# Microsoft SQL Server Plugin

{% hint style="warning" %}
Keeper has also launched a zero-trust Password Rotation feature with KeeperPAM. This new capability is recommended for most password rotation use cases. The Documentation is linked below:

* [Password Rotation with KeeperPAM](https://docs.keeper.io/en/keeperpam/secrets-manager/password-rotation)
* Commander [KeeperPAM commands](https://docs.keeper.io/en/keeperpam/commander-cli/command-reference/keeperpam-commands)
  {% endhint %}

This plugin allows rotating a user's password in Microsoft SQL Server

## Prerequisites

#### Install pymssql

```
pip3 install pymssql
```

## Prepare Records for Rotation

### Create a Record for Rotation

Rotation supports legacy and typed records. If using typed record, a 'Login' type field is required. Additional fields may be added depending on the rotation type as well. See the instructions below.

{% hint style="info" %}
See the [Troubleshooting ](https://docs.keeper.io/en/keeperpam/troubleshooting-commander-cli#typed-vs-untyped-records-v3-vs-v2)section for more information on legacy vs typed records
{% endhint %}

![Complete record example. Follow steps below to setup a record for rotation](https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FwjleYChSFGLucHbo6EfP%2Fimage.png?alt=media\&token=36515408-7f70-4286-9b12-a8b17ff489a2)

#### Set the record Login as username of the account to rotate

![](https://762006384-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJXOXEifAmpyvNVL1to%2F-Mf3OKL0C-A5D2nQFew1%2F-Mf3e0ukI6fX4zt2Z1NN%2Fimage.png?alt=media\&token=72c11bbd-5f32-449c-8b8b-1464ccd1f9eb)

#### Set the Hostname and Port

Commander will use these settings to connect.

![](https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FQckdUZ8JwzVBe6mpZDLy%2Fimage.png?alt=media\&token=9ea70cea-3e80-4f23-b02a-6a83e4e5eae9)

{% hint style="info" %}
TIP: If the port is set to 1433, or the host begins with "mssql://" Commander will automatically recognize the record as Microsoft SQL credentials and will use that rotation method unless otherwise configured
{% endhint %}

#### Set the record Password to the match account's password

Commander will use the password to login to perform the rotation

![](https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FXRuczS0T4nq1r8ucRIyT%2Fimage.png?alt=media\&token=54aa80db-ad43-4432-af6b-bd1d43433e00)

#### Set the Database Name in a custom field

Create a Text type custom field labeled "cmdr:db" and fill in the name of the database to connect to.

![](https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2F8McEnYBUn4wIzSL5LyJQ%2Fimage.png?alt=media\&token=980b32e7-350b-4a65-9eef-02f901ab2f4c)

####

#### Optional Custom Fields

Instead of using the fields above, custom fields can be added with the shown label

| Label       | Value                                                                        | Comment                                                                                                                         |
| ----------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| cmdr:plugin | mssql                                                                        | Tells Commander to use Microsoft SQL Key rotation. This should be either set to the record, or supplied to the rotation command |
| cmdr:host   |                                                                              | Hostname of your MSSQL server                                                                                                   |
| cmdr:rules  | <p>'# uppercase, # lowercase, # numeric, # special'</p><p>(e.g. 4,6,3,8)</p> | Password generation rules                                                                                                       |

#### Record Example using Optional Fields

![A Keeper Record that is setup for MSSQL rotation](https://762006384-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MJXOXEifAmpyvNVL1to%2F-Mf3OKL0C-A5D2nQFew1%2F-Mf3e6a022EwH5Vklq3u%2Fimage.png?alt=media\&token=b1a08c73-3594-4c06-800c-41c14cfde67b)

## Rotate

To rotate MSSQL passwords, use the `rotate` command in Commander. Pass the command a record title or UID (or use `--match` with a regular expression to rotate several records at once)

```
rotate "MSSQL Example" --plugin mssql
```

{% hint style="info" %}
The plugin can be supplied to the command as shown here added to a record field, or automatically assigned based on the port number (see options above).\
Adding the plugin type to the record makes it possible to rotate several records at once with different plugins.
{% endhint %}

#### Output

After rotation is completed, the new password will be stored in the `Password` field of the record