Focus

Next-Gen Trust Security

Create a Microsoft SQL Server Machine

Table of Contents

Create a Microsoft SQL Server Machine

Creating a machine enables Next-Gen Trust Security to connect to a Microsoft SQL Server host so certificates can be installed and managed. After creating the machine, you can provision certificates to it.

Before You Begin

Choose the most secure authentication method supported by your environment.

The following methods are listed from most to least secure:

Kerberos authentication over HTTPS (recommended)
Kerberos authentication over HTTP
Basic authentication over HTTPS

You will also need:

Windows Remote Management (WinRM) enabled on the target host
Credentials with permissions to manage certificates on the SQL Server host
The dbatools PowerShell module installed on the SQL Server host
Supported Windows versions:
- Windows Server 2019
- Windows Server 2022

Ensure that the required Windows Remote Management (WinRM) ports are open from the Next-Gen Trust Security VSatellite machine to the target Windows Server. Firewalls or network security controls that block these ports will prevent certificate operations, discovery, or provisioning.

Required ports

Purpose	Protocol	Port	When required
WinRM over HTTP	TCP	5985	When the machine uses WinRM over HTTP (for example, Kerberos over HTTP).
WinRM over HTTPS	TCP	5986	When the machine uses WinRM over HTTPS (for example, Kerberos over HTTPS or Basic Authentication over HTTPS).
Kerberos authentication	TCP and UDP	88	Required whenever Kerberos authentication is used. The Next-Gen Trust Security VSatellite must reach a domain controller’s Kerberos service.

Important:

Confirm that TCP 5985 and/or TCP 5986 are reachable if you're using the default WinRM listener configuration.
When using Kerberos authentication, verify that TCP/UDP 88 is open between the VSatellite and your domain controller.
If your environment uses custom WinRM ports, ensure those ports are reachable.
Blocked ports frequently cause Test Access failures or authentication errors during machine creation or certificate provisioning.

PowerShell Module Requirement

The SQL Server machine uses the dbatools PowerShell module to manage certificates.

Install the module on the target host:

Install-Module -Name dbatools -Scope AllUsers

Configure the machine

From Authentication Type, select the method you want to use, then follow the corresponding steps.

Warning: Always use the most secure authentication method allowed by your environment. Less secure methods increase the risk of credential exposure.

Note:

If a username in UPN format (for example, user@domain.com) fails, try using only the username (for example, user).
Windows Management Framework (WMF) 5.1 or later is required.

Kerberos Authentication over HTTPS

Prerequisites

The SQL Server host must already have a valid TLS server certificate installed for WinRM over HTTPS.
The account used must have the required permissions on the target host.

Enter the Microsoft SQL Server Hostname and WinRM Port.
Enable Use TLS for WinRM.
Enter the Domain Name, Key Distribution Center Address, and Service Principal Name.
Select Enter Credentials or Select Credentials, then provide the required credentials.
Warning: Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.
Click Test Access, then click Create.

Kerberos Authentication over HTTP

Prerequisites

The SQL Server host must allow WinRM over HTTP.
The account used must have the required permissions on the target host.

Enter the Microsoft SQL Server Hostname and WinRM Port.
Leave Use TLS for WinRM disabled.
Enter the Domain Name, Key Distribution Center Address, and Service Principal Name.
Select Enter Credentials or Select Credentials, then provide the required credentials.
Warning: Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.
Click Test Access, then click Create.

Basic Authentication over HTTPS

Prerequisites

The SQL Server host must already have a valid TLS server certificate installed for WinRM over HTTPS.
The account used must have the required permissions on the target host.

Enter the Microsoft SQL Server Hostname and WinRM Port.
Enable Use TLS for WinRM.
Warning: Disabling TLS sends credentials in plaintext and is not recommended.
Select Enter Credentials or Select Credentials, then provide the required credentials.
Warning: Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.
Click Test Access, then click Create.

What's Next?

Return to Create a new machine to finish setting up your new machine by configuring Discovery and Provisioning scheduling.

For existing machines:

Create a Microsoft Windows (PowerShell) Machine

Create a Common KeyStore Machine