SQL Server 2005 query results differ for different AD accounts using same SQL login

Question

There are two AD accounts, admin1 and admin2. Both are logged in to identical machines, both open SQL Server Management Studio and log in as the same SQL user to the same SQL server (using SQL Server Authentication, NOT using Integrated Security), and both run an identical query: "SELECT * FROM View1". However, admin1 receives many results (the correct result set), whereas admin2 receives an empty result set. This happens on every computer in the domain, regardless of windows version, wired/wireless connection, etc.

Why is this happening? Shouldn't SSMS be Windows account agnostic when using SQL Server Authentication? Any help would be appreciated.

Answer 1

The issue I had was a result of Microsoft Dynamics CRM, not SQL Server itself. I was using Filtered views, which return zero results to any user not using Windows authentication. I am not sure how I got the results I mentioned above, but trying again another day, I was never able to get results with SQL authentication, no matter what Windows account I was using. Likewise, I was always able to get results when logged in with Windows authentication.

Answer 2

You can either use the raw tables or hack the underlying view framework by inserting records manually that show the domainname as your SQL Server Authentication login id and granting not the CRMReaderRole but the standard DQL Role. Take a peek at the wonderful fn_FindUserGuid function which looks up the SystemGuid which the views all inner join to. Just fabricate this record and a few others and your good. If you reverse engineer their system you will see there is a way to trick the system.

Its essentially just the SystemUserBase, SystemUserPrincipals, UserSettingsBase.

Obviously this is not Microsoft recommended. ¯(°_°)/¯ But when you need an ODBC connection on a shared server which provides generic reports to many users outside of the wonderful CRM world you need to do this. You will NOT find another way outside of replicating data to another database but of course keep in mind dynamics is wonderfully dynamic and changes often. Good luck syncronizing environments.

In my opinion this system was obviously designed this way to sway users towards Microsoft products. Not saying I wouldn't do the same if I owned Microsoft. When you're forced to hack your forced to hack.