Database Credentials

Specify the database credentials that adTempus will use to connect to the database. The account you specify must have read, write, and backup permissions for the database but does not need to be an administrator or database owner.

Database Credentials

Select the authentication type for the connection to SQL Server.

• Windows Authentication. Choose Windows Authentication to use integrated security for the database connection. To use this option, the LocalSystem account on this computer must be granted the necessary login and database permissions on SQL Server.

  If SQL Server is located on the same computer as adTempus, make the necessary security changes in SQL Server to grant permissions to the LocalSystem account.

  If SQL Server is running on a different computer, additional configuration is required, and the SQL Server Computer Account page (see below) will be displayed when you click Next.

• SQL Server Authentication. Choose SQL Server Authentication to connect using a user ID and password. To use this option, your SQL Server must be configured to allow SQL Server authentication.

  If the account you want adTempus to use already exists, specify the user ID and password here.

  Otherwise, adTempus can create the account for you, or you can copy the script shown at the bottom of the page and use it to create the account.

The remaining options apply if you are using Microsoft Entra authentication. For these options you must manually configure logins, users, and permissions in your database; the Database Configuration Wizard will not do this for you.

• Microsoft Entra Password. Uses Microsoft Entra ID user ID and password.

• Microsoft Entra Integrated. Uses integrated authentication if you are logged in to Windows and using your credentials from a federated domain, or a managed domain configured for seamless single sign-on for pass-through and password hash authentication.

• Microsoft Entra Service Principal. Authenticate using the client ID and secret of a service principal identity.

• Microsoft Entra Managed Identity. Authenticate using the managed identity of the computer where adTempus is running.

SQL Server Login for Computer Account

If you are using Windows authentication for SQL Server, and SQL Server is running on a different computer than adTempus, you must create a machine login in SQL Server for the computer on which adTempus is running.

This is necessary because adTempus runs under the special LocalSystem account that is specific to the computer on which adTempus is running. Were you to grant permissions to "LocalSystem" in SQL Server, that would only grant permissions to the LocalSystem account on the database server itself, not to the LocalSystem account on the adTempus computer.

You may have adTempus create the necessary account for you, or you may review the script that adTempus generates and execute it yourself.

To create the login yourself (for example, if you move the database to a different server after adTempus is installed), connect to SQL Server using SQL Server Management Studio or another management tool and run the following script. Replace DOMAIN with the name of your domain, COMPUTERNAME with the name of the computer where the adTempus service is running (keep the "$" after the name), and DATABASENAME with the name of the adTempus database.

use [master]
GO
if not exists (select * from master.dbo.syslogins where loginname = N'DOMAIN\COMPUTERNAME$')
CREATE LOGIN [DOMAIN\COMPUTERNAME$] FROM WINDOWS with DEFAULT_DATABASE=[DATABASENAME]
GO
use [DATABASENAME]
GO
if not exists (select * from dbo.sysusers where name = N'DOMAIN\COMPUTERNAME$' and uid < 16382)
    CREATE USER [DOMAIN\COMPUTERNAME$] FOR LOGIN [DOMAIN\COMPUTERNAME$] WITH DEFAULT_SCHEMA=[dbo]
GO
exec sp_addrolemember N'db_backupoperator', N'DOMAIN\COMPUTERNAME$'
GO
exec sp_addrolemember N'db_datareader', N'DOMAIN\COMPUTERNAME$'
GO
exec sp_addrolemember N'db_datawriter', N'DOMAIN\COMPUTERNAME$'
GO

Make sure that all statements succeed. If this login is missing, the service fails to start and the diagnostic log reports "Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'" or "Login failed for user 'DOMAIN\COMPUTERNAME$'".