you want to continue log shipping to a different server or to a database, click Add. Then, click to select the appropriate server or database to act as the secondary server before you remove the existing log shipping secondary.
Q2: Is there a problem with removing log shipping for a database that has special characters in it's name?
A2: Read the following Microsoft Knowledge Base article, which discusses this problem in more detail:
295936 (http://support.microsoft.com/kb/295936/ ) FIX: Error removing log shipping on secondary database when database name has a quote
Back to the top
REFERENCES
For more information about log shipping, visit the following Microsoft Web sites:
How to setup log shipping (white paper)
http://support.microsoft.com/support/sql/content/2000papers/LogShippingFinal.asp (http://support.microsoft.com/?scid=http%3a%2f%2fsupport.microsoft.com%2fsupport%2fsql%2fcontent%2f2000papers%2flogshippingfinal.asp)
Log shipping
http://msdn2.microsoft.com/en-us/library/aa213785(SQL.80).aspx (http://msdn2.microsoft.com/en-us/library/aa213785(SQL.80).aspx)
275146 (http://support.microsoft.com/kb/275146/ ) Frequently asked questions - SQL Server 7.0 - Log shipping
Didn't see an answer to your question? Visit the Microsoft SQL Server Newsgroups at:
Microsoft SQL Server Newsgroupshttp://www.microsoft.com/communities/newsgroups/en-us/ (http://www.microsoft.com/communities/newsgroups/en-us/)
Comments about this or other Microsoft Knowledge Base articles? Drop us a note at SQLKB@Microsoft.com (mailto:sqlkb@microsoft.com) .
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
917544 (http://support.microsoft.com/kb/917544/ ) BUG: You receive an error message when you run the "Log Shipping Alert Job - Restore" job in SQL Server 2000
Back to the top
--------------------------------------------------------------------------------
APPLIES TO
Microsoft SQL Server 2000 Enterprise Edition
Microsoft SQL Server 2000 Developer Edition
Back to the top
Keywords: kbinfo KB314515
Back to the top
Frequently asked questions - SQL Server 2000 - Log shipping
View products that this article applies to.
This article was previously published under Q314515
On This PageSUMMARY
MORE INFORMATION
Log shipping set up
Log shipping security considerations
Log shipping monitoring
Log shipping role change
Log shipping removal
REFERENCES
Expand all | Collapse all
SUMMARYThis article discusses several aspects of log shipping and answers the most comm...This article discusses several aspects of log shipping and answers the most commonly asked questions regarding setup, security, monitoring, role-change and the removal of log shipping in SQL Server 2000 Enterprise Edition.
Back to the top
MORE INFORMATIONLog shipping in SQL Server 2000 provides a means of establishing a warm back up...Log shipping in SQL Server 2000 provides a means of establishing a warm back up solution by using the SQL Server Maintenance Plan Wizard. Transaction log backups from a database can be automatically shipped to a different server and applied to a standby database. You can use the standby database to perform read-only operations (depending on the load state).
Log shipping set up
Q1: What edition of SQL Server do I have to have to set up log shipping?
A1: The following matrix shows the edition of SQL Server that is required for the three components that participate in log shipping:
Collapse this tableExpand this table
Component Edition of SQL Server required
Primary Server Enterprise or Developer Edition
Secondary Server Enterprise or Developer Edition
Monitor Server Any Edition
Q2: What do I have to do before I start the log shipping set up through SQL Server Enterprise Manager?
A2: Here is the list of what you must do before you start log shipping in SQL Server 2000.
Either start SQL Server and SQL Server Agent services under a domain account or configure the relevant primary, secondary and monitor servers for pass-through security (see question three in this heading for more information).
You can set up log shipping from any computer that has SQL Server Enterprise Manager (SEM) installed. You must register all computers that are running SQL Server that function as servers, which are intended to be the secondary servers, through SEM, on the computer from which log shipping is going to be set up.
Create a folder on the primary server for the transaction log back ups. You can create this folder anywhere on the primary computer. There must be enough free disk space on the drive on which you place the folder to hold at least one days worth of transaction log back ups. The exact space required is not easy to predict because it depends on the size and frequency of the transaction log back ups for the database. Microsoft recommends that you create a different folder for each database that you log ship.
Share the folders you created in the previous step. Make sure that you grant READ and CHANGE permissions to the Microsoft Windows NT accounts under which SQL Server and SQL Server Agent services are started for the servers that participate in log shipping. If you use pass-through security, grant these permissions to the local Windows NT account, under which the SQL Server related services are started.
Remove or disable any transaction log back up jobs on the databases that will be log shipped. This includes any third party back up jobs.
Q3: Do I have to start SQL Server related services under a domain account as opposed to a local Windows NT account?
A3: It is possible to configure SQL Server services to start under a local Windows NT account, unless SQL Server is configured to run as a virtual server in conjunction with Microsoft Cluster Service. You can use Windows NT pass-through security for this purpose. Follow these steps to configure pass-through security:
Create a Windows NT account on the primary, secondary and monitor computers with the same name and passwords.
Configure SQL Server related services to start under these Windows NT accounts on all computers.
The SQL Server services must be started under a domain account if SQL Server is configured to run as a virtual server with Microsoft Cluster Service. Even if SQL Server is a virtual server, Microsoft recommends that you use a domain account to start the services when SQL Server computers are in a domain. You gain the following advantage by having SQL Server related services start under a domain account:
Change of password for the SQL Server start up account will not result in a failure of log shipping jobs. To successfully continue log shipping in a pass-through security situation, all the servers must have the password changed for the Windows NT start up account, at the same time.
Q4: Where can I set up log shipping from?
A4: In SQL Server Enterprise Manager, right-click the database for which log shipping has to be set up, and then click Maintenance Plan. In the Welcome dialog box, click Next. Click to select the Ship the transaction log to other SQL Servers (log shipping) check box. The check box indicates to the SQL Server Maintenance Plan Wizard that this database must have log shipping. You can perform this step from a client that has SQL Server Enterprise Manager installed.
Q5: Why is the log shipping check box sometimes dimmed in the Maintenance Plan dialog box?
A5: The check box can be dimmed for one of the following reasons:
Multiple databases might be selected for the Maintenance Plan.
The database that is selected is not in the Full or Bulk Logged Recovery model.
SQL Server 2000 Enterprise Edition is not installed on the server.
Q6: Why does the log shipping set up fail while performing the initial configuration?
A6: There are several reasons that may cause the log shipping set up to fail. At this time there is at least one known problem that causes this behavior. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
298743 (http://support.microsoft.com/kb/298743/ ) BUG: All changes may not be rolled back when Log Shipping Maintenance Wizard fails
Q7: Are the table schema and database file structure changes propagated to the secondary server?
A7: In SQL Server 2000, all table schema and database file structure changes are logged operations. However, if a new NDF or LDF file is added to the primary database, the transaction log restore job fails while loading the transaction log backup that was performed immediately after the database file was added to the primary database. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
286280 (http://support.microsoft.com/kb/286280/ ) Description of the effect to database recovery after you add or remove database files
Q8: Can I script log shipping?
A8: No. Currently, it is not possible to script log shipping. The only supported means of setting up log shipping is through the wizard as described in question 4 of this section.
Q9: Can I set up log shipping between servers in multiple domains?
A9: Yes. It is possible to set up log shipping between servers that are in separate domains. There are two ways to do this:
Use pass-through security. Configure Windows NT accounts with the same name and passwords on the primary, secondary and monitor servers. Configure SQL Server related services to start under these accounts on all servers and use SQL authentication while setting up log shipping to connect to the monitor server. -or-
Use conventional Windows NT security. You must configure the domains with two-way trusts. SQL Server related services can be started under domain accounts. Either SQL authentication or Windows authentication can be used by jobs on the primary and secondary servers to connect to the monitor server. All other requirements are the same as explained in question 2 of this section.
Q10: Can I configure primary and secondary servers to use SQL authentication to connect to the monitor server?
A10: Yes. It is possible to use either Windows or SQL authentication for primary and secondary servers to connect to the monitor server. Microsoft recommends that you use Windows authentication for this purpose. However, if it is not possible to use Windows authentication, you can use SQL authentication. SQL Server will create a "log_shipping_monitor_probe" account on the primary, secondary and monitor servers, if it does not already exist, with the password specified when you set up log shipping. If SQL authentication is used for log shipping, you must configure SQL Server on the primary, secondary and monitor servers to use Mixed Mode authentication.
Log shipping security considerations
Q1: If I make the "guest" account unavailable before setting up log shipping, and I want my secondary database to be in a standby state, how can I allow users to have access to the secondary database (enforcing the same security model as the primary server)?
A1: The "guest" account must not be removed from SQL Server for any reason. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
315523 (http://support.microsoft.com/kb/315523/ ) Removal of the guest account may cause a 916 error in SQL Server 2000 SP4 or a handled exception access violation in earlier versions of SQL Server 2000
However, you can can make the "guest" account unavailable for databases where there might be security concerns. Because the secondary database is in a standby state, it is not possible to use the sp_change_users_login (http://msdn2.microsoft.com/en-us/library/aa259633(SQL.80).aspx) stored procedure to re-map the logins appropriately. To enforce the same security model on a standby database, create the logins on the secondary server by using the same security identifier (SID) value as the primary server. Read the following Microsoft Knowledge Base article for more information about creating logins with the same SID values:
303722 (http://support.microsoft.com/kb/303722/ ) How to grant access to SQL logins on a standby database when the guest user is disabled in SQL Server
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
321247 (http://support.microsoft.com/kb/321247/ ) How to configure security for SQL Server log shipping
Q2: What does sp_resolve_logins do?
A2: At the time of the log shipping role change, the sp_resolve_logins (http://msdn2.microsoft.com/en-us/library/aa238877(SQL.80).aspx) stored procedure requires a BCP file of the syslogins system table from the primary server. This stored procedure loads the BCP file into the temporary table and loops through each login to verify if a login with the same name exists in the secondary server's syslogins system table. It then checks to see if the SID value for this login exists in the secondary database's sysusers system table. It finally checks to see if the SID value in secondary database's sysusers system table is not the same as the SID value in the secondary server's syslogins table. If these checks are satisfied, the sp_resolve_logins stored procedure runs the sp_Change_users_login stored procedure for that login, and fixes the SID in the secondary database's sysusers system table. Execution of this stored procedure is required only if there are new logins created on the primary server after log shipping has been initialized and those same logins are not created on the secondary servers with the same SID (as described in Microsoft Knowledge Base article Q303722).
Q3: The sp_resolve_logins stored procedure runs successfully; however, it does not perform the expected modifications to the security on the secondary server. Why?
A3: The sp_resolve_logins stored procedure requires an up-to-date BCP file of the primary server's syslogins system table. These logins must already by created on the secondary server. If these two conditions are met, the sp_resolve_logins stored procedure performs the modifications to the sysusers system table in the secondary database.
Q4: Do I have to run a Transfer Logins DTS task in conjunction with the sp_resolve_logins stored procedure before performing the role change?
A4: Yes. You must use the Transfer Logins task to make sure that the logins exist in the syslogins system table on the secondary server. This does not guarantee that the user can use the secondary database (if the secondary database is loaded in standby mode). If the user has to use the secondary database before performing the log shipping role change, see question 1 in this section.
Q5: Does the sp_resolve_logins stored procedure work for remote logins in SQL Server?
A5: No. The sp_resolve_logins stored procedure only works for typical logins. Any remote logins must be created manually on the secondary server.
Log shipping monitoring
Q1: Log Shipping Backup and Out of Sync alerts are firing, even when the secondary server is updated with the transaction log backups. Is this possible?
A1: Yes. It is possible that the alerts might fire even when the secondary database is being updated. If the alert threshold is set to a value less than double the time between back up and copy or restore jobs, the alerts might be raised. If the alerts are being raised and the threshold is close to or less than two times the time between subsequent backup and copy or restore jobs, go ahead and increase the threshold.
Q2: Why do the transaction log backups fail to restore on the secondary server?
A2: Transaction Log backups can only be restored if they are in a sequence. This sequence is determined by the LastLSN and FirstLSN fields that are returned by the RESTORE HEADERONLY (http://msdn2.microsoft.com/en-us/library/aa238455(SQL.80).aspx) command. If the LastLSN field and the FirstLSN field do not display the same number on consecutive transaction log backups, they are not restorable in that sequence. There may be several reasons for transaction log backups to be out of sequence. Some of the most common reasons are:
There are redundant transaction log backup jobs on the primary server that are causing the sequence to be broken.
There are non-logged operations performed in the database. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
272093 (http://support.microsoft.com/kb/272093/ ) Description of the effects of nonlogged and minimally logged operations on transaction log backup and the restore process in SQL Server
The recovery model of the database was probably toggled between transaction log backups.
The Data Transformation Services (DTS) task on the primary server might be causing this problem. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
308267 (http://support.microsoft.com/kb/308267/ ) FIX: DTS Copy Objects Task (DMO) breaks transaction log backup chain by switching recovery mode to Simple during transfer
Q3: Where can I find information about errors while performing back up, copy or restore operations?
A3: To get more information about a particular log shipping pair, follow these steps:
Open SQL Server Enterprise Manager, and then connect to the monitor server.
Under Management, click Log Shipping Monitor. In the right window pane, all the log shipping pairs are displayed (that have been configured with this server as the monitor server). If the log shipping pair is not visible, right-click the Log Shipping Monitor (under Management), and then click Refresh.
Right-click the log shipping pair that you want information about, and then click View Backup History to view the back up job history.
Right-click the log shipping pair, and then click View Copy/Restore History to view the history for copy and restore jobs.
Right-click the log shipping pair, and then click Properties to view the current log shipping status, Source, and Destination alert status.
Q4: Does the file name first_file_000000000000.trn indicate that the copy or restore job was unsuccessful?
A4: Each run of the copy and restore job is associated with at least one file. By default, if no files are copied or restored in a certain run of any of these two jobs, SQL Server places first_file_000000000000.trn in the file name field. This may or may not indicate a problem. For example, the very first time that copy or restore jobs are run on the secondary server, there might not be any files available to copy or restore. In this case, first_file_000000000000.trn does not necessarily represent an error. However, under certain circumstances, this might represent a problem. Read the following Microsoft Knowledge Base article for more information:
292586 (http://support.microsoft.com/kb/292586/ ) Backup, copy, and load job information is not updated on the log shipping monitor
Q5: Is it possible to modify the frequency and destination of the transaction log backups, on the primary server, after log shipping has been operational for a while?
A5: Yes. This information is in the Maintenance Plan on the primary server. To view the information, follow these steps:
Double-click the Maintenance Plan on the primary server for the database for which this information must be modified.
Click the Transaction Log Backup tab. Modify the destination and frequency in the dialog box.
Because the copy job on the secondary server is expecting to copy transaction log backups from the share specified at the time log shipping was set up, this job might fail after modifying the target folder for the transaction log back ups. For more information about how to work around this problem, read the following article in the Microsoft Knowledge Base:
314570 (http://support.microsoft.com/kb/314570/ ) Cannot modify backup network share after you change the transaction log backup folder
Log shipping role change
Q1: How do I perform a log shipping role change?
A1: Click the following link to read the SQL Server 2000 Books Online topic about performing a log shipping role change:
How to set up and perform a log shipping role change (Transact-SQL) (http://msdn2.microsoft.com/en-us/library/aa215392(SQL.80).aspx)
Q2: Can I perform a role change while the primary server is offline or unavailable?
A2: Yes. Running the sp_change_primary_role (http://msdn2.microsoft.com/en-us/library/aa259617(SQL.80).aspx) stored procedure on the primary server is optional.
Q3: Why does the sp_resolve_logins stored procedure fail with error message 208 when run from the secondary database at the time of a role change?
A3: The sp_resolve_logins stored procedure does not qualify the sysusers system table with the master database prefix. This is a known problem with the code for the sp_resolve_logins stored procedure. For more information about this problem, read the following article in the Microsoft Knowledge Base:
310882 (http://support.microsoft.com/kb/310882/ ) BUG: sp_resolve_logins stored procedure fails if executed during log shipping role change
Q4: Is there a problem when promoting a secondary server to be a primary server, when there are multiple secondary servers involved in a role change?
A4: Read the following Microsoft Knowledge Base article about a known problem that can cause errors while performing a role change that involves multiple secondary servers:
300497 (http://support.microsoft.com/kb/300497/ ) FIX: Log shipping: Cannot change role from secondary to primary when database names are different
Q5: How can I re-establish log shipping after promoting the secondary server to be the primary server?
A5: If the Allow database to assume Primary role check box is selected, while setting up log shipping, in the Add Destination Database dialog box, follow these steps to add a new secondary server after performing a role change. If the setting was not selected, use the Maintenance Plan Wizard to set up log shipping after a role change.
Open SQL Server Enterprise Manager, and then connect to the promoted primary server. Register the server that you intend to add as the secondary server.
Expand Management (in SQL Server Enterprise Manager), and then click Maintenance Plans. Right-click the appropriate Maintenance Plan from the list, and then click Properties.
Click the Log Shipping tab, and then click Add.
Provide the appropriate information regarding the secondary server about this dialog box, and then click OK. This will add the new secondary server to log shipping.
Q6: How can I continue to log ship to the former primary server without restoring a database backup?
A6: It is possible to log ship between two servers repeatedly without having to restore the complete database backup. The requirement is that both the primary and secondary servers are available when you perform the role change procedure. As part of performing the role change, you must run the sp_change_primary_role (http://msdn.microsoft.com/en-us/library/aa259617.aspx) stored procedure. You must run the sp_change_primary_role stored procedure with a @final_state parameter of either 2 or 3. This will leave the primary database in an unrecovered state after performing the transaction log back up. Because the database is left in an unrecovered state, this database can be selected when the log shipping destination is added (as explained in the previous question). This way you do not have to reload a database backup.
Log shipping removal
Q1: How can I stop log shipping for a particular log shipping pair?
A1: Follow these steps to remove a log shipping pair:
Open the SQL Server Enterprise Manager on the primary server. Expand Management, and then click Maintenance Plan. Right-click the Maintenance Plan, and then click Properties.
Click the Log Shipping tab, and then click to select the log shipping pair that you want to remove.
Click the Delete command button to remove this pair from log shipping. If this is the last pair in log shipping, clicking Delete removes log shipping. If you want to continue log shipping to a different server or to a database, click Add. Then, click to select the appropriate server or database to act as the secondary server before you remove the existing log shipping secondary.
Q2: Is there a problem with removing log shipping for a database that has special characters in it's name?
A2: Read the following Microsoft Knowledge Base article, which discusses this problem in more detail:
295936 (http://support.microsoft.com/kb/295936/ ) FIX: Error removing log shipping on secondary database when database name has a quote
Back to the top
REFERENCES
For more information about log shipping, visit the following Microsoft Web sites:
How to setup log shipping (white paper)
http://support.microsoft.com/support/sql/content/2000papers/LogShippingFinal.asp (http://support.microsoft.com/?scid=http%3a%2f%2fsupport.microsoft.com%2fsupport%2fsql%2fcontent%2f2000papers%2flogshippingfinal.asp)
Log shipping
http://msdn2.microsoft.com/en-us/library/aa213785(SQL.80).aspx (http://msdn2.microsoft.com/en-us/library/aa213785(SQL.80).aspx)
275146 (http://support.microsoft.com/kb/275146/ ) Frequently asked questions - SQL Server 7.0 - Log shipping
Didn't see an answer to your question? Visit the Microsoft SQL Server Newsgroups at:
Microsoft SQL Server Newsgroupshttp://www.microsoft.com/communities/newsgroups/en-us/ (http://www.microsoft.com/communities/newsgroups/en-us/)
Comments about this or other Microsoft Knowledge Base articles? Drop us a note at SQLKB@Microsoft.com (mailto:sqlkb@microsoft.com) .
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
917544 (http://support.microsoft.com/kb/917544/ ) BUG: You receive an error message when you run the "Log Shipping Alert Job - Restore" job in SQL Server 2000
Back to the top
--------------------------------------------------------------------------------
APPLIES TO
Microsoft SQL Server 2000 Enterprise Edition
Microsoft SQL Server 2000 Developer Edition
Back to the top
Keywords: kbinfo KB314515
Back to the top
2008年12月1日星期一
添加cacti用户的过程
添加cacti用户的过程
User Management\add
user name :testuser
Full Name:testuser
Password: ******
Enabled: 选中
Account Options：User Must Change Password at Next Login 选中
Email Address:testuser@test.coom
Realm Permissions：
View Graphs
View Thresholds
View Monitoring
View Host Info
Create
回到user管理界面编辑改用户：
Graph Permissions：
Graph Permissions (By Device) 将Deny->Allow
选择允许查看的Host，Add
Tree Permissions： 将Deny->Allow
选择Root，Add
SAVE
-------------
手工添加用户可查看的主机监控信息,用于批量处理用户权限
user_id在user_auth里查到
insert into user_auth_perms(user_id,item_id,type)
select "4",id,"3"
from host
where id not in (select item_id from user_auth_perms where user_id ="4")
User Management\add
user name :testuser
Full Name:testuser
Password: ******
Enabled: 选中
Account Options：User Must Change Password at Next Login 选中
Email Address:testuser@test.coom
Realm Permissions：
View Graphs
View Thresholds
View Monitoring
View Host Info
Create
回到user管理界面编辑改用户：
Graph Permissions：
Graph Permissions (By Device) 将Deny->Allow
选择允许查看的Host，Add
Tree Permissions： 将Deny->Allow
选择Root，Add
SAVE
-------------
手工添加用户可查看的主机监控信息,用于批量处理用户权限
user_id在user_auth里查到
insert into user_auth_perms(user_id,item_id,type)
select "4",id,"3"
from host
where id not in (select item_id from user_auth_perms where user_id ="4")
订阅：
博文 (Atom)
博文
