In the sample scenario I present in the main article, you're dealing with only a few computers, and you can probably assume that the administrative systems maintain better physical security than the client systems. Therefore, preshared key authentication is a reasonably safe way to extend security.
To use preshared key authentication, follow the same procedure as for certificate-based authentication, but add only the preshared key authentication method in the Authorized Administrative SQL Clients IPSEC Group Policy Object (GPO), take note of the key, and use that key to configure preshared key authentication for the Microsoft SQL Server system. If you're worried about someone capturing the preshared key from Group Policy packets traversing the network, manually configure IP Security (IPSec) on each administrative computer instead of creating the Authorized Administrative SQL Clients group, or change the key on a regular basis. To keep things in perspective, though, consider that sniffing a key from a GPO requires physical access to the network and a fair amount of skill. If someone does capture the key, they’ve made it past only the first level of your defenses. The attacker still needs to penetrate your SQL Server–level and application-level defenses. If you change the key each week, you can limit the amount of time an intruder has to attack those defenses.
