sql server - Using SSPI, how to make my webapp NOT connect to local SQL Express? -

yep - read right! want make web-application not connect local sql server express (2008r) database!

i created domain user account web-application, , added user domain (ad) group.

in local sql server instance, created login ad group. user account mentioned absolutely in sql database.

then in local iis, changed app-pool site use account created.

when browse local site in browser, voila! connects database.

okay, go ad , remove user account ad group. iisreset. browse local site in browsser, voila!? connects database.

huh? how connecting? using [integrated security=sspi][2], authentication ought made via account being used application pool. so, since doesn't belong group has access sql database, shouldn't fail?

how can make fail? maybe connecting other windows authentication? okay, logins server's instance are:

• mydomaingroup (without app-pool's user account)
• mydomainadminaccount
• sa
• nt authority\network service (necessary everything, even sql log viewer)

and - can confirm none of logins user-mapped users allowed database except special domain group.

ah, it's worse. if connection string uses sspi, supposed accept , use username , password if present. if specify username , password of account have left out of ad group, shouldn't application pool trying login bad credentials? -- think so, but, again, voila! connects!

thus, these 2 connection strings both connect domain user account seemingly has no credentials in sql server instance:

    <add name="development" connectionstring="server=mycomputer\sqlexpress;database=shoppe;persist security info=false;integrated security=sspi; user id=myuser; password=mypassword; pooling=true" providername="system.data.sqlclient"/>      <add name="development" connectionstring="server=mycomputer\sqlexpress;database=shoppe;persist security info=false;integrated security=sspi; pooling=true" providername="system.data.sqlclient"/> 

i tried adding trusted_connection=false; , still connects!

so, getting access connect? there not way tell account being used connect?

on other hand, if remove integrated security=sspi; connection string, can't connect @ windows authentication. don't know if clue or not.

the system stored procedure xp_logininfo http://msdn.microsoft.com/en-us/library/ms190369.aspx can tell access path being used when account connects sql server. example, groups being granted access through , effective permissions login.