Why is Mixed Mode less secure than Windows NT Authentication Mode?
In Mixed Mode, username and password information is stored within SQL Server itself. Mixed Mode is only intended for use in networks in which the servers, clients and network infrastructure are physically protected, and all users are trusted. It’s included in SQL Server 7.0 only to provide for backward compatibility with previous releases, and to allow interoperability with products that don’t support Windows NT Authentication. In contrast, Windows NT Authentication Mode uses the normal Windows NT authentication mechanism, which was built for use in environments where security is important. All authentication information is housed on the domain controller rather than the SQL Server, and it’s protected – both on the wire and on the domain controller – by strong cryptographic hashes. More information on SQL Server 7.0 security in general, including authentication modes, is available at http://www.microsoft.com/technet/SQL/Technote/secure.asp. In particular, the section titled “Setting Up
