From 4ad62c919fdd7077f6a685856284b71ab5c2e64e Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Mon, 20 Nov 2023 23:02:00 +0530 Subject: [PATCH 001/370] Added a new file --- ...to-troubleshoot-sql-connectivity-issues.md | 134 ++++++++++++++++++ 1 file changed, 134 insertions(+) create mode 100644 support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md diff --git a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md new file mode 100644 index 0000000000..18a111f25d --- /dev/null +++ b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md @@ -0,0 +1,134 @@ +--- +title: Data collection to troubleshoot SQL connectivity problems +description: This article provides questions based on several components using which you can effectively troubleshoot connectivity problems. +ms.date: 11/23/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Collect data to troubleshoot SQL connectivity issues + +This section is a comprehensive list of questions classified based on certain categories. While [Prerequisites and checklist for resolving connectivity errors](resolve-connectivity-errors-checklist.md) has the most important items to be collected, the questions is this article can help you rule out many scenarios and narrow down your focus for troubleshooting problems in an effective manner. + +> [!NOTE] +> Not all questions might be applicable to all problems but serve as a list of things to consider while troubleshooting connectivity problems. + +- [Client machine](#client-machine) +- [Server machine](#server-machine) +- [User information](#user-information) +- [Log information](#log-information) +- [Big picture questions](#big-picture-questions) +- [New or existing problem](#new-or-existing-problem) + +## Client machine + +You can collect the following information for the Client machine component. + +- What is the operating system name, edition, and version (WinVer) used? +- What is the name and version of the SQL Server Driver or Provider? +- What is the machine name and IP address? +- Is the machine domain joined? if yes, what is the domain name? +- What is the application run-time environment used? For example, IIS, Windows Forms, Web Sphere, SSIS Job, and so on. +- Which is the Application language used? +- What is the connection string used? +- What type of authentication is used to connect to the server? For example, NTLM, Kerberos, SQL, or AAD. +- If the application is a server or service, does it delegate user credentials to the backend database? +- Is constrained delegation being used? +- Which is the application service account and domain? +- Which type of service is used? Is it physical, virtual or cloud? For example IaaS vs Web App vs Web Role vs Power BI. +- Is the client driver JDBC or does it run on Linux or Mac? + +> [!NOTE] +> The workflows are more Windows-oriented at the moment. + +- Does the issue only affect legacy providers, such as Provider=SQLOLEBD or Driver={SQL Server} and not SQL Native client and newer drivers or vice versa? +- Does the issue only happen in one or several applications? +- Does a UDL file fail to connect to other SQL Servers or does it only fail to the SQL Server that has the problem? +- Can you log in to the SQL Server and connect using Management Studio? +- Does the issue only happen when you use the NETBIOS name of the server and not when you use the FQDN or vice versa? Does it work using the IP address? +- If the client is Windows 10 Enterprise Edition, is the Credential Guard feature turned ON? If yes, this might affect with the full delegation scenarios. + +## Server machine + +For a Linked Server, collect server information for both the mid-tier server and the back-end server. For an IIS-to-SQL delegation issue, collect information on the web server, including the *web.config* and authentication settings. + +- What is the name of the operating system name, edition, and version (Winver)? +- What is the name and version of the database? +- What is the name of the computer? +- What is the IP address? +- Is the machine domain joined? if yes, what is the domain name? +- What is the SQL Server service account and domain? +- What is the name of the SQL Server instance? +- Which protocols have been enabled? +- Which is the port that the server listens on? +- What is the name of the server pipe?. You can find this information in the (ERRORLOG). +- Which type of environment is used? Is it physical, virtual, or cloud? For example, IaaS (SQL in an Azure VM) or PaaS (Azure SQL Database, SQL MI). +- Is the database stand-alone, clustered, mirrored, or Always On? +- What is the Failover partner name and IP address? +- What is the Virtual cluster name or Listener name and port? +- Virtual IP/Listener IP: +- Which operating system is the database installed on? Is it Windows, Linux, or Mac? This might affect data collection. +- Is the database located in Azure? +- Is the server on the latest Service Pack and Cumulative Update? There’s no point in debugging an issue that's already fixed. +- Has SQL Server been upgraded recently to support TLS 1.2? Were the clients also patched? Has TLS 1.0 been turned off? +- Is the SQL Server service currently running? +- Is the SQL Browser service running? +- Is the problem specific to a service account? If you run the server using a different service account, does the problem get resolved? + +## User information + +- Does the user log into the client machine directly or access it remotely? For example, does the user use a browser? +- Is the user a service, such as SQL Agent? Is the process identity being used or a stored credential? +- What is the type of authentication used to connect to the client application? Is it Windows, Forms authentication, or Azure Active Directory? +- Does the user connect to the server using integrated security? +- What are the user name and domain name? + +If the user is remote to the client application, collect the following details: + +- What is the name of the computer and IP address? +- Is the machine domain joined? if yes, what is the domain name? +- Is the user connecting over a VPN or a proxy server? Does the issue happen if either of them is directly connected? +- If the user is connecting to a web server, is it load balanced? +- Are sticky sessions or session affinity being used? +- Is the user logging into a terminal server or jump box and accessing the application? +- Does the issue only affect users in particular organizational units (OUs)? +- Has the user, client, or server moved to a different OU in Active Directory? +- Does the issue only affect non-admin users? +- Does the issue only affect some or all of the users in a particular domain? + +## Log information + +- What is the exact error message in the call stack? +- Has the log been collected from the SQL Server ERRORLOG and ERRORLOG.1? +- Have the application event logs been collected from the client and server? +- Have the client application's log files and configuration files been collected? For example: web.config, rsreportserver.config, *.config, or *.ini. +- Is a visual representation of the network available which shows the computers, routers, and so on. + +## Big picture questions + +If none of the questions in the previous sections provide an answer, consider the following questions to collect relevant information. + +- Does the issue only affect database connections, or does it affect web and file share connections as well? Many cases are reported to the SQL team because they are seen on the database server, but the problem might not be related to database related at all and might require more general Windows or Active Directory support. +- If the user domain, client domain, or server domain are different, what is the trust relationship between them? Is it external, forest, one-way, two-way, or none? +- Does the connection work correctly if all the resources are in the same domain? +- Is the issue intermittent (or periodic) or is it consistent? +- Does the issue only occur if more than one user is using the application? Does it occur more often if more users are using it? +- Does the issue only happen at certain times of the day or days of the week? +- Does the issue only happen when a backup is being taken or the database is being re-indexed? +- Does the issue affect more than one server? +- Does the issue only affect one node in a n-node cluster? If yes, perhaps rebuilding is more efficient. +- Does the issue affect only one or two clients out of several? If yes, perhaps rebuilding is more efficient. +- Does the issue only affect Named Pipes and not TCP or vice versa? +- Does the issue happen when you use a SQL login and TCP/IP? +- Is there a working case that can be compared against the failing case? How are the two systems different? + +## New or existing problem + +- Has the problem always existed (new installation) or did it function properly before recently breaking down? +- If it used to function properly, what changes were made to the environment? Foe example, installed patches, upgraded domain controllers, changed the firewall settings, decommissioned domain controllers, and moved to a different Organizational Unit (OU) in the domain. + +## See also + +Consistent SQL Network Connectivity Issue From 15bff7bb4d639e91289138196536ddadb4ff1482 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Tue, 21 Nov 2023 10:33:40 +0530 Subject: [PATCH 002/370] Updated text --- ...ollect-data-to-troubleshoot-sql-connectivity-issues.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md index 18a111f25d..461d94d46c 100644 --- a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md +++ b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md @@ -10,7 +10,7 @@ ms.custom: sap:Connection issues # Collect data to troubleshoot SQL connectivity issues -This section is a comprehensive list of questions classified based on certain categories. While [Prerequisites and checklist for resolving connectivity errors](resolve-connectivity-errors-checklist.md) has the most important items to be collected, the questions is this article can help you rule out many scenarios and narrow down your focus for troubleshooting problems in an effective manner. +This section is a comprehensive list of questions classified based on certain categories. While [Prerequisites and checklist for resolving connectivity errors](resolve-connectivity-errors-checklist.md) has the most important items to be collected, the questions in this article can help you rule out many scenarios and narrow down your focus for troubleshooting problems in an effective manner. > [!NOTE] > Not all questions might be applicable to all problems but serve as a list of things to consider while troubleshooting connectivity problems. @@ -37,7 +37,7 @@ You can collect the following information for the Client machine component. - If the application is a server or service, does it delegate user credentials to the backend database? - Is constrained delegation being used? - Which is the application service account and domain? -- Which type of service is used? Is it physical, virtual or cloud? For example IaaS vs Web App vs Web Role vs Power BI. +- Which type of service is used? Is it physical, virtual or cloud? For example, IaaS vs Web App vs Web Role vs Power BI. - Is the client driver JDBC or does it run on Linux or Mac? > [!NOTE] @@ -104,7 +104,7 @@ If the user is remote to the client application, collect the following details: - Has the log been collected from the SQL Server ERRORLOG and ERRORLOG.1? - Have the application event logs been collected from the client and server? - Have the client application's log files and configuration files been collected? For example: web.config, rsreportserver.config, *.config, or *.ini. -- Is a visual representation of the network available which shows the computers, routers, and so on. +- Is a visual representation of the network available, which shows the computers, routers, and so on. ## Big picture questions @@ -132,3 +132,5 @@ If none of the questions in the previous sections provide an answer, consider th ## See also Consistent SQL Network Connectivity Issue +[Recommended prerequisites and checklist for troubleshooting SQL Server connectivity issues](resolve-connectivity-errors-checklist.md) +[Troubleshoot connectivity issues in SQL Server](resolve-connectivity-errors-overview.md) From 45f2fca19a811623811887a896be47b9a673612a Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Tue, 21 Nov 2023 10:42:07 +0530 Subject: [PATCH 003/370] Updated more text --- .../collect-data-to-troubleshoot-sql-connectivity-issues.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md index 461d94d46c..bd77300b27 100644 --- a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md +++ b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md @@ -61,7 +61,7 @@ For a Linked Server, collect server information for both the mid-tier server and - Is the machine domain joined? if yes, what is the domain name? - What is the SQL Server service account and domain? - What is the name of the SQL Server instance? -- Which protocols have been enabled? +- Which protocols are enabled? - Which is the port that the server listens on? - What is the name of the server pipe?. You can find this information in the (ERRORLOG). - Which type of environment is used? Is it physical, virtual, or cloud? For example, IaaS (SQL in an Azure VM) or PaaS (Azure SQL Database, SQL MI). @@ -104,13 +104,13 @@ If the user is remote to the client application, collect the following details: - Has the log been collected from the SQL Server ERRORLOG and ERRORLOG.1? - Have the application event logs been collected from the client and server? - Have the client application's log files and configuration files been collected? For example: web.config, rsreportserver.config, *.config, or *.ini. -- Is a visual representation of the network available, which shows the computers, routers, and so on. +- Is a visual representation of the network available, which shows the computers, routers, and so on? ## Big picture questions If none of the questions in the previous sections provide an answer, consider the following questions to collect relevant information. -- Does the issue only affect database connections, or does it affect web and file share connections as well? Many cases are reported to the SQL team because they are seen on the database server, but the problem might not be related to database related at all and might require more general Windows or Active Directory support. +- Does the issue only affect database connections, or does it affect web and file share connections as well? Many cases are reported to the SQL team because they are seen on the database server. However, it might be possible that the problem isn't related to the database at all and might call for more general Windows or Active Directory support. - If the user domain, client domain, or server domain are different, what is the trust relationship between them? Is it external, forest, one-way, two-way, or none? - Does the connection work correctly if all the resources are in the same domain? - Is the issue intermittent (or periodic) or is it consistent? From d5abf4a8a541abb8906f71c76513ac2443ed8526 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Tue, 21 Nov 2023 13:56:59 +0530 Subject: [PATCH 004/370] Updated text --- .../collect-data-to-troubleshoot-sql-connectivity-issues.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md index bd77300b27..2b523117d2 100644 --- a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md +++ b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md @@ -103,12 +103,12 @@ If the user is remote to the client application, collect the following details: - What is the exact error message in the call stack? - Has the log been collected from the SQL Server ERRORLOG and ERRORLOG.1? - Have the application event logs been collected from the client and server? -- Have the client application's log files and configuration files been collected? For example: web.config, rsreportserver.config, *.config, or *.ini. +- Have the client application's log files and configuration files been collected? For example, web.config, rsreportserver.config, *.config, or *.ini. - Is a visual representation of the network available, which shows the computers, routers, and so on? ## Big picture questions -If none of the questions in the previous sections provide an answer, consider the following questions to collect relevant information. +Following are some questions which will help you understand the category of issue so that you can proceed in the right direction to troubleshoot the problems: - Does the issue only affect database connections, or does it affect web and file share connections as well? Many cases are reported to the SQL team because they are seen on the database server. However, it might be possible that the problem isn't related to the database at all and might call for more general Windows or Active Directory support. - If the user domain, client domain, or server domain are different, what is the trust relationship between them? Is it external, forest, one-way, two-way, or none? @@ -127,7 +127,7 @@ If none of the questions in the previous sections provide an answer, consider th ## New or existing problem - Has the problem always existed (new installation) or did it function properly before recently breaking down? -- If it used to function properly, what changes were made to the environment? Foe example, installed patches, upgraded domain controllers, changed the firewall settings, decommissioned domain controllers, and moved to a different Organizational Unit (OU) in the domain. +- If it used to function properly, what changes were made to the environment? For example, installed patches, upgraded domain controllers, changed the firewall settings, decommissioned domain controllers, and moved to a different Organizational Unit (OU) in the domain. ## See also From 5da25b145807153a65dcb03193509b0ba62fd845 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Tue, 21 Nov 2023 14:23:53 +0530 Subject: [PATCH 005/370] Corrected case problems --- ...data-to-troubleshoot-sql-connectivity-issues.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md index 2b523117d2..eac385424d 100644 --- a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md +++ b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md @@ -29,7 +29,7 @@ You can collect the following information for the Client machine component. - What is the operating system name, edition, and version (WinVer) used? - What is the name and version of the SQL Server Driver or Provider? - What is the machine name and IP address? -- Is the machine domain joined? if yes, what is the domain name? +- Is the machine domain joined? If yes, what is the domain name? - What is the application run-time environment used? For example, IIS, Windows Forms, Web Sphere, SSIS Job, and so on. - Which is the Application language used? - What is the connection string used? @@ -58,17 +58,17 @@ For a Linked Server, collect server information for both the mid-tier server and - What is the name and version of the database? - What is the name of the computer? - What is the IP address? -- Is the machine domain joined? if yes, what is the domain name? +- Is the machine domain joined? If yes, what is the domain name? - What is the SQL Server service account and domain? - What is the name of the SQL Server instance? - Which protocols are enabled? - Which is the port that the server listens on? -- What is the name of the server pipe?. You can find this information in the (ERRORLOG). +- What is the name of the server pipe? You can find this information in the (ERRORLOG). - Which type of environment is used? Is it physical, virtual, or cloud? For example, IaaS (SQL in an Azure VM) or PaaS (Azure SQL Database, SQL MI). - Is the database stand-alone, clustered, mirrored, or Always On? - What is the Failover partner name and IP address? - What is the Virtual cluster name or Listener name and port? -- Virtual IP/Listener IP: +- Which is the Virtual IP or Listener IP? - Which operating system is the database installed on? Is it Windows, Linux, or Mac? This might affect data collection. - Is the database located in Azure? - Is the server on the latest Service Pack and Cumulative Update? There’s no point in debugging an issue that's already fixed. @@ -88,7 +88,7 @@ For a Linked Server, collect server information for both the mid-tier server and If the user is remote to the client application, collect the following details: - What is the name of the computer and IP address? -- Is the machine domain joined? if yes, what is the domain name? +- Is the machine domain joined? If yes, what is the domain name? - Is the user connecting over a VPN or a proxy server? Does the issue happen if either of them is directly connected? - If the user is connecting to a web server, is it load balanced? - Are sticky sessions or session affinity being used? @@ -103,12 +103,12 @@ If the user is remote to the client application, collect the following details: - What is the exact error message in the call stack? - Has the log been collected from the SQL Server ERRORLOG and ERRORLOG.1? - Have the application event logs been collected from the client and server? -- Have the client application's log files and configuration files been collected? For example, web.config, rsreportserver.config, *.config, or *.ini. +- Have the client application's log files and configuration files collected? For example, web.config, rsreportserver.config, *.config, or *.ini. - Is a visual representation of the network available, which shows the computers, routers, and so on? ## Big picture questions -Following are some questions which will help you understand the category of issue so that you can proceed in the right direction to troubleshoot the problems: +Following are some questions, which help you understand the category of issue so that you can proceed in the right direction in troubleshooting the problems: - Does the issue only affect database connections, or does it affect web and file share connections as well? Many cases are reported to the SQL team because they are seen on the database server. However, it might be possible that the problem isn't related to the database at all and might call for more general Windows or Active Directory support. - If the user domain, client domain, or server domain are different, what is the trust relationship between them? Is it external, forest, one-way, two-way, or none? From aafcd6cc8f52c01f54109d1a68630d3483c90671 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Wed, 22 Nov 2023 10:09:34 +0530 Subject: [PATCH 006/370] Added a new file --- .../consistent-authentication-connectivity-issues.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md diff --git a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md new file mode 100644 index 0000000000..c1783cd052 --- /dev/null +++ b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md @@ -0,0 +1,12 @@ +--- +title: Introduction to consistent authentication issues +description: This article introduces to consistent authentication issues, the types of error messages, and workarounds to troubleshoot various problems. +ms.date: 11/21/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Consistent authentication issues + From 837006268e32e79051e1deab1520aa3c4971ef0a Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Wed, 22 Nov 2023 15:04:56 +0530 Subject: [PATCH 007/370] Added a topic --- ...tent-authentication-connectivity-issues.md | 60 ++++++++++++++++++- 1 file changed, 59 insertions(+), 1 deletion(-) diff --git a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md index c1783cd052..a8f824831d 100644 --- a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md +++ b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md @@ -8,5 +8,63 @@ ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp ms.custom: sap:Connection issues --- -# Consistent authentication issues +# Consistent authentication problems + +A consistent authentication issue in SQL Server typically refers to problems related to authentication and authorization of users or applications trying to access the SQL Server database. These issues can lead to authentication failures, access denied errors, or other security-related problems. + +> [!NOTE] +> The commands provided in this article are for Windows systems. + +## Recommended pre-requisites for consistent authentication problems + +To troubleshoot consistent authentication issues, follow these steps: + +1. See the recommended [prerequisites and checklist for troubleshooting SQL Server connectivity issues](resolve-connectivity-errors-checklist.md). +1. Collect data to troubleshoot SQL consistent authentication issues. + + This will help you to get a macro perspective of the scope of an issue, that is whether the issue affects single or multiple computers or whether only computers in a specific data center are affected. This can help you focus on the troubleshooting steps. It will also prepare you to discuss the problem with Microsoft Support should you choose to do so. + +1. Make sure you understand the application architecture and summarize the issue like the following description: + + - There are two domains involved: contoso and fabrikam. + + - The client sparky.contoso.com runs on Windows 2012. + + - The user contoso\johndoe runs on EDGE and connects to a web server (http://web01.contoso.com/accounting) using integrated security. + + - The IIS app pool runs as contoso\web_svc. + + - The web server connects to SQL Server 2014 (SQLProd01.fabrikam.com\Accounting on port 1433) using the SqlClient .NET 4.6.2 Provider and assigns the user credentials to SQL Server using integrated security. + + - The SQL Server service account is fabrikam\sql_svc_01. + +1. Collect the SPN information based on the service accounts identified in the description. For example: + + `SETSPN -L CONTOSO\WEB_SVC > c:\temp\spns.txt` - Creates a new file. + `SETSPN -L FABRIKAM\SQL_SVC_01 >> c:\temp\spns.txt` - Appends to a file. + +## Types of errors + +Before you start to troubleshoot errors, it's important to understand what each error means and also what is the type of error. It's also important to understand the category of the error because the workflow also varies. This section provides various types of consistent authentication errors. + +- [Directory Services specific error messages](#directory-services-specific-error-messages) - Refers to the Active Directory error messages. If the SQL Server ERRORLOG file contains the following messages, then this is an Active Directory issue. This might happen if the domain controller can't be contacted by Windows on the SQL Server computer, or the local security service (LSASS) is having a problem. + +> Error -2146893039 (0x80090311): No authority could be contacted for authentication. +> Error -2146893052 (0x80090304): The Local Security Authority cannot be contacted. + +- [Login failed error codes](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16#additional-error-information) - If you are troubleshooting a "Login Failed" error message, the SQL Server ERRORLOG file can provide more information in the SQL State value with error 18456 (Login Failed). + +- [Login failed error messages](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true) - Refers to some of the common login failures. For more information, see [MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true). + [Login failed for user '(null)'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16#login-failed-for-user-(null)) + Login failed for user '' + Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON' + Login failed for user 'JohnDoe' + Login failed for user 'CONTOSO\JohnDoe' + Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. + SQL Server does not exist or access denied - This can also be a network error. +- [SSPI context messages](/troubleshoot/sql/database-engine/connect/cannot-generate-sspi-context-error?branch=main) + + + + From f910ccba70e762c354e31faacbf4ae17a4e45ca9 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Wed, 22 Nov 2023 18:02:37 +0530 Subject: [PATCH 008/370] Added a new section for configuring the tools --- ...to-troubleshoot-sql-connectivity-issues.md | 49 +++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md index eac385424d..12587d6cc4 100644 --- a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md +++ b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md @@ -22,6 +22,55 @@ This section is a comprehensive list of questions classified based on certain ca - [Big picture questions](#big-picture-questions) - [New or existing problem](#new-or-existing-problem) +## Method of collecting data + +You can use tools such as Problem Steps Recorder (PSR), Network trace, and NETLOGON trace to collect data. This section provides detailed steps you can use to install and configure a combination of all three tools. + +Follow these steps simultaneously on both the client and server machines. If the application is a 3-tier or n-tier architecture, run on intermediate servers, as well. + +1. Install **NETMON** or **WIRESHARK** on all affected machines or use the built-in `NETSH` command (Windows 2008 or newer). No reboot is required. + +1. Enable NETLOGON debug logging on the client and all servers by running the following command: + + `NLTEST /DBFLAG:2080FFFF` + +1. If possible, do one of the following: + + - Reboot the client machine. + - Ask the user to log off and log in again. + - Close the client application and re-open it. + +1. On the client machine, start the **Problem Steps Recorder** (psr.exe) and select **Start Record**. + + This will accurately capture all user actions that lead up to the problem and save the results to a ZIP file. + +1. Start the network capture on all machines. + +1. If you are using NETSH, run the `NETSH TRACE START CAPTURE=YES TRACEFILE=C:\TEMP%computername%.ETL` command (use an appropriate file or path name). + +1. Flush the DNS cache on all machines by running the `IPCONFIG /FLUSHDNS` command. + +1. Clear the NETBIOS cache on all machines by running the `NBTSTAT /RR` command. + +1. Purge client Kerberos tickets by running the `KLIST purge` command. + +1. Clear tickets on each server by running the `KLIST -li 0x3e7 purge` command. + + > [!NOTE] + > Type the command and don't use copy or paste into the command line. The dash might get converted to a hyphen and break the command. `KLIST` is case-sensitive. + +1. Reproduce the issue. + +1. Stop the *psr.exe* recording. + +1. Stop the network captures and save the recorded file by running the command `NETSH: NETSH TRACE STOP` with a meaningful name. For example, *SQLProd01.netmon.cap*. + +1. Wait for the command prompt to reappear. Don't close the command window until this happens. + +1. Copy the NETLOGON log to *C:\windows\debug\netlogon.log* and give a meaningful name. For example, *SQLProd01.netlogon.log*. + +1. Disable logging by running the `NLTEST /DBFLAG:0x0` command. + ## Client machine You can collect the following information for the Client machine component. From 04252f98a5eb3b1810dfba4fd1858f2e178a7319 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Wed, 22 Nov 2023 18:17:31 +0530 Subject: [PATCH 009/370] Added toc entry as well --- support/sql/database-engine/connect/toc.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/support/sql/database-engine/connect/toc.yml b/support/sql/database-engine/connect/toc.yml index d7b9575567..b356d5b7d7 100644 --- a/support/sql/database-engine/connect/toc.yml +++ b/support/sql/database-engine/connect/toc.yml @@ -9,6 +9,8 @@ items: href: /sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?context=/troubleshoot/sql/context/context - name: Network-related or instance-specific error href: network-related-or-instance-specific-error-occurred-while-establishing-connection.md +- name: Collect data to troubleshoot SQL connectivity issues + href: collect-data-to-troubleshoot-sql-connectivity-issues.md - name: Pre-reqs for connectivity troubleshooting href: resolve-connectivity-errors-checklist.md - name: The certificate chain was issued by an authority that isn't trusted From d5d088361cf2ea889e16bd1d6c700a144f9eca5c Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Wed, 22 Nov 2023 23:22:40 +0530 Subject: [PATCH 010/370] updated text --- .../connect/consistent-authentication-connectivity-issues.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md index a8f824831d..7942468030 100644 --- a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md +++ b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md @@ -58,8 +58,8 @@ Before you start to troubleshoot errors, it's important to understand what each [Login failed for user '(null)'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16#login-failed-for-user-(null)) Login failed for user '' Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON' - Login failed for user 'JohnDoe' - Login failed for user 'CONTOSO\JohnDoe' + Login failed for user 'username' + Login failed for user 'DOMAIN\username' Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. SQL Server does not exist or access denied - This can also be a network error. - [SSPI context messages](/troubleshoot/sql/database-engine/connect/cannot-generate-sspi-context-error?branch=main) From 87f4868fa88bb3fb113f403b440270a4c439e0c6 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Thu, 23 Nov 2023 06:04:40 +0530 Subject: [PATCH 011/370] Added hyperlinks and a new section --- ...onsistent-authentication-connectivity-issues.md | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md index 7942468030..f739598342 100644 --- a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md +++ b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md @@ -56,14 +56,20 @@ Before you start to troubleshoot errors, it's important to understand what each - [Login failed error messages](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true) - Refers to some of the common login failures. For more information, see [MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true). [Login failed for user '(null)'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16#login-failed-for-user-(null)) - Login failed for user '' - Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON' - Login failed for user 'username' - Login failed for user 'DOMAIN\username' + [Login failed for user ''](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) + [Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) + [Login failed for user 'username'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) + [Login failed for user 'DOMAIN\username'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. SQL Server does not exist or access denied - This can also be a network error. - [SSPI context messages](/troubleshoot/sql/database-engine/connect/cannot-generate-sspi-context-error?branch=main) +## Categorization of error messages + +This section helps you to drill down to the category of error so that you can effectively troubleshoot. It also provides the cause, symptoms, and possible solutions. + +Issues with a SQL Login - This mainly refers to the error messages related to failed login. For more information, see [MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). + From 8a46c5d96e0d69410291b3fbf547f0006b990add Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Thu, 23 Nov 2023 21:54:47 +0530 Subject: [PATCH 012/370] created MD files --- ...tent-authentication-connectivity-issues.md | 14 ++++- ...tauth-connection-string-error-scenarios.md | 62 +++++++++++++++++++ ...uth-some-aspects-of-sql-error-scenarios.md | 57 +++++++++++++++++ 3 files changed, 130 insertions(+), 3 deletions(-) create mode 100644 support/sql/database-engine/connect/consistentauth-connection-string-error-scenarios.md create mode 100644 support/sql/database-engine/connect/consistentauth-some-aspects-of-sql-error-scenarios.md diff --git a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md index f739598342..2f6ca01f16 100644 --- a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md +++ b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md @@ -13,7 +13,7 @@ ms.custom: sap:Connection issues A consistent authentication issue in SQL Server typically refers to problems related to authentication and authorization of users or applications trying to access the SQL Server database. These issues can lead to authentication failures, access denied errors, or other security-related problems. > [!NOTE] -> The commands provided in this article are for Windows systems. +> The commands provided in this article are for Windows systems only. ## Recommended pre-requisites for consistent authentication problems @@ -66,11 +66,19 @@ Before you start to troubleshoot errors, it's important to understand what each ## Categorization of error messages -This section helps you to drill down to the category of error so that you can effectively troubleshoot. It also provides the cause, symptoms, and possible solutions. +Before you start with troubleshooting, it is important to understand the nature of an error and the category that it belongs to. This section provides error messages grouped based on a category. Some errors might appear in more than one category. Each of these error scenarios has the symptoms and the solutions as well. Following are the error categories. -Issues with a SQL Login - This mainly refers to the error messages related to failed login. For more information, see [MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). +- Issues with a SQL Login - Refers to the error scenarios related to failed login. For more information, see [MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). +- [Issues with different aspects of SQL Server](consistentauth-some-aspects-of-sql-error-scenarios.md) - Refers to error scenarios related to database offline, database permissions, missing login and so on. For more information, see [Login failed for user NT AUTHORITY\ANONYMOUS LOGON](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error#Login-failed-for-user-NT-AUTHORITY\ANONYMOUS-LOGON). +- Issues with the connection string - Refers to various error scenarios such as wrong database name, wrong SPN account, missing SPN, misplaced SPN, and duplicate SPN. +- Issues with local Windows permissions or Policy settings - Refers to permission oriented error scenarios such as corrupt user profile, local security subsystem issues, network login disallowed, and so on. +- Issues specific to NTLM - Refers to scenarios related to NTLM such as peer login, double hop, loopback protection, and so on. For more information, see [Login failed for user NT AUTHORITY\ANONYMOUS LOGON](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error#Login-failed-for-user-NT-AUTHORITY\ANONYMOUS-LOGON). + +- Issues specific to Active Directory and Domain Controller - Refers to scenarios such as account and group related error scenarios. + +- Miscellaneous issues - Refers to scenarios that do not fall under any of the previous scenarios. diff --git a/support/sql/database-engine/connect/consistentauth-connection-string-error-scenarios.md b/support/sql/database-engine/connect/consistentauth-connection-string-error-scenarios.md new file mode 100644 index 0000000000..387ab38467 --- /dev/null +++ b/support/sql/database-engine/connect/consistentauth-connection-string-error-scenarios.md @@ -0,0 +1,62 @@ +--- +title: Troubleshooting errors specific to connection strings +description: This article provides cause, symptoms, and workarounds for errors related to connection strings. +ms.date: 11/23/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Connection string related issues + +This article helps you to troubleshoot connection string related error scenarios. + +## Scenario 1 - Bad Server name in connection string + +Consider the following scenario: + +SQLOLEDB and SQLNCLI11 OLE DB providers over TCP or Named Pipes show the following error messages: + +- "Login failed for user 'userx'." - Message is shown when the providers use an SQL login. +- "Login failed for user 'CONTOSO\user1'." - Message is shown the providers use a Windows login. + +The SQL Server and ODBC Driver 13 ODBC Drivers show the following error message: + +> "Login failed for user 'CONTOSO\user1'." + +The SqlClient .NET Provider displays the following error messages: + +> "Login failed for user ''. -when using TCP and a SQL login or a Windows login" +> "Login failed for user 'CONTOSO\user1'. - when using Named Pipes and a SQL login or a Windows login" + +The SQL Server Errorlog will have one of the following messages: + +> "'Login failed for user'. Reason: Could not find a login matching the name provided." +> "'Login failed for user 'CONTOSO\USER1'. Reason: Could not find a login matching the name provided." + +**Solution** + +This can be a common issue if you deploy an application that uses a DEV or QA server into production and you fail to update the connection string. To resolve this issue, validate that you are connecting to the appropriate server. If not, correct the connection string. If it is, then add the login to the database or if it's a Windows login, add it to a local group or domain group that's allowed to connect to the database server. + +## Scenario 2 - Wrong Database Name in Connection String + +The driver might generate the following error message: + +"Cannot open database "northwind" requested by the login. The login failed." + +Some drivers might also generate the "Login failed for user CONTOSO\user1" error message. + +The SQL Server Errorlog will have one of the following message: +"Login failed for user 'CONTOSO\User1'. Reason: Failed to open the explicitly specified database 'northwind'." + +**Solution** + +Make sure that The database name should be clear in the error message and the Errorlog entry. +Change the connection string, if it is incorrect, or grant the user the required permissions. + +## Scenario 3 - Wrong Explicit SPN Account + +If the application specifies the SQL Server service account in the ServerSPN property of the connection string, for example: + + diff --git a/support/sql/database-engine/connect/consistentauth-some-aspects-of-sql-error-scenarios.md b/support/sql/database-engine/connect/consistentauth-some-aspects-of-sql-error-scenarios.md new file mode 100644 index 0000000000..2426c4b602 --- /dev/null +++ b/support/sql/database-engine/connect/consistentauth-some-aspects-of-sql-error-scenarios.md @@ -0,0 +1,57 @@ +--- +title: Troubleshooting various aspects +description: This article provides cause, symptoms, and workarounds for some of the aspects of SQL Server using which you can troubleshoot related problems. +ms.date: 11/23/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Issues with some aspects of SQL Server + +This article details a scenario related to SQLOLEDB and provides resolution. + +## Scenario 1 - Linked Server Account Mapping + +**Symptoms** + +When you connect to the mid-tier server from the Management Studio, you might see the following error messages: + +```output +> "Msg 233, Level 20, State 0, Line 0 +A transport-level error has occurred when sending the request to the server. (provider: Shared Memory Provider, error: 0 - No process is on the other end of the pipe.)" +``` + +When you connect using application developed using .NET, you might see the following error message: + +> "The OLE DB provider "MSDASQL" for linked server "SQLPROD02" reported an error. Authentication failed." + +> "Cannot initialize the data source object of OLE DB provider "MSDASQL" for linked server "SQLPROD02"." + +If you also see the following error message, it indicates you are using Named Pipes for the linked server connection and a SQL login, and the mid-tier SQL Server service account or machine account doesn’t have login rights to Windows on the backend server: + +> "OLE DB provider "MSDASQL" for linked server "SQLPROD02" returned message "[Microsoft][SQL Server Native Client 11.0][SQL Server]Login failed for user 'CONTOSO\SQLPROD01$'." + +**Solution** + +In the **Linked Server security** dialog, when you select the **Be made without using a security context** option, the "Login Failed" for user "NT AUTHORITY\ANONYMOUS LOGON" error is displayed. When you select **Be made with this security context**, the SQL login is successful. + +You can correct this error by forcing TCP/IP or granting the appropriate permissions. In addition to the settings in the **Linked Server security** dialog, you can modify the individual account mappings in the upper portion of the dialog, which overrides the main mapping settings. + +> [!NOTE] +> Using a SQL Server ODBC driver in a linked server isn't a supported scenario. Other ODBC drivers might have limited support from Microsoft and mainly from the vendor. + +## Scenario 2 - Proxy account + +**Symptoms** + +An SSIS job run by SQL Agent might need permissions other than the SQL Agent service account can provide. + +**Solution** + +Check whether a Proxy account needs to be created or used and if a proxy account is being used, it is the correct account. + +## Scenario 3 - Bad Metadata + +A View or stored procedure which is used to query views in the linked server, receives login failures whereas a distributed `SELECT` statement copied from them doesn't. This might happen if the View was created and then the linked server was recreated, or a remote table was modified without rebuilding the View. From 5218059c9779646975d6eaacac5f39393e61e249 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Fri, 24 Nov 2023 09:26:38 +0530 Subject: [PATCH 013/370] adjusted formatting --- .../collect-data-to-troubleshoot-sql-connectivity-issues.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md index 12587d6cc4..7a65178456 100644 --- a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md +++ b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md @@ -181,5 +181,7 @@ Following are some questions, which help you understand the category of issue so ## See also Consistent SQL Network Connectivity Issue + [Recommended prerequisites and checklist for troubleshooting SQL Server connectivity issues](resolve-connectivity-errors-checklist.md) + [Troubleshoot connectivity issues in SQL Server](resolve-connectivity-errors-overview.md) From 0da6ee9427e251bba4cd66422b552420fbdea9a2 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Fri, 24 Nov 2023 09:30:07 +0530 Subject: [PATCH 014/370] Applied bulleted lists --- .../collect-data-to-troubleshoot-sql-connectivity-issues.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md index 7a65178456..5aef42e042 100644 --- a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md +++ b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md @@ -180,8 +180,8 @@ Following are some questions, which help you understand the category of issue so ## See also -Consistent SQL Network Connectivity Issue +- Consistent SQL Network Connectivity Issue -[Recommended prerequisites and checklist for troubleshooting SQL Server connectivity issues](resolve-connectivity-errors-checklist.md) +- [Recommended prerequisites and checklist for troubleshooting SQL Server connectivity issues](resolve-connectivity-errors-checklist.md) -[Troubleshoot connectivity issues in SQL Server](resolve-connectivity-errors-overview.md) +- [Troubleshoot connectivity issues in SQL Server](resolve-connectivity-errors-overview.md) From 518ee409ec940f1769075aeaff68371eb29d9d4f Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Fri, 24 Nov 2023 11:10:16 +0530 Subject: [PATCH 015/370] Added more scenarios --- ...tauth-connection-string-error-scenarios.md | 40 ++++++++++++++++++- 1 file changed, 39 insertions(+), 1 deletion(-) diff --git a/support/sql/database-engine/connect/consistentauth-connection-string-error-scenarios.md b/support/sql/database-engine/connect/consistentauth-connection-string-error-scenarios.md index 387ab38467..6fd7f5f2a5 100644 --- a/support/sql/database-engine/connect/consistentauth-connection-string-error-scenarios.md +++ b/support/sql/database-engine/connect/consistentauth-connection-string-error-scenarios.md @@ -57,6 +57,44 @@ Change the connection string, if it is incorrect, or grant the user the required ## Scenario 3 - Wrong Explicit SPN Account -If the application specifies the SQL Server service account in the ServerSPN property of the connection string, for example: +**Symptom** +If the application specifies the SQL Server service account in the `ServerSPN` property of the connection string, for example: +`Provider=SQLNCLI11;Data Source=SQLProd01;initial catalog=northwind;integrated security=sspi;server spn=contoso` + +If the account name is correct, then the connection will use Kerberos. If the account name isn't found, the connection will use NTLM, and if the account exists but isn't the SQL Server service account, an SSPI Context error is generated. + +**Solution** + +You can use one of the methods explained in [Determine If I Am Connected to SQL Server using Kerberos Authentication](https://github.com/microsoft/CSS_SQL_Networking_Tools/wiki/Determine-If-I-Am-Connected-to-SQL-Server-using-Kerberos-Authentication) to test independent of the application. + +Test the connection from a remote computer. Local connections on Windows 2008 R2 and later, use NTLM to support the per-service SID security feature to prevent one service from spoofing another. + +## Scenario 4 - Explicit SPN is missing + +**Symptom** + +If you specify a non-existent SPN explicitly in the ServerSPN property of the connection string, then the connection will be made using NTLM authentication. + +**Solution** + +1. Use SETSPN -L domain\serviceacct to list all SPNs for the SQL Server service account. + +1. Add the missing SPN or change the connection string to use an existing one. + +For further information, see [Register a Service Principal Name for Kerberos connections](/sql/database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections?view=sql-server-ver16). + +It is best to test the connection from a remote machine because even with proper Kerberos configuration, local connections will always use NTLM. + +## Scenario 5 - Explicit Misplaced SPN + +**Symptom** + +If the SPN you specify in the connection string exists on a service account that's not used by SQL Server, you will get an "SSPI Context" error message. + +**Solution** + +Use SETSPN -L domain\svcacct to list SPNs on the SQL Server service account. + +Use SETSPN -Q spnName to find what account the SPN is on. You can move the SPN using SETSPN -D and SETSPN -A or choose an SPN already in the correct account. \ No newline at end of file From 1130419b17492af5e48edb14d96d2352a811dbca Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Fri, 24 Nov 2023 23:17:01 +0530 Subject: [PATCH 016/370] Added new files for each scenario --- ...ccess-through-group-windows-permissions.md | 29 +++++ .../connect/bad-metadata-error.md | 20 ++++ ...bad-server-name-connection-string-error.md | 39 +++++++ ...tauth-connection-string-error-scenarios.md | 100 ------------------ .../connect/explicit-misplaced-spn-error.md | 23 ++++ .../connect/explicit-spn-is-missing-error.md | 25 +++++ ...=> linked-server-account-mapping-error.md} | 30 ++---- .../connect/network-login-disallowed.md | 23 ++++ .../connect/only-admins-can-login.md | 13 +++ .../connect/proxy-account-error.md | 21 ++++ ...vice-account-not-trusted-for-delegation.md | 19 ++++ ...-explicit-spn-account-connection-string.md | 27 +++++ 12 files changed, 246 insertions(+), 123 deletions(-) create mode 100644 support/sql/database-engine/connect/access-through-group-windows-permissions.md create mode 100644 support/sql/database-engine/connect/bad-metadata-error.md create mode 100644 support/sql/database-engine/connect/bad-server-name-connection-string-error.md delete mode 100644 support/sql/database-engine/connect/consistentauth-connection-string-error-scenarios.md create mode 100644 support/sql/database-engine/connect/explicit-misplaced-spn-error.md create mode 100644 support/sql/database-engine/connect/explicit-spn-is-missing-error.md rename support/sql/database-engine/connect/{consistentauth-some-aspects-of-sql-error-scenarios.md => linked-server-account-mapping-error.md} (66%) create mode 100644 support/sql/database-engine/connect/network-login-disallowed.md create mode 100644 support/sql/database-engine/connect/only-admins-can-login.md create mode 100644 support/sql/database-engine/connect/proxy-account-error.md create mode 100644 support/sql/database-engine/connect/service-account-not-trusted-for-delegation.md create mode 100644 support/sql/database-engine/connect/wrong-explicit-spn-account-connection-string.md diff --git a/support/sql/database-engine/connect/access-through-group-windows-permissions.md b/support/sql/database-engine/connect/access-through-group-windows-permissions.md new file mode 100644 index 0000000000..d5ed2154e1 --- /dev/null +++ b/support/sql/database-engine/connect/access-through-group-windows-permissions.md @@ -0,0 +1,29 @@ +--- +title: Troubleshooting the access via group error +description: This article provides cause, symptoms, and solution for troubleshooting the access via group error. +ms.date: 11/23/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Access via group error + +## Symptoms + +If the user doesn't belong to a local group that's used to grant access to the server, the provider should display the "Login failed for user 'contoso/user1'" error message. +The DBA can double-check this by looking at the Security\Logins in SSMS. If it's a contained database, the DBA checks under databasename. + +When you run the `xp_logininfo 'contoso/user1'` stored procedure, the following might occur: + +- If you receive an error, SQL can't resolve the username at all. It is likely that a name isn't present in the Active Directory or there might be issues connecting to the DC. Try using another name to check if the issue is related to a specific account. + +- If you are connecting to cross-domain, the group must be in the SQL Server domain, and not the user domain so that its membership can be resolved. + +- If no rows are returned, then there is no group that provides access to the server. +- If one or more rows are returned, then the user belongs to a group that provides the access. + +## Solution + +To be added \ No newline at end of file diff --git a/support/sql/database-engine/connect/bad-metadata-error.md b/support/sql/database-engine/connect/bad-metadata-error.md new file mode 100644 index 0000000000..aa31e88ea6 --- /dev/null +++ b/support/sql/database-engine/connect/bad-metadata-error.md @@ -0,0 +1,20 @@ +--- +title: Troubleshooting the bad metadata error +description: This article provides cause, symptoms, and solution for troubleshooting the bad metadata error. +ms.date: 11/23/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Bad metadata error + +This article provides the symptoms, and resolution of the bad metadata error. + +## Symptoms + +A View or stored procedure which is used to query views in the linked server, receives login failures whereas a distributed `SELECT` statement copied from them doesn't. This might happen if the View was created and then the linked server was recreated, or a remote table was modified without rebuilding the View. + +## Solution + diff --git a/support/sql/database-engine/connect/bad-server-name-connection-string-error.md b/support/sql/database-engine/connect/bad-server-name-connection-string-error.md new file mode 100644 index 0000000000..81f1b415e4 --- /dev/null +++ b/support/sql/database-engine/connect/bad-server-name-connection-string-error.md @@ -0,0 +1,39 @@ +--- +title: Troubleshooting bad server name in connection string issue +description: This article provides cause, symptoms, and workarounds for troubleshooting the bad server name in connection string error. +ms.date: 11/23/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Bad server name in connection string error + +This article helps you to troubleshoot the bad server name error. + +## Symptoms + +SQLOLEDB and SQLNCLI11 OLE DB providers over TCP or Named Pipes show the following error messages: + +- `Login failed for user 'userx'.`- Message is shown when the providers use an SQL login. +- `Login failed for user 'CONTOSO\user1'.`- Message is shown the providers use a Windows login. + +The SQL Server and ODBC Driver 13 ODBC Drivers show the following error message: + +`Login failed for user 'CONTOSO\user1'` + +The SqlClient .NET Provider displays the following error messages: + +> "Login failed for user ''. -when using TCP and a SQL login or a Windows login" +> "Login failed for user 'CONTOSO\user1'. - when using Named Pipes and a SQL login or a Windows login" + +The SQL Server Errorlog will have one of the following messages: + +> "'Login failed for user'. Reason: Could not find a login matching the name provided." +> "'Login failed for user 'CONTOSO\USER1'. Reason: Could not find a login matching the name provided." + +## Solution + +This can be a common issue if you deploy an application that uses a DEV or QA server into production and you fail to update the connection string. To resolve this issue, validate that you are connecting to the appropriate server. If not, correct the connection string. If it is, then add the login to the database or if it's a Windows login, add it to a local group or domain group that's allowed to connect to the database server. + diff --git a/support/sql/database-engine/connect/consistentauth-connection-string-error-scenarios.md b/support/sql/database-engine/connect/consistentauth-connection-string-error-scenarios.md deleted file mode 100644 index 6fd7f5f2a5..0000000000 --- a/support/sql/database-engine/connect/consistentauth-connection-string-error-scenarios.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: Troubleshooting errors specific to connection strings -description: This article provides cause, symptoms, and workarounds for errors related to connection strings. -ms.date: 11/23/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp -ms.custom: sap:Connection issues ---- - -# Connection string related issues - -This article helps you to troubleshoot connection string related error scenarios. - -## Scenario 1 - Bad Server name in connection string - -Consider the following scenario: - -SQLOLEDB and SQLNCLI11 OLE DB providers over TCP or Named Pipes show the following error messages: - -- "Login failed for user 'userx'." - Message is shown when the providers use an SQL login. -- "Login failed for user 'CONTOSO\user1'." - Message is shown the providers use a Windows login. - -The SQL Server and ODBC Driver 13 ODBC Drivers show the following error message: - -> "Login failed for user 'CONTOSO\user1'." - -The SqlClient .NET Provider displays the following error messages: - -> "Login failed for user ''. -when using TCP and a SQL login or a Windows login" -> "Login failed for user 'CONTOSO\user1'. - when using Named Pipes and a SQL login or a Windows login" - -The SQL Server Errorlog will have one of the following messages: - -> "'Login failed for user'. Reason: Could not find a login matching the name provided." -> "'Login failed for user 'CONTOSO\USER1'. Reason: Could not find a login matching the name provided." - -**Solution** - -This can be a common issue if you deploy an application that uses a DEV or QA server into production and you fail to update the connection string. To resolve this issue, validate that you are connecting to the appropriate server. If not, correct the connection string. If it is, then add the login to the database or if it's a Windows login, add it to a local group or domain group that's allowed to connect to the database server. - -## Scenario 2 - Wrong Database Name in Connection String - -The driver might generate the following error message: - -"Cannot open database "northwind" requested by the login. The login failed." - -Some drivers might also generate the "Login failed for user CONTOSO\user1" error message. - -The SQL Server Errorlog will have one of the following message: -"Login failed for user 'CONTOSO\User1'. Reason: Failed to open the explicitly specified database 'northwind'." - -**Solution** - -Make sure that The database name should be clear in the error message and the Errorlog entry. -Change the connection string, if it is incorrect, or grant the user the required permissions. - -## Scenario 3 - Wrong Explicit SPN Account - -**Symptom** - -If the application specifies the SQL Server service account in the `ServerSPN` property of the connection string, for example: - -`Provider=SQLNCLI11;Data Source=SQLProd01;initial catalog=northwind;integrated security=sspi;server spn=contoso` - -If the account name is correct, then the connection will use Kerberos. If the account name isn't found, the connection will use NTLM, and if the account exists but isn't the SQL Server service account, an SSPI Context error is generated. - -**Solution** - -You can use one of the methods explained in [Determine If I Am Connected to SQL Server using Kerberos Authentication](https://github.com/microsoft/CSS_SQL_Networking_Tools/wiki/Determine-If-I-Am-Connected-to-SQL-Server-using-Kerberos-Authentication) to test independent of the application. - -Test the connection from a remote computer. Local connections on Windows 2008 R2 and later, use NTLM to support the per-service SID security feature to prevent one service from spoofing another. - -## Scenario 4 - Explicit SPN is missing - -**Symptom** - -If you specify a non-existent SPN explicitly in the ServerSPN property of the connection string, then the connection will be made using NTLM authentication. - -**Solution** - -1. Use SETSPN -L domain\serviceacct to list all SPNs for the SQL Server service account. - -1. Add the missing SPN or change the connection string to use an existing one. - -For further information, see [Register a Service Principal Name for Kerberos connections](/sql/database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections?view=sql-server-ver16). - -It is best to test the connection from a remote machine because even with proper Kerberos configuration, local connections will always use NTLM. - -## Scenario 5 - Explicit Misplaced SPN - -**Symptom** - -If the SPN you specify in the connection string exists on a service account that's not used by SQL Server, you will get an "SSPI Context" error message. - -**Solution** - -Use SETSPN -L domain\svcacct to list SPNs on the SQL Server service account. - -Use SETSPN -Q spnName to find what account the SPN is on. You can move the SPN using SETSPN -D and SETSPN -A or choose an SPN already in the correct account. \ No newline at end of file diff --git a/support/sql/database-engine/connect/explicit-misplaced-spn-error.md b/support/sql/database-engine/connect/explicit-misplaced-spn-error.md new file mode 100644 index 0000000000..8d07060df2 --- /dev/null +++ b/support/sql/database-engine/connect/explicit-misplaced-spn-error.md @@ -0,0 +1,23 @@ +--- +title: Troubleshooting the explicit misplaced SPN issue +description: This article provides cause, symptoms, and workarounds for troubleshooting the explicit SPN is missing issue. +ms.date: 11/23/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Explicit misplaced SPN + +## Symptoms + +If the SPN you specify in the connection string exists on a service account that's not used by SQL Server, you will get an "SSPI Context" error message. + +## Solution + +To resolve this errors, follow these steps: + +1. Use `SETSPN -L domain\svcacct` to list SPNs on the SQL Server service account. + +1. Use `SETSPN -Q spnName` to find what account the SPN is on. You can move the SPN using `SETSPN -D` and `SETSPN -A` or choose an SPN already in the correct account. \ No newline at end of file diff --git a/support/sql/database-engine/connect/explicit-spn-is-missing-error.md b/support/sql/database-engine/connect/explicit-spn-is-missing-error.md new file mode 100644 index 0000000000..a14df449a5 --- /dev/null +++ b/support/sql/database-engine/connect/explicit-spn-is-missing-error.md @@ -0,0 +1,25 @@ +--- +title: Troubleshooting explicit SPN is missing issue +description: This article provides cause, symptoms, and workarounds for troubleshooting the explicit SPN is missing issue. +ms.date: 11/23/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Explicit SPN is missing error + +## Symptoms + +If you specify a non-existent SPN explicitly in the ServerSPN property of the connection string, then the connection will be made using NTLM authentication. + +## Solution + +1. Use `SETSPN -L domain\serviceacct` to list all SPNs for the SQL Server service account. + +1. Add the missing SPN or change the connection string to use an existing one. + +For further information, see [Register a Service Principal Name for Kerberos connections](/sql/database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections?view=sql-server-ver16). + +It is best to test the connection from a remote machine because even with proper Kerberos configuration, local connections will always use NTLM. \ No newline at end of file diff --git a/support/sql/database-engine/connect/consistentauth-some-aspects-of-sql-error-scenarios.md b/support/sql/database-engine/connect/linked-server-account-mapping-error.md similarity index 66% rename from support/sql/database-engine/connect/consistentauth-some-aspects-of-sql-error-scenarios.md rename to support/sql/database-engine/connect/linked-server-account-mapping-error.md index 2426c4b602..5b6ebad7a8 100644 --- a/support/sql/database-engine/connect/consistentauth-some-aspects-of-sql-error-scenarios.md +++ b/support/sql/database-engine/connect/linked-server-account-mapping-error.md @@ -1,6 +1,6 @@ --- -title: Troubleshooting various aspects -description: This article provides cause, symptoms, and workarounds for some of the aspects of SQL Server using which you can troubleshoot related problems. +title: Troubleshooting linked server account mapping issue +description: This article provides cause, symptoms, and workarounds for troubleshooting the linked server account mapping issue. ms.date: 11/23/2023 author: prmadhes-msft ms.author: prmadhes @@ -8,13 +8,11 @@ ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp ms.custom: sap:Connection issues --- -# Issues with some aspects of SQL Server +# Linked Server Account Mapping error -This article details a scenario related to SQLOLEDB and provides resolution. +This article provides the cause, symptoms, and resolution of the linked server account mapping error. -## Scenario 1 - Linked Server Account Mapping - -**Symptoms** +## Symptoms When you connect to the mid-tier server from the Management Studio, you might see the following error messages: @@ -33,25 +31,11 @@ If you also see the following error message, it indicates you are using Named Pi > "OLE DB provider "MSDASQL" for linked server "SQLPROD02" returned message "[Microsoft][SQL Server Native Client 11.0][SQL Server]Login failed for user 'CONTOSO\SQLPROD01$'." -**Solution** +## Solution In the **Linked Server security** dialog, when you select the **Be made without using a security context** option, the "Login Failed" for user "NT AUTHORITY\ANONYMOUS LOGON" error is displayed. When you select **Be made with this security context**, the SQL login is successful. You can correct this error by forcing TCP/IP or granting the appropriate permissions. In addition to the settings in the **Linked Server security** dialog, you can modify the individual account mappings in the upper portion of the dialog, which overrides the main mapping settings. > [!NOTE] -> Using a SQL Server ODBC driver in a linked server isn't a supported scenario. Other ODBC drivers might have limited support from Microsoft and mainly from the vendor. - -## Scenario 2 - Proxy account - -**Symptoms** - -An SSIS job run by SQL Agent might need permissions other than the SQL Agent service account can provide. - -**Solution** - -Check whether a Proxy account needs to be created or used and if a proxy account is being used, it is the correct account. - -## Scenario 3 - Bad Metadata - -A View or stored procedure which is used to query views in the linked server, receives login failures whereas a distributed `SELECT` statement copied from them doesn't. This might happen if the View was created and then the linked server was recreated, or a remote table was modified without rebuilding the View. +> Using a SQL Server ODBC driver in a linked server isn't a supported scenario. Other ODBC drivers might have limited support from Microsoft and mainly from the vendor. \ No newline at end of file diff --git a/support/sql/database-engine/connect/network-login-disallowed.md b/support/sql/database-engine/connect/network-login-disallowed.md new file mode 100644 index 0000000000..5b8c920957 --- /dev/null +++ b/support/sql/database-engine/connect/network-login-disallowed.md @@ -0,0 +1,23 @@ +--- +title: Troubleshooting the network login disallowed error +description: This article provides cause, symptoms, and workarounds for troubleshooting the network login disallowed error. +ms.date: 11/24/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Network login disallowed error + +This article provides the cause, symptoms, and resolution of the Network login disallowed error. + +## Symptoms + +The following error message might be shown in an event on the SQL Server where the user doesn't have the allowed login type. + +> "The user account is not allowed the Network Login type." + +## Solution + +Check in the *secpol.msc* file to see that the user account (or a group they might belong to) doesn't exist in the **Local Policies > User Rights Assignment > Deny access to this computer from the network** security policy settings. diff --git a/support/sql/database-engine/connect/only-admins-can-login.md b/support/sql/database-engine/connect/only-admins-can-login.md new file mode 100644 index 0000000000..d28b1da04e --- /dev/null +++ b/support/sql/database-engine/connect/only-admins-can-login.md @@ -0,0 +1,13 @@ +--- +title: Troubleshooting only admins can login error +description: This article provides cause, symptoms, and workarounds for troubleshooting the only admins can login error. +ms.date: 11/23/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + + +# Only admins can login error + diff --git a/support/sql/database-engine/connect/proxy-account-error.md b/support/sql/database-engine/connect/proxy-account-error.md new file mode 100644 index 0000000000..21907e5166 --- /dev/null +++ b/support/sql/database-engine/connect/proxy-account-error.md @@ -0,0 +1,21 @@ +--- +title: Troubleshooting the proxy account error +description: This article provides cause, symptoms, and workarounds for troubleshooting the proxy account error. +ms.date: 11/23/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Proxy account error + +This article provides the cause, symptoms, and resolution of the proxy account error. + +## Symptoms + +An SSIS job run by SQL Agent might need permissions other than the SQL Agent service account can provide. + +## Solution + +Check whether a Proxy account needs to be created or used and if a proxy account is being used, it is the correct account. \ No newline at end of file diff --git a/support/sql/database-engine/connect/service-account-not-trusted-for-delegation.md b/support/sql/database-engine/connect/service-account-not-trusted-for-delegation.md new file mode 100644 index 0000000000..6197ca9968 --- /dev/null +++ b/support/sql/database-engine/connect/service-account-not-trusted-for-delegation.md @@ -0,0 +1,19 @@ +--- +title: Troubleshooting the service account not trusted for delegation error +description: This article provides cause, symptoms, and solution for troubleshooting the service account not trusted for delegation error. +ms.date: 11/23/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Service account not trusted for delegation error + +## Symptoms + +(To be added) + +## Solution + +If a delegation scenario isn't enabled, check the SQL Server *secpol.msc* if the SQL Server service account is listed under **Local Policies > User Rights Assignment > Impersonate a client after authentication** security policy settings. diff --git a/support/sql/database-engine/connect/wrong-explicit-spn-account-connection-string.md b/support/sql/database-engine/connect/wrong-explicit-spn-account-connection-string.md new file mode 100644 index 0000000000..4ac617ca66 --- /dev/null +++ b/support/sql/database-engine/connect/wrong-explicit-spn-account-connection-string.md @@ -0,0 +1,27 @@ +--- +title: Troubleshooting wrong explicit SPN account error +description: This article provides cause, symptoms, and workarounds for troubleshooting the linked server account mapping issue. +ms.date: 11/23/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Wrong Explicit SPN Account error + +This article provides the cause, symptoms, and resolution of the wrong explicit SPN account error. + +## Symptoms + +If the application specifies the SQL Server service account in the `ServerSPN` property of the connection string, for example: + +`Provider=SQLNCLI11;Data Source=SQLProd01;initial catalog=northwind;integrated security=sspi;server spn=contoso` + +If the account name is correct, then the connection will use Kerberos. If the account name isn't found, the connection will use NTLM, and if the account exists but isn't the SQL Server service account, an SSPI Context error is generated. + +## Solution + +You can use one of the methods explained in [Determine If I Am Connected to SQL Server using Kerberos Authentication](https://github.com/microsoft/CSS_SQL_Networking_Tools/wiki/Determine-If-I-Am-Connected-to-SQL-Server-using-Kerberos-Authentication) to test independent of the application. + +Test the connection from a remote computer. Local connections on Windows 2008 R2 and later, use NTLM to support the per-service SID security feature to prevent one service from spoofing another. \ No newline at end of file From 91150abe71c29dbfc3e2b3787fc38a8044ad9bee Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Sat, 25 Nov 2023 06:34:10 +0530 Subject: [PATCH 017/370] Updated text - added text Added a topic Combining commits Added content --- ...ccess-through-group-windows-permissions.md | 8 ++++- .../connect/bad-metadata-error.md | 9 +++-- ...bad-server-name-connection-string-error.md | 16 +++++++-- .../connect/corrupt-user-file.md | 30 ++++++++++++++++ .../local-security-subsystem-issues.md | 35 +++++++++++++++++++ .../connect/only-admins-can-login.md | 24 ++++++++++++- 6 files changed, 116 insertions(+), 6 deletions(-) create mode 100644 support/sql/database-engine/connect/corrupt-user-file.md create mode 100644 support/sql/database-engine/connect/local-security-subsystem-issues.md diff --git a/support/sql/database-engine/connect/access-through-group-windows-permissions.md b/support/sql/database-engine/connect/access-through-group-windows-permissions.md index d5ed2154e1..0b22a479ce 100644 --- a/support/sql/database-engine/connect/access-through-group-windows-permissions.md +++ b/support/sql/database-engine/connect/access-through-group-windows-permissions.md @@ -10,7 +10,9 @@ ms.custom: sap:Connection issues # Access via group error -## Symptoms +This articles helps you to resolve Access via group Windows permission error. + +## Cause If the user doesn't belong to a local group that's used to grant access to the server, the provider should display the "Login failed for user 'contoso/user1'" error message. The DBA can double-check this by looking at the Security\Logins in SSMS. If it's a contained database, the DBA checks under databasename. @@ -24,6 +26,10 @@ When you run the `xp_logininfo 'contoso/user1'` stored procedure, the following - If no rows are returned, then there is no group that provides access to the server. - If one or more rows are returned, then the user belongs to a group that provides the access. +## Symptoms + +To be added + ## Solution To be added \ No newline at end of file diff --git a/support/sql/database-engine/connect/bad-metadata-error.md b/support/sql/database-engine/connect/bad-metadata-error.md index aa31e88ea6..3e92c5dbb1 100644 --- a/support/sql/database-engine/connect/bad-metadata-error.md +++ b/support/sql/database-engine/connect/bad-metadata-error.md @@ -10,11 +10,16 @@ ms.custom: sap:Connection issues # Bad metadata error -This article provides the symptoms, and resolution of the bad metadata error. +This article helps you to resolve a problem when there is a bad metadata error. -## Symptoms +## Cause A View or stored procedure which is used to query views in the linked server, receives login failures whereas a distributed `SELECT` statement copied from them doesn't. This might happen if the View was created and then the linked server was recreated, or a remote table was modified without rebuilding the View. +## Symptoms + +To be added + ## Solution +To be added \ No newline at end of file diff --git a/support/sql/database-engine/connect/bad-server-name-connection-string-error.md b/support/sql/database-engine/connect/bad-server-name-connection-string-error.md index 81f1b415e4..83a26a507f 100644 --- a/support/sql/database-engine/connect/bad-server-name-connection-string-error.md +++ b/support/sql/database-engine/connect/bad-server-name-connection-string-error.md @@ -10,7 +10,11 @@ ms.custom: sap:Connection issues # Bad server name in connection string error -This article helps you to troubleshoot the bad server name error. +This article helps you to resolve the problem related to the bad server name error. + +## Cause + +This can be a common issue if you deploy an application that uses a DEV or QA server into production and you fail to update the connection string. ## Symptoms @@ -35,5 +39,13 @@ The SQL Server Errorlog will have one of the following messages: ## Solution -This can be a common issue if you deploy an application that uses a DEV or QA server into production and you fail to update the connection string. To resolve this issue, validate that you are connecting to the appropriate server. If not, correct the connection string. If it is, then add the login to the database or if it's a Windows login, add it to a local group or domain group that's allowed to connect to the database server. +To resolve this issue: + +1. Validate that you are connecting to the appropriate server. + +1. If the server is not the appropriate one, then the connection string. + +1. If the connection string is correct, add the login to the database. + +1. If it is a Windows login, add it to a local group or domain group that's allowed to connect to the database server. diff --git a/support/sql/database-engine/connect/corrupt-user-file.md b/support/sql/database-engine/connect/corrupt-user-file.md new file mode 100644 index 0000000000..c4ece5fa2c --- /dev/null +++ b/support/sql/database-engine/connect/corrupt-user-file.md @@ -0,0 +1,30 @@ +--- +title: Troubleshooting the bad metadata error +description: This article provides cause, symptoms, and solution for troubleshooting the bad metadata error. +ms.date: 11/23/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Corrupt user file error + +This article helps you resolve the corrupt user file error. + +## Cause + +If you log in as the affected user, you will get a temporary profile. This is a good indication that the profile is corrupt or you are a guest user. If you are a guest user, then you must be added to the appropriate groups. + +## Symptoms + +To be added + +## Resolution + +If you are not a guest user, then use the steps in Fix a corrupted user profile in Windows to either (a) repair the profile or (b) delete and recreate the profile. + + + + + diff --git a/support/sql/database-engine/connect/local-security-subsystem-issues.md b/support/sql/database-engine/connect/local-security-subsystem-issues.md new file mode 100644 index 0000000000..79e342a9e0 --- /dev/null +++ b/support/sql/database-engine/connect/local-security-subsystem-issues.md @@ -0,0 +1,35 @@ +--- +title: Troubleshooting local security subsystem issues +description: This article provides cause, symptoms, and workarounds for troubleshooting the local security subsystem issues. +ms.date: 11/25/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Local security subsystem issues + +This article helps to resolve the problem related to local security subsystem issues. + +## Cause + +To be added + +## Symptoms + +The driver shows the "The login is from an untrusted domain and cannot be used with Windows authentication" error message. + +The SQL Server Errorlog will have the following messages: + +`SSPI handshake failed with error code 0x80090311, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure` + +`SSPI handshake failed with error code 0x80090304, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure.` + +You might also see Kerberos errors in the System event log on the SQL Server machine for the same time range. The following error codes have specific meanings: + +"Error -2146893039 (0x80090311): No authority could be contacted for authentication. This is an Active Directory issue." + +## Resolution + +To be added diff --git a/support/sql/database-engine/connect/only-admins-can-login.md b/support/sql/database-engine/connect/only-admins-can-login.md index d28b1da04e..4655591a54 100644 --- a/support/sql/database-engine/connect/only-admins-can-login.md +++ b/support/sql/database-engine/connect/only-admins-can-login.md @@ -8,6 +8,28 @@ ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp ms.custom: sap:Connection issues --- - # Only admins can login error +This article helps you resolve the "Only admins can login" error. + +## Cause + +The **CrashOnAuditFail** feature is a security feature used by system administrators to check all security events. The valid values for "CrashOnAuditFail" are 0, 1, and 2. If the key is set to 2, it means that the security event log is full. + +## Resolution + +To resolve the error, follow these steps: + +1. Start the Registry Editor. +1. Locate the following key, and then check whether the value of this key is set to *2*: + + `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa!crashonauditfail` + + This indicates that the security event log requires manual clearing. + +1. Set the value to *0* and then reboot the server. + + You might also want to change the security event log to allow events to roll over. For more information about how the setting affects all services such as SQL, IIS, file share, and login, see [Users cannot access Web sites when the security event log is full](../../../developer/webapps/iis/general/users-cannot-access-web-sites-when-log-full.md). + + > [!NOTE] + > This only affects integrated logins. A Named Pipe connection will also be affected with a SQL Login because Named Pipes first logs into Windows' Admin pipe before connecting to SQL Server. From f524e168347045a829f2df068849c5972a8cc510 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Mon, 27 Nov 2023 17:44:27 +0530 Subject: [PATCH 018/370] Updated text, removed unnecessary files Combined the commits Corrected consistency issues --- ...ccess-through-group-windows-permissions.md | 18 ++-- .../connect/bad-metadata-error.md | 8 +- ...bad-server-name-connection-string-error.md | 11 +-- ...tent-authentication-connectivity-issues.md | 85 ++++++++++++------- .../connect/corrupt-user-file.md | 30 ------- .../connect/corrupt-user-profile.md | 21 +++++ .../connect/explicit-misplaced-spn-error.md | 23 ----- .../connect/explicit-spn-is-missing-error.md | 25 ------ .../linked-server-account-mapping-error.md | 20 ++--- .../local-security-subsystem-issues.md | 8 +- ...s-connection-fail-no-windows-permission.md | 28 ++++++ .../connect/network-login-disallowed.md | 8 +- .../connect/only-admins-can-login.md | 4 +- .../connect/proxy-account-error.md | 8 +- ...vice-account-not-trusted-for-delegation.md | 6 +- ...rong-database-name-in-connection-string.md | 28 ++++++ ...-explicit-spn-account-connection-string.md | 12 +-- 17 files changed, 179 insertions(+), 164 deletions(-) delete mode 100644 support/sql/database-engine/connect/corrupt-user-file.md create mode 100644 support/sql/database-engine/connect/corrupt-user-profile.md delete mode 100644 support/sql/database-engine/connect/explicit-misplaced-spn-error.md delete mode 100644 support/sql/database-engine/connect/explicit-spn-is-missing-error.md create mode 100644 support/sql/database-engine/connect/named-pipes-connection-fail-no-windows-permission.md create mode 100644 support/sql/database-engine/connect/wrong-database-name-in-connection-string.md diff --git a/support/sql/database-engine/connect/access-through-group-windows-permissions.md b/support/sql/database-engine/connect/access-through-group-windows-permissions.md index 0b22a479ce..4ce868b4d1 100644 --- a/support/sql/database-engine/connect/access-through-group-windows-permissions.md +++ b/support/sql/database-engine/connect/access-through-group-windows-permissions.md @@ -1,7 +1,7 @@ --- title: Troubleshooting the access via group error -description: This article provides cause, symptoms, and solution for troubleshooting the access via group error. -ms.date: 11/23/2023 +description: This article provides symptoms and resolution for the access via group error. +ms.date: 11/27/2023 author: prmadhes-msft ms.author: prmadhes ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp @@ -10,16 +10,16 @@ ms.custom: sap:Connection issues # Access via group error -This articles helps you to resolve Access via group Windows permission error. +This article helps you to resolve the access via group Windows permission error. ## Cause -If the user doesn't belong to a local group that's used to grant access to the server, the provider should display the "Login failed for user 'contoso/user1'" error message. -The DBA can double-check this by looking at the Security\Logins in SSMS. If it's a contained database, the DBA checks under databasename. +If the user doesn't belong to a local group used to grant access to the server, the provider should display the "Login failed for user 'contoso/user1'" error message. +The DBA can double-check the access by looking at the Security\Logins in SSMS. If it's a contained database, the DBA checks under database name. -When you run the `xp_logininfo 'contoso/user1'` stored procedure, the following might occur: +When you run the `xp_logininfo 'contoso/user1'` stored procedure, the following are likely to happen: -- If you receive an error, SQL can't resolve the username at all. It is likely that a name isn't present in the Active Directory or there might be issues connecting to the DC. Try using another name to check if the issue is related to a specific account. +- If you receive an error, SQL can't resolve the user name at all. It is likely that a name isn't present in the Active Directory or there might be issues connecting to the Domain Controller (DC). Try using another name to check if the issue is related to a specific account. - If you are connecting to cross-domain, the group must be in the SQL Server domain, and not the user domain so that its membership can be resolved. @@ -30,6 +30,6 @@ When you run the `xp_logininfo 'contoso/user1'` stored procedure, the following To be added -## Solution +## Resolution -To be added \ No newline at end of file +To be added diff --git a/support/sql/database-engine/connect/bad-metadata-error.md b/support/sql/database-engine/connect/bad-metadata-error.md index 3e92c5dbb1..4299f509b7 100644 --- a/support/sql/database-engine/connect/bad-metadata-error.md +++ b/support/sql/database-engine/connect/bad-metadata-error.md @@ -1,6 +1,6 @@ --- title: Troubleshooting the bad metadata error -description: This article provides cause, symptoms, and solution for troubleshooting the bad metadata error. +description: This article provides symptoms and resolution for troubleshooting the bad metadata error. ms.date: 11/23/2023 author: prmadhes-msft ms.author: prmadhes @@ -12,14 +12,12 @@ ms.custom: sap:Connection issues This article helps you to resolve a problem when there is a bad metadata error. -## Cause - A View or stored procedure which is used to query views in the linked server, receives login failures whereas a distributed `SELECT` statement copied from them doesn't. This might happen if the View was created and then the linked server was recreated, or a remote table was modified without rebuilding the View. ## Symptoms To be added -## Solution +## Resolution -To be added \ No newline at end of file +To be added diff --git a/support/sql/database-engine/connect/bad-server-name-connection-string-error.md b/support/sql/database-engine/connect/bad-server-name-connection-string-error.md index 83a26a507f..bf9abce649 100644 --- a/support/sql/database-engine/connect/bad-server-name-connection-string-error.md +++ b/support/sql/database-engine/connect/bad-server-name-connection-string-error.md @@ -1,7 +1,7 @@ --- title: Troubleshooting bad server name in connection string issue -description: This article provides cause, symptoms, and workarounds for troubleshooting the bad server name in connection string error. -ms.date: 11/23/2023 +description: This article provides symptoms and resolution for troubleshooting the bad server name in connection string error. +ms.date: 11/27/2023 author: prmadhes-msft ms.author: prmadhes ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp @@ -12,8 +12,6 @@ ms.custom: sap:Connection issues This article helps you to resolve the problem related to the bad server name error. -## Cause - This can be a common issue if you deploy an application that uses a DEV or QA server into production and you fail to update the connection string. ## Symptoms @@ -37,9 +35,9 @@ The SQL Server Errorlog will have one of the following messages: > "'Login failed for user'. Reason: Could not find a login matching the name provided." > "'Login failed for user 'CONTOSO\USER1'. Reason: Could not find a login matching the name provided." -## Solution +## Resolution -To resolve this issue: +To resolve this issue, follow these steps: 1. Validate that you are connecting to the appropriate server. @@ -48,4 +46,3 @@ To resolve this issue: 1. If the connection string is correct, add the login to the database. 1. If it is a Windows login, add it to a local group or domain group that's allowed to connect to the database server. - diff --git a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md index 2f6ca01f16..9717477a89 100644 --- a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md +++ b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md @@ -1,7 +1,7 @@ --- title: Introduction to consistent authentication issues description: This article introduces to consistent authentication issues, the types of error messages, and workarounds to troubleshoot various problems. -ms.date: 11/21/2023 +ms.date: 11/27/2023 author: prmadhes-msft ms.author: prmadhes ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp @@ -22,21 +22,21 @@ To troubleshoot consistent authentication issues, follow these steps: 1. See the recommended [prerequisites and checklist for troubleshooting SQL Server connectivity issues](resolve-connectivity-errors-checklist.md). 1. Collect data to troubleshoot SQL consistent authentication issues. - This will help you to get a macro perspective of the scope of an issue, that is whether the issue affects single or multiple computers or whether only computers in a specific data center are affected. This can help you focus on the troubleshooting steps. It will also prepare you to discuss the problem with Microsoft Support should you choose to do so. + This will help you to get a macro perspective of the scope of an issue, that is whether the issue affects single or multiple machines or whether only machines in a specific data center are affected. This can help you focus on the troubleshooting steps. It will also prepare you to discuss the problem with Microsoft Support should you choose to do so. -1. Make sure you understand the application architecture and summarize the issue like the following description: +1. Make sure you understand the application architecture and summarize the issue like the following description: - There are two domains involved: contoso and fabrikam. - - The client sparky.contoso.com runs on Windows 2012. + - The client `sparky.contoso.com` runs on Windows 2012. - - The user contoso\johndoe runs on EDGE and connects to a web server (http://web01.contoso.com/accounting) using integrated security. + - The user `contoso\johndoe` runs on EDGE and connects to a web server `(http://web01.contoso.com/accounting)` using integrated security. - - The IIS app pool runs as contoso\web_svc. + - The IIS app pool runs as `contoso\web_svc`. - The web server connects to SQL Server 2014 (SQLProd01.fabrikam.com\Accounting on port 1433) using the SqlClient .NET 4.6.2 Provider and assigns the user credentials to SQL Server using integrated security. - - The SQL Server service account is fabrikam\sql_svc_01. + - The SQL Server service account is `fabrikam\sql_svc_01`. 1. Collect the SPN information based on the service accounts identified in the description. For example: @@ -45,40 +45,63 @@ To troubleshoot consistent authentication issues, follow these steps: ## Types of errors -Before you start to troubleshoot errors, it's important to understand what each error means and also what is the type of error. It's also important to understand the category of the error because the workflow also varies. This section provides various types of consistent authentication errors. +Before you start to troubleshoot errors, it's important to understand what each error means and also what is the type of error. It's also important to understand the category of the error because the troubleshooting steps also vary. This section provides various types of consistent authentication errors. -- [Directory Services specific error messages](#directory-services-specific-error-messages) - Refers to the Active Directory error messages. If the SQL Server ERRORLOG file contains the following messages, then this is an Active Directory issue. This might happen if the domain controller can't be contacted by Windows on the SQL Server computer, or the local security service (LSASS) is having a problem. +- Directory Services specific error messages - Refers to the Active Directory error messages. If the SQL Server ERRORLOG file contains the following messages, then this is an Active Directory issue. This might happen if the domain controller can't be contacted by Windows on the SQL Server computer, or the local security service (LSASS) is having a problem. > Error -2146893039 (0x80090311): No authority could be contacted for authentication. > Error -2146893052 (0x80090304): The Local Security Authority cannot be contacted. -- [Login failed error codes](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16#additional-error-information) - If you are troubleshooting a "Login Failed" error message, the SQL Server ERRORLOG file can provide more information in the SQL State value with error 18456 (Login Failed). +- [Login failed error codes](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true#additional-error-information) - If you are troubleshooting a "Login Failed" error message, the SQL Server ERRORLOG file can provide more information in the SQL State value with error 18456 (Login Failed). - [Login failed error messages](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true) - Refers to some of the common login failures. For more information, see [MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true). - [Login failed for user '(null)'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16#login-failed-for-user-(null)) - [Login failed for user ''](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) - [Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) - [Login failed for user 'username'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) - [Login failed for user 'DOMAIN\username'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) - Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. - SQL Server does not exist or access denied - This can also be a network error. + - [Login failed for user '(null)'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true#login-failed-for-user-(null)) + - [Login failed for user ''](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) + - [Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) + - [Login failed for user 'username'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) + - [Login failed for user 'DOMAIN\username'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) + - Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. + - [SQL Server does not exist or access denied](network-related-or-instance-specific-error-occurred-while-establishing-connection.md) - This can also be a network error. - [SSPI context messages](/troubleshoot/sql/database-engine/connect/cannot-generate-sspi-context-error?branch=main) ## Categorization of error messages Before you start with troubleshooting, it is important to understand the nature of an error and the category that it belongs to. This section provides error messages grouped based on a category. Some errors might appear in more than one category. Each of these error scenarios has the symptoms and the solutions as well. Following are the error categories. -- Issues with a SQL Login - Refers to the error scenarios related to failed login. For more information, see [MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). - -- [Issues with different aspects of SQL Server](consistentauth-some-aspects-of-sql-error-scenarios.md) - Refers to error scenarios related to database offline, database permissions, missing login and so on. For more information, see [Login failed for user NT AUTHORITY\ANONYMOUS LOGON](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error#Login-failed-for-user-NT-AUTHORITY\ANONYMOUS-LOGON). - -- Issues with the connection string - Refers to various error scenarios such as wrong database name, wrong SPN account, missing SPN, misplaced SPN, and duplicate SPN. - -- Issues with local Windows permissions or Policy settings - Refers to permission oriented error scenarios such as corrupt user profile, local security subsystem issues, network login disallowed, and so on. - -- Issues specific to NTLM - Refers to scenarios related to NTLM such as peer login, double hop, loopback protection, and so on. For more information, see [Login failed for user NT AUTHORITY\ANONYMOUS LOGON](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error#Login-failed-for-user-NT-AUTHORITY\ANONYMOUS-LOGON). - -- Issues specific to Active Directory and Domain Controller - Refers to scenarios such as account and group related error scenarios. - -- Miscellaneous issues - Refers to scenarios that do not fall under any of the previous scenarios. - +- Following are the errors specific to failed login: + - [Bad password](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) + - [Invalid username](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) + - [SQL logins are not enabled](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) + - [Named Pipes connections fail because the user doesn't have permission to log into Windows](named-pipes-connection-fail-no-windows-permission.md). + +- Following are the errors specific to the different aspects of SQL Server: + - [Database offline](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) + - [Database permissions](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) + - [No Login](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) + - [Linked Server Account Mapping](linked-server-account-mapping-error.md) + - [Proxy Account](proxy-account-error.md) + - [Bad metadata](bad-metadata-error.md) + +- Following are the errors specific to Connection String: + - [Bad server name in Connection String](bad-server-name-connection-string-error.md) + - [Wrong database name in Connection String](wrong-database-name-in-connection-string.md) + - [Wrong explicit SPN account](wrong-explicit-spn-account-connection-string.md) + - [Explicit SPN is missing](cannot-generate-sspi-context-error.md) + - [Explicit Misplaced SPN](cannot-generate-sspi-context-error.md) + - [Explicit SPN is duplicated](cannot-generate-sspi-context-error.md) + +- Following are the errors specific to the local Windows permissions or Policy settings. + - [Access via Group](access-through-group-windows-permissions.md) + - [Network login disallowed](network-login-disallowed.md) + - [Service account not trusted for delegation](service-account-not-trusted-for-delegation.md) + - [Only admins can login](only-admins-can-login.md) + - [Local Security Subsystem Issues](local-security-subsystem-issues.md) + - [Corrupt user profile](corrupt-user-profile.md) + - [Credential Guard is enabled](/windows/security/identity-protection/credential-guard/considerations-known-issues) + +- Following are the errors specific to NTLM: + (To be added) + +- Issues specific to Active Directory and Domain Controller - To be added + +- Miscellaneous issues - To be added. diff --git a/support/sql/database-engine/connect/corrupt-user-file.md b/support/sql/database-engine/connect/corrupt-user-file.md deleted file mode 100644 index c4ece5fa2c..0000000000 --- a/support/sql/database-engine/connect/corrupt-user-file.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -title: Troubleshooting the bad metadata error -description: This article provides cause, symptoms, and solution for troubleshooting the bad metadata error. -ms.date: 11/23/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp -ms.custom: sap:Connection issues ---- - -# Corrupt user file error - -This article helps you resolve the corrupt user file error. - -## Cause - -If you log in as the affected user, you will get a temporary profile. This is a good indication that the profile is corrupt or you are a guest user. If you are a guest user, then you must be added to the appropriate groups. - -## Symptoms - -To be added - -## Resolution - -If you are not a guest user, then use the steps in Fix a corrupted user profile in Windows to either (a) repair the profile or (b) delete and recreate the profile. - - - - - diff --git a/support/sql/database-engine/connect/corrupt-user-profile.md b/support/sql/database-engine/connect/corrupt-user-profile.md new file mode 100644 index 0000000000..a275f97d39 --- /dev/null +++ b/support/sql/database-engine/connect/corrupt-user-profile.md @@ -0,0 +1,21 @@ +--- +title: Troubleshooting the corrupt user profile error +description: This article provides symptoms and resolution for the corrupt user profile error. +ms.date: 11/27/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Corrupt user file error + +This article helps you to resolve the corrupt user profile error. + +## Symptoms + +If you log in as the affected user, you will get a temporary profile. This is a good indication that the profile is corrupt or you are a guest user. If you are a guest user, then you must be added to the appropriate groups. + +## Resolution + +If you are not a guest user, follow the steps explained in [Fix a corrupted user profile in Windows](https://support.microsoft.com/en-us/windows/fix-a-corrupted-user-profile-in-windows-1cf41c18-7ce3-12f9-8e1d-95896661c5c9) to either (a) repair the profile or (b) delete and recreate the profile. diff --git a/support/sql/database-engine/connect/explicit-misplaced-spn-error.md b/support/sql/database-engine/connect/explicit-misplaced-spn-error.md deleted file mode 100644 index 8d07060df2..0000000000 --- a/support/sql/database-engine/connect/explicit-misplaced-spn-error.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -title: Troubleshooting the explicit misplaced SPN issue -description: This article provides cause, symptoms, and workarounds for troubleshooting the explicit SPN is missing issue. -ms.date: 11/23/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp -ms.custom: sap:Connection issues ---- - -# Explicit misplaced SPN - -## Symptoms - -If the SPN you specify in the connection string exists on a service account that's not used by SQL Server, you will get an "SSPI Context" error message. - -## Solution - -To resolve this errors, follow these steps: - -1. Use `SETSPN -L domain\svcacct` to list SPNs on the SQL Server service account. - -1. Use `SETSPN -Q spnName` to find what account the SPN is on. You can move the SPN using `SETSPN -D` and `SETSPN -A` or choose an SPN already in the correct account. \ No newline at end of file diff --git a/support/sql/database-engine/connect/explicit-spn-is-missing-error.md b/support/sql/database-engine/connect/explicit-spn-is-missing-error.md deleted file mode 100644 index a14df449a5..0000000000 --- a/support/sql/database-engine/connect/explicit-spn-is-missing-error.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -title: Troubleshooting explicit SPN is missing issue -description: This article provides cause, symptoms, and workarounds for troubleshooting the explicit SPN is missing issue. -ms.date: 11/23/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp -ms.custom: sap:Connection issues ---- - -# Explicit SPN is missing error - -## Symptoms - -If you specify a non-existent SPN explicitly in the ServerSPN property of the connection string, then the connection will be made using NTLM authentication. - -## Solution - -1. Use `SETSPN -L domain\serviceacct` to list all SPNs for the SQL Server service account. - -1. Add the missing SPN or change the connection string to use an existing one. - -For further information, see [Register a Service Principal Name for Kerberos connections](/sql/database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections?view=sql-server-ver16). - -It is best to test the connection from a remote machine because even with proper Kerberos configuration, local connections will always use NTLM. \ No newline at end of file diff --git a/support/sql/database-engine/connect/linked-server-account-mapping-error.md b/support/sql/database-engine/connect/linked-server-account-mapping-error.md index 5b6ebad7a8..dc6b67207b 100644 --- a/support/sql/database-engine/connect/linked-server-account-mapping-error.md +++ b/support/sql/database-engine/connect/linked-server-account-mapping-error.md @@ -1,27 +1,27 @@ --- -title: Troubleshooting linked server account mapping issue -description: This article provides cause, symptoms, and workarounds for troubleshooting the linked server account mapping issue. -ms.date: 11/23/2023 +title: Troubleshooting linked server account mapping error +description: This article provides symptoms and resolution for the linked server account mapping error. +ms.date: 11/27/2023 author: prmadhes-msft ms.author: prmadhes ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp ms.custom: sap:Connection issues --- -# Linked Server Account Mapping error +# Linked server account mapping error -This article provides the cause, symptoms, and resolution of the linked server account mapping error. +This article helps you to resolve the linked server account mapping error. ## Symptoms -When you connect to the mid-tier server from the Management Studio, you might see the following error messages: +When you connect to the mid-tier server from the Management Studio, you might see the following error message: ```output > "Msg 233, Level 20, State 0, Line 0 A transport-level error has occurred when sending the request to the server. (provider: Shared Memory Provider, error: 0 - No process is on the other end of the pipe.)" ``` -When you connect using application developed using .NET, you might see the following error message: +When you connect using application developed using .NET, you might see the following error messages: > "The OLE DB provider "MSDASQL" for linked server "SQLPROD02" reported an error. Authentication failed." @@ -31,11 +31,11 @@ If you also see the following error message, it indicates you are using Named Pi > "OLE DB provider "MSDASQL" for linked server "SQLPROD02" returned message "[Microsoft][SQL Server Native Client 11.0][SQL Server]Login failed for user 'CONTOSO\SQLPROD01$'." -## Solution +## Resolution -In the **Linked Server security** dialog, when you select the **Be made without using a security context** option, the "Login Failed" for user "NT AUTHORITY\ANONYMOUS LOGON" error is displayed. When you select **Be made with this security context**, the SQL login is successful. +In the **Linked Server security** dialog, when you select the **Be made without using a security context** option, the "Login Failed for user NT AUTHORITY\ANONYMOUS LOGON" error is displayed. When you select **Be made with this security context**, the SQL login is successful. You can correct this error by forcing TCP/IP or granting the appropriate permissions. In addition to the settings in the **Linked Server security** dialog, you can modify the individual account mappings in the upper portion of the dialog, which overrides the main mapping settings. > [!NOTE] -> Using a SQL Server ODBC driver in a linked server isn't a supported scenario. Other ODBC drivers might have limited support from Microsoft and mainly from the vendor. \ No newline at end of file +> Using a SQL Server ODBC driver in a linked server isn't a supported scenario. Other ODBC drivers might have limited support from Microsoft and mainly from the vendor. diff --git a/support/sql/database-engine/connect/local-security-subsystem-issues.md b/support/sql/database-engine/connect/local-security-subsystem-issues.md index 79e342a9e0..3390fb96f4 100644 --- a/support/sql/database-engine/connect/local-security-subsystem-issues.md +++ b/support/sql/database-engine/connect/local-security-subsystem-issues.md @@ -1,6 +1,6 @@ --- -title: Troubleshooting local security subsystem issues -description: This article provides cause, symptoms, and workarounds for troubleshooting the local security subsystem issues. +title: Troubleshooting local security subsystem errors +description: This article provides symptoms and resolution for the local security subsystem issues. ms.date: 11/25/2023 author: prmadhes-msft ms.author: prmadhes @@ -12,10 +12,6 @@ ms.custom: sap:Connection issues This article helps to resolve the problem related to local security subsystem issues. -## Cause - -To be added - ## Symptoms The driver shows the "The login is from an untrusted domain and cannot be used with Windows authentication" error message. diff --git a/support/sql/database-engine/connect/named-pipes-connection-fail-no-windows-permission.md b/support/sql/database-engine/connect/named-pipes-connection-fail-no-windows-permission.md new file mode 100644 index 0000000000..ae59f84c63 --- /dev/null +++ b/support/sql/database-engine/connect/named-pipes-connection-fail-no-windows-permission.md @@ -0,0 +1,28 @@ +--- +title: Troubleshooting the named pipes error +description: This article provides symptoms and resolution for troubleshooting the named pipes connections fail error. +ms.date: 11/27/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Named Pipes connections fail error + +This article helps you to resolve problems related to the Named Pipes connections fail error. + +## Symptoms + +The SQLOLEDB provider shows the "[SQL Server does not exist or access denied error](../startup-shutdown/event-id-7000-access-denied.md)". + +Some other providers display both messages in a random order, whether you use integrated security or a SQL login: + +- "A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections." +- "Could not open a connection to SQL Server." + +Some other providers might also show "Login timeout expired" as part of the message. + +## Resolution + +Add the user to the Users group on the SQL Server machine. If SQL is mirrored or clustered, do the same on all the machines. diff --git a/support/sql/database-engine/connect/network-login-disallowed.md b/support/sql/database-engine/connect/network-login-disallowed.md index 5b8c920957..c646512fbb 100644 --- a/support/sql/database-engine/connect/network-login-disallowed.md +++ b/support/sql/database-engine/connect/network-login-disallowed.md @@ -1,6 +1,6 @@ --- title: Troubleshooting the network login disallowed error -description: This article provides cause, symptoms, and workarounds for troubleshooting the network login disallowed error. +description: This article provides symptoms and resolution for troubleshooting the network login disallowed error. ms.date: 11/24/2023 author: prmadhes-msft ms.author: prmadhes @@ -10,7 +10,7 @@ ms.custom: sap:Connection issues # Network login disallowed error -This article provides the cause, symptoms, and resolution of the Network login disallowed error. +This article helps you to resolve the issue related to network login disallowed error. ## Symptoms @@ -18,6 +18,6 @@ The following error message might be shown in an event on the SQL Server where t > "The user account is not allowed the Network Login type." -## Solution +## Resolution -Check in the *secpol.msc* file to see that the user account (or a group they might belong to) doesn't exist in the **Local Policies > User Rights Assignment > Deny access to this computer from the network** security policy settings. +Check the *secpol.msc* file to see that the user account (or a group they might belong to) doesn't exist in the **Local Policies > User Rights Assignment > Deny access to this computer from the network** security policy settings. diff --git a/support/sql/database-engine/connect/only-admins-can-login.md b/support/sql/database-engine/connect/only-admins-can-login.md index 4655591a54..89c1af301c 100644 --- a/support/sql/database-engine/connect/only-admins-can-login.md +++ b/support/sql/database-engine/connect/only-admins-can-login.md @@ -1,6 +1,6 @@ --- title: Troubleshooting only admins can login error -description: This article provides cause, symptoms, and workarounds for troubleshooting the only admins can login error. +description: This article provides symptoms and resolution for troubleshooting the only admins can login error. ms.date: 11/23/2023 author: prmadhes-msft ms.author: prmadhes @@ -12,7 +12,7 @@ ms.custom: sap:Connection issues This article helps you resolve the "Only admins can login" error. -## Cause +## Symptoms The **CrashOnAuditFail** feature is a security feature used by system administrators to check all security events. The valid values for "CrashOnAuditFail" are 0, 1, and 2. If the key is set to 2, it means that the security event log is full. diff --git a/support/sql/database-engine/connect/proxy-account-error.md b/support/sql/database-engine/connect/proxy-account-error.md index 21907e5166..5e1a62b580 100644 --- a/support/sql/database-engine/connect/proxy-account-error.md +++ b/support/sql/database-engine/connect/proxy-account-error.md @@ -1,6 +1,6 @@ --- title: Troubleshooting the proxy account error -description: This article provides cause, symptoms, and workarounds for troubleshooting the proxy account error. +description: This article provides symptoms and resolution for the proxy account error. ms.date: 11/23/2023 author: prmadhes-msft ms.author: prmadhes @@ -10,12 +10,12 @@ ms.custom: sap:Connection issues # Proxy account error -This article provides the cause, symptoms, and resolution of the proxy account error. +This article helps you resolve the proxy account error. ## Symptoms An SSIS job run by SQL Agent might need permissions other than the SQL Agent service account can provide. -## Solution +## Resolution -Check whether a Proxy account needs to be created or used and if a proxy account is being used, it is the correct account. \ No newline at end of file +Check whether a Proxy account needs to be created or used and if a proxy account is being used, it is the correct account. diff --git a/support/sql/database-engine/connect/service-account-not-trusted-for-delegation.md b/support/sql/database-engine/connect/service-account-not-trusted-for-delegation.md index 6197ca9968..b93953778f 100644 --- a/support/sql/database-engine/connect/service-account-not-trusted-for-delegation.md +++ b/support/sql/database-engine/connect/service-account-not-trusted-for-delegation.md @@ -1,6 +1,6 @@ --- title: Troubleshooting the service account not trusted for delegation error -description: This article provides cause, symptoms, and solution for troubleshooting the service account not trusted for delegation error. +description: This article provides symptoms and resolution for the service account not trusted for delegation error. ms.date: 11/23/2023 author: prmadhes-msft ms.author: prmadhes @@ -10,10 +10,12 @@ ms.custom: sap:Connection issues # Service account not trusted for delegation error +This article helps you to resolve the service account not trusted for delegation error. + ## Symptoms (To be added) -## Solution +## Resolution If a delegation scenario isn't enabled, check the SQL Server *secpol.msc* if the SQL Server service account is listed under **Local Policies > User Rights Assignment > Impersonate a client after authentication** security policy settings. diff --git a/support/sql/database-engine/connect/wrong-database-name-in-connection-string.md b/support/sql/database-engine/connect/wrong-database-name-in-connection-string.md new file mode 100644 index 0000000000..c4cd829ef3 --- /dev/null +++ b/support/sql/database-engine/connect/wrong-database-name-in-connection-string.md @@ -0,0 +1,28 @@ +--- +title: Troubleshooting wrong database name in connection string +description: This article provides symptoms and resolution for troubleshooting the wrong database name in connection string error. +ms.date: 11/23/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Wrong database name in connection string + +This article helps you resolve the issue related to the wrong database name in the connection string. + +## Symptoms + +The driver might generate the following error message: + +"Cannot open database "northwind" requested by the login. The login failed." + +Some drivers might also show the "Login failed for user CONTOSO\user1" error message. + +The SQL Server Errorlog will have the following message: +"Login failed for user 'CONTOSO\User1'. Reason: Failed to open the explicitly specified database 'northwind'." + +## Resolution + +Make sure if the database name is the same in the error message and the ERRORLOG entry. Change the connection string, if incorrect, or grant the user the required permissions. diff --git a/support/sql/database-engine/connect/wrong-explicit-spn-account-connection-string.md b/support/sql/database-engine/connect/wrong-explicit-spn-account-connection-string.md index 4ac617ca66..0dd99b66ce 100644 --- a/support/sql/database-engine/connect/wrong-explicit-spn-account-connection-string.md +++ b/support/sql/database-engine/connect/wrong-explicit-spn-account-connection-string.md @@ -1,6 +1,6 @@ --- title: Troubleshooting wrong explicit SPN account error -description: This article provides cause, symptoms, and workarounds for troubleshooting the linked server account mapping issue. +description: This article provides symptoms and resolution for troubleshooting the linked server account mapping issue. ms.date: 11/23/2023 author: prmadhes-msft ms.author: prmadhes @@ -8,9 +8,9 @@ ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp ms.custom: sap:Connection issues --- -# Wrong Explicit SPN Account error +# Wrong explicit SPN account error -This article provides the cause, symptoms, and resolution of the wrong explicit SPN account error. +This article helps you to resolve an issue related to the wrong explicit SPN account error. ## Symptoms @@ -18,10 +18,10 @@ If the application specifies the SQL Server service account in the `ServerSPN` p `Provider=SQLNCLI11;Data Source=SQLProd01;initial catalog=northwind;integrated security=sspi;server spn=contoso` -If the account name is correct, then the connection will use Kerberos. If the account name isn't found, the connection will use NTLM, and if the account exists but isn't the SQL Server service account, an SSPI Context error is generated. +If the account name is correct, then the connection will use Kerberos. If the account name isn't found, the connection will use NTLM, and if the account exists but isn't the SQL Server service account, an "SSPI Context" error is generated. -## Solution +## Resolution You can use one of the methods explained in [Determine If I Am Connected to SQL Server using Kerberos Authentication](https://github.com/microsoft/CSS_SQL_Networking_Tools/wiki/Determine-If-I-Am-Connected-to-SQL-Server-using-Kerberos-Authentication) to test independent of the application. -Test the connection from a remote computer. Local connections on Windows 2008 R2 and later, use NTLM to support the per-service SID security feature to prevent one service from spoofing another. \ No newline at end of file +Test the connection from a remote computer. Local connections on Windows 2008 R2 and later, use NTLM to support the per-service SID security feature to prevent one service from spoofing another. From 5ceb267b0dafb8b5cbb8133bf5757d802d7233ac Mon Sep 17 00:00:00 2001 From: Jerry Sitser <36421998+przlplx@users.noreply.github.com> Date: Mon, 27 Nov 2023 15:38:41 -0800 Subject: [PATCH 019/370] Update collect-data-to-troubleshoot-sql-connectivity-issues.md Edit review per CI 184107 --- ...to-troubleshoot-sql-connectivity-issues.md | 144 +++++++++--------- 1 file changed, 72 insertions(+), 72 deletions(-) diff --git a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md index 5aef42e042..8754e874f7 100644 --- a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md +++ b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md @@ -1,6 +1,6 @@ --- -title: Data collection to troubleshoot SQL connectivity problems -description: This article provides questions based on several components using which you can effectively troubleshoot connectivity problems. +title: Data collection to troubleshoot SQL connectivity issues +description: This article provides questions based on several components using which you can effectively troubleshoot connectivity issues. ms.date: 11/23/2023 author: prmadhes-msft ms.author: prmadhes @@ -10,25 +10,25 @@ ms.custom: sap:Connection issues # Collect data to troubleshoot SQL connectivity issues -This section is a comprehensive list of questions classified based on certain categories. While [Prerequisites and checklist for resolving connectivity errors](resolve-connectivity-errors-checklist.md) has the most important items to be collected, the questions in this article can help you rule out many scenarios and narrow down your focus for troubleshooting problems in an effective manner. +This section provides a comprehensive list of questions that are classified by specific categories. Although the ["Recommended prerequisites and checklist for troubleshooting SQL Server connectivity issues"](resolve-connectivity-errors-checklist.md) topic includes the most important items to be collected, the questions in this article can help you troubleshoot effectively by ruling out many scenarios and narrowing your focus. > [!NOTE] -> Not all questions might be applicable to all problems but serve as a list of things to consider while troubleshooting connectivity problems. +> Not all questions are applicable to all issues. However, these questions can guide you as you consider how to troubleshoot connectivity issues. -- [Client machine](#client-machine) -- [Server machine](#server-machine) +- [Client computer](#client-computer) +- [Server computer](#server-computer) - [User information](#user-information) - [Log information](#log-information) - [Big picture questions](#big-picture-questions) -- [New or existing problem](#new-or-existing-problem) +- [New or existing issue](#new-or-existing-issue) ## Method of collecting data -You can use tools such as Problem Steps Recorder (PSR), Network trace, and NETLOGON trace to collect data. This section provides detailed steps you can use to install and configure a combination of all three tools. +To collect data, you can use tools such as Problem Steps Recorder (PSR), Network trace, and NETLOGON trace. This section provides detailed steps to install and configure a combination of all these tools. -Follow these steps simultaneously on both the client and server machines. If the application is a 3-tier or n-tier architecture, run on intermediate servers, as well. +Follow these steps simultaneously on both the client and server computers. If the application is a 3-tier or n-tier architecture, run the installation on intermediate servers, also. -1. Install **NETMON** or **WIRESHARK** on all affected machines or use the built-in `NETSH` command (Windows 2008 or newer). No reboot is required. +1. Install **NETMON** or **WIRESHARK** on all affected computers or use the built-in `NETSH` command (Windows 2008 or later versions). No restart is required. 1. Enable NETLOGON debug logging on the client and all servers by running the following command: @@ -36,70 +36,70 @@ Follow these steps simultaneously on both the client and server machines. If the 1. If possible, do one of the following: - - Reboot the client machine. + - Restart the client computer. - Ask the user to log off and log in again. - - Close the client application and re-open it. + - Close and reopen the client application. -1. On the client machine, start the **Problem Steps Recorder** (psr.exe) and select **Start Record**. +1. On the client computer, start **Problem Steps Recorder** (psr.exe), and then select **Start Record**. - This will accurately capture all user actions that lead up to the problem and save the results to a ZIP file. + This will accurately capture all user actions that preceded the issue, and save the results to a .zip file. -1. Start the network capture on all machines. +1. Start the network capture on all computers. 1. If you are using NETSH, run the `NETSH TRACE START CAPTURE=YES TRACEFILE=C:\TEMP%computername%.ETL` command (use an appropriate file or path name). -1. Flush the DNS cache on all machines by running the `IPCONFIG /FLUSHDNS` command. +1. Flush the DNS cache on all computers by running the `IPCONFIG /FLUSHDNS` command. -1. Clear the NETBIOS cache on all machines by running the `NBTSTAT /RR` command. +1. Clear the NETBIOS cache on all computers by running the `NBTSTAT /RR` command. 1. Purge client Kerberos tickets by running the `KLIST purge` command. 1. Clear tickets on each server by running the `KLIST -li 0x3e7 purge` command. > [!NOTE] - > Type the command and don't use copy or paste into the command line. The dash might get converted to a hyphen and break the command. `KLIST` is case-sensitive. + > Type the command. Don't copy and paste into the command line because the dash might get converted to a hyphen and break the command. `KLIST` is case-sensitive. 1. Reproduce the issue. 1. Stop the *psr.exe* recording. -1. Stop the network captures and save the recorded file by running the command `NETSH: NETSH TRACE STOP` with a meaningful name. For example, *SQLProd01.netmon.cap*. +1. Stop the network captures. Save the recorded file by running the command `NETSH: NETSH TRACE STOP` by using a meaningful name. For example, *SQLProd01.netmon.cap*. -1. Wait for the command prompt to reappear. Don't close the command window until this happens. +1. Wait for the command prompt to reappear, and then close the window. Don't close the Command Prompt window before the prompt appears. -1. Copy the NETLOGON log to *C:\windows\debug\netlogon.log* and give a meaningful name. For example, *SQLProd01.netlogon.log*. +1. Copy the NETLOGON log to *C:\windows\debug\netlogon.log* and give the file a meaningful name. For example, *SQLProd01.netlogon.log*. 1. Disable logging by running the `NLTEST /DBFLAG:0x0` command. -## Client machine +## Client computer -You can collect the following information for the Client machine component. +You can collect the following information about the components of the client computer. -- What is the operating system name, edition, and version (WinVer) used? -- What is the name and version of the SQL Server Driver or Provider? -- What is the machine name and IP address? -- Is the machine domain joined? If yes, what is the domain name? -- What is the application run-time environment used? For example, IIS, Windows Forms, Web Sphere, SSIS Job, and so on. -- Which is the Application language used? +- What is the operating system name, edition, and version (WinVer)? +- What is the name and version of the SQL Server driver or provider? +- What are the computer name and IP address? +- Is the computer domain-joined? If yes, what is the domain name? +- What application run-time environment is used? For example, IIS, Windows Forms, Web Sphere, or SSIS Job. +- Which application language is used? - What is the connection string used? - What type of authentication is used to connect to the server? For example, NTLM, Kerberos, SQL, or AAD. -- If the application is a server or service, does it delegate user credentials to the backend database? -- Is constrained delegation being used? -- Which is the application service account and domain? -- Which type of service is used? Is it physical, virtual or cloud? For example, IaaS vs Web App vs Web Role vs Power BI. +- If the application is a server or service, does it delegate user credentials to the back-end database? +- Is constrained delegation used? +- What are the application service account and domain? +- Which type of service is used? Is it physical, virtual, or cloud? For example, IaaS, Web App, Web Role, or Power BI. - Is the client driver JDBC or does it run on Linux or Mac? > [!NOTE] -> The workflows are more Windows-oriented at the moment. +> The workflows are currently more Windows-oriented. -- Does the issue only affect legacy providers, such as Provider=SQLOLEBD or Driver={SQL Server} and not SQL Native client and newer drivers or vice versa? -- Does the issue only happen in one or several applications? -- Does a UDL file fail to connect to other SQL Servers or does it only fail to the SQL Server that has the problem? -- Can you log in to the SQL Server and connect using Management Studio? -- Does the issue only happen when you use the NETBIOS name of the server and not when you use the FQDN or vice versa? Does it work using the IP address? -- If the client is Windows 10 Enterprise Edition, is the Credential Guard feature turned ON? If yes, this might affect with the full delegation scenarios. +- Does the issue affect only legacy providers, such as Provider=SQLOLEBD or Driver={SQL Server}, and not SQL Native client and later drivers (or vice versa)? +- Does the issue occur in only one application or in multiple applications? +- Does a UDL file fail when it tries to connect to other SQL Server-based servers, or does it fail to only the server that has the issue? +- Can you log in to the SQL Server-based server and connect using Management Studio? +- Does the issue occur only when you use the NETBIOS name of the server and not when you use the FQDN (or vice versa)? Does it work by using the IP address? +- If the client is running Windows 10 Enterprise Edition, is the Credential Guard feature turned on? If yes, this might affect full delegation scenarios. -## Server machine +## Server computer For a Linked Server, collect server information for both the mid-tier server and the back-end server. For an IIS-to-SQL delegation issue, collect information on the web server, including the *web.config* and authentication settings. @@ -107,28 +107,28 @@ For a Linked Server, collect server information for both the mid-tier server and - What is the name and version of the database? - What is the name of the computer? - What is the IP address? -- Is the machine domain joined? If yes, what is the domain name? +- Is the computer domain-joined? If yes, what is the domain name? - What is the SQL Server service account and domain? - What is the name of the SQL Server instance? - Which protocols are enabled? - Which is the port that the server listens on? - What is the name of the server pipe? You can find this information in the (ERRORLOG). - Which type of environment is used? Is it physical, virtual, or cloud? For example, IaaS (SQL in an Azure VM) or PaaS (Azure SQL Database, SQL MI). -- Is the database stand-alone, clustered, mirrored, or Always On? +- Is the database standalone, clustered, mirrored, or Always On? - What is the Failover partner name and IP address? - What is the Virtual cluster name or Listener name and port? - Which is the Virtual IP or Listener IP? - Which operating system is the database installed on? Is it Windows, Linux, or Mac? This might affect data collection. - Is the database located in Azure? -- Is the server on the latest Service Pack and Cumulative Update? There’s no point in debugging an issue that's already fixed. -- Has SQL Server been upgraded recently to support TLS 1.2? Were the clients also patched? Has TLS 1.0 been turned off? +- Is the server on the latest Service Pack and Cumulative Update? There’s no point in debugging an issue that is already fixed. +- Has SQL Server been upgraded recently to support TLS 1.2? Were the clients also updated? Has TLS 1.0 been turned off? - Is the SQL Server service currently running? - Is the SQL Browser service running? -- Is the problem specific to a service account? If you run the server using a different service account, does the problem get resolved? +- Is the issue specific to a service account? If you run the server using a different service account, does the issue get resolved? ## User information -- Does the user log into the client machine directly or access it remotely? For example, does the user use a browser? +- Does the user log in to the client computer directly or access it remotely? For example, does the user use a browser? - Is the user a service, such as SQL Agent? Is the process identity being used or a stored credential? - What is the type of authentication used to connect to the client application? Is it Windows, Forms authentication, or Azure Active Directory? - Does the user connect to the server using integrated security? @@ -136,47 +136,47 @@ For a Linked Server, collect server information for both the mid-tier server and If the user is remote to the client application, collect the following details: -- What is the name of the computer and IP address? -- Is the machine domain joined? If yes, what is the domain name? -- Is the user connecting over a VPN or a proxy server? Does the issue happen if either of them is directly connected? -- If the user is connecting to a web server, is it load balanced? +- What are the computer name and IP address? +- Is the computer domain-joined? If yes, what is the domain name? +- Is the user connecting over a VPN or a proxy server? Does the issue occur if either method is directly connected? +- If the user is connecting to a web server, is the server load balanced? - Are sticky sessions or session affinity being used? -- Is the user logging into a terminal server or jump box and accessing the application? -- Does the issue only affect users in particular organizational units (OUs)? +- Is the user logging in to a terminal server or jump box and accessing the application? +- Does the issue affect only users in particular organizational units (OUs)? - Has the user, client, or server moved to a different OU in Active Directory? -- Does the issue only affect non-admin users? -- Does the issue only affect some or all of the users in a particular domain? +- Does the issue affect only non-administrative users? +- Does the issue affect all or only some of the users in a particular domain? ## Log information - What is the exact error message in the call stack? -- Has the log been collected from the SQL Server ERRORLOG and ERRORLOG.1? -- Have the application event logs been collected from the client and server? -- Have the client application's log files and configuration files collected? For example, web.config, rsreportserver.config, *.config, or *.ini. -- Is a visual representation of the network available, which shows the computers, routers, and so on? +- Was the log collected from the SQL Server ERRORLOG and ERRORLOG.1 files? +- Were the application event logs collected from the client and server? +- Were the client application log files and configuration files collected? For example, web.config, rsreportserver.config, *.config, or *.ini. +- Is there an available visual representation of the network that shows the computers, routers, and so on? ## Big picture questions -Following are some questions, which help you understand the category of issue so that you can proceed in the right direction in troubleshooting the problems: +The following questions can help you understand the category of issue so that you can troubleshoot in the right direction: -- Does the issue only affect database connections, or does it affect web and file share connections as well? Many cases are reported to the SQL team because they are seen on the database server. However, it might be possible that the problem isn't related to the database at all and might call for more general Windows or Active Directory support. +- Does the issue affect only database connections, or does it also affect web and file share connections? Many cases are reported to the SQL Server team because they occur on the database server. However, it might be possible that the issue isn't related to the database at all and might require more general Windows or Active Directory support. - If the user domain, client domain, or server domain are different, what is the trust relationship between them? Is it external, forest, one-way, two-way, or none? - Does the connection work correctly if all the resources are in the same domain? - Is the issue intermittent (or periodic) or is it consistent? -- Does the issue only occur if more than one user is using the application? Does it occur more often if more users are using it? -- Does the issue only happen at certain times of the day or days of the week? -- Does the issue only happen when a backup is being taken or the database is being re-indexed? +- Does the issue occur only if more than one user is using the application? Does it occur more often if more users are using it? +- Does the issue occur only at certain times of the day or on certain days of the week? +- Does the issue occur only when a backup is being taken or the database is being re-indexed? - Does the issue affect more than one server? -- Does the issue only affect one node in a n-node cluster? If yes, perhaps rebuilding is more efficient. -- Does the issue affect only one or two clients out of several? If yes, perhaps rebuilding is more efficient. -- Does the issue only affect Named Pipes and not TCP or vice versa? -- Does the issue happen when you use a SQL login and TCP/IP? -- Is there a working case that can be compared against the failing case? How are the two systems different? +- Does the issue affect only one node in a n-node cluster? If yes, perhaps rebuilding would be more efficient. +- Does the issue affect only one or two clients out of several? If yes, perhaps rebuilding would be more efficient. +- Does the issue affect only Named Pipes and not TCP (or vice versa)? +- Does the issue occur when you use a SQL Server login and TCP/IP? +- Is there a working case that can be compared against the failing case? How do the systems differ? -## New or existing problem +## New or existing issue -- Has the problem always existed (new installation) or did it function properly before recently breaking down? -- If it used to function properly, what changes were made to the environment? For example, installed patches, upgraded domain controllers, changed the firewall settings, decommissioned domain controllers, and moved to a different Organizational Unit (OU) in the domain. +- Has the issue always existed (new installation) or did the application function correctly for some time before it recently broke? +- If the application used to function correctly, what changes were made to the environment? For example, installed updates, upgraded domain controllers, changes in the firewall settings, decommissioned domain controllers, or a move to a different organizational unit (OU) in the domain. ## See also From e0d9575731379832eae8617e04086b895d036ae3 Mon Sep 17 00:00:00 2001 From: Jerry Sitser <36421998+przlplx@users.noreply.github.com> Date: Mon, 27 Nov 2023 16:09:19 -0800 Subject: [PATCH 020/370] Update collect-data-to-troubleshoot-sql-connectivity-issues.md --- .../collect-data-to-troubleshoot-sql-connectivity-issues.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md index 8754e874f7..9b5d8615fe 100644 --- a/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md +++ b/support/sql/database-engine/connect/collect-data-to-troubleshoot-sql-connectivity-issues.md @@ -1,6 +1,6 @@ --- title: Data collection to troubleshoot SQL connectivity issues -description: This article provides questions based on several components using which you can effectively troubleshoot connectivity issues. +description: This article provides questions based on several components that you can use to effectively troubleshoot connectivity issues. ms.date: 11/23/2023 author: prmadhes-msft ms.author: prmadhes @@ -10,7 +10,7 @@ ms.custom: sap:Connection issues # Collect data to troubleshoot SQL connectivity issues -This section provides a comprehensive list of questions that are classified by specific categories. Although the ["Recommended prerequisites and checklist for troubleshooting SQL Server connectivity issues"](resolve-connectivity-errors-checklist.md) topic includes the most important items to be collected, the questions in this article can help you troubleshoot effectively by ruling out many scenarios and narrowing your focus. +This section provides a comprehensive list of questions that are classified by specific categories. Although the ["Recommended prerequisites and checklist for troubleshooting SQL Server connectivity issues"](resolve-connectivity-errors-checklist.md) topic includes the most important items to be collected, the questions in this article can help you troubleshoot more effectively by ruling out many scenarios and narrowing your focus. > [!NOTE] > Not all questions are applicable to all issues. However, these questions can guide you as you consider how to troubleshoot connectivity issues. From 815b24670534ca41e6fa8e5f677088fcc5155fc2 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Tue, 28 Nov 2023 19:20:43 +0530 Subject: [PATCH 021/370] Added more files --- ...ccess-through-group-windows-permissions.md | 6 ----- .../connect/account-disabled-error.md | 21 ++++++++++++++++ .../connect/account-migration-error.md | 21 ++++++++++++++++ ...tent-authentication-connectivity-issues.md | 21 ++++++++++++---- .../connect/cross-domain-groups.md | 21 ++++++++++++++++ ...ectory-services-specific-error-messages.md | 24 +++++++++++++++++++ .../connect/domain-trust-error.md | 21 ++++++++++++++++ .../connect/firewall-blocks-the-dc.md | 21 ++++++++++++++++ .../connect/selective-authentication.md | 21 ++++++++++++++++ 9 files changed, 167 insertions(+), 10 deletions(-) create mode 100644 support/sql/database-engine/connect/account-disabled-error.md create mode 100644 support/sql/database-engine/connect/account-migration-error.md create mode 100644 support/sql/database-engine/connect/cross-domain-groups.md create mode 100644 support/sql/database-engine/connect/directory-services-specific-error-messages.md create mode 100644 support/sql/database-engine/connect/domain-trust-error.md create mode 100644 support/sql/database-engine/connect/firewall-blocks-the-dc.md create mode 100644 support/sql/database-engine/connect/selective-authentication.md diff --git a/support/sql/database-engine/connect/access-through-group-windows-permissions.md b/support/sql/database-engine/connect/access-through-group-windows-permissions.md index 4ce868b4d1..06ca6533e5 100644 --- a/support/sql/database-engine/connect/access-through-group-windows-permissions.md +++ b/support/sql/database-engine/connect/access-through-group-windows-permissions.md @@ -12,8 +12,6 @@ ms.custom: sap:Connection issues This article helps you to resolve the access via group Windows permission error. -## Cause - If the user doesn't belong to a local group used to grant access to the server, the provider should display the "Login failed for user 'contoso/user1'" error message. The DBA can double-check the access by looking at the Security\Logins in SSMS. If it's a contained database, the DBA checks under database name. @@ -26,10 +24,6 @@ When you run the `xp_logininfo 'contoso/user1'` stored procedure, the following - If no rows are returned, then there is no group that provides access to the server. - If one or more rows are returned, then the user belongs to a group that provides the access. -## Symptoms - -To be added - ## Resolution To be added diff --git a/support/sql/database-engine/connect/account-disabled-error.md b/support/sql/database-engine/connect/account-disabled-error.md new file mode 100644 index 0000000000..1b855e0066 --- /dev/null +++ b/support/sql/database-engine/connect/account-disabled-error.md @@ -0,0 +1,21 @@ +--- +title: Troubleshooting the account disabled error +description: This article provides symptoms and resolution for the account disabled error. +ms.date: 11/27/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Account disabled error + +This article helps you resolve an issue related to the account disabled error. + +## Symptoms + +To be added + +## Resolution + +To be added diff --git a/support/sql/database-engine/connect/account-migration-error.md b/support/sql/database-engine/connect/account-migration-error.md new file mode 100644 index 0000000000..444a90fba9 --- /dev/null +++ b/support/sql/database-engine/connect/account-migration-error.md @@ -0,0 +1,21 @@ +--- +title: Troubleshooting the account migration error +description: This article provides symptoms and resolution for the account migration error. +ms.date: 11/23/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Account migration error + +This article helps you to resolve the service account not trusted for delegation error. If old user accounts can't connect to the SQL Server, but newly created accounts can, this could be due to account migration. This is an Active Directory issue. + +## Symptoms + +To be added + +## Resolution + +To be added diff --git a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md index 9717477a89..b3c1dd9d0f 100644 --- a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md +++ b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md @@ -100,8 +100,21 @@ Before you start with troubleshooting, it is important to understand the nature - [Credential Guard is enabled](/windows/security/identity-protection/credential-guard/considerations-known-issues) - Following are the errors specific to NTLM: - (To be added) - -- Issues specific to Active Directory and Domain Controller - To be added - + - [NTLM Peer Login](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16) + - [Loopback Protection](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16) + - [Always-On Listener Loopback Protection](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16) + - [Double Hop](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16) + - [LANMAN Compatibility Level](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16) + +- Issues specific to Active Directory and Domain Controller: + - [Account disabled](account-disabled-error.md) + - [Cross-domain groups](cross-domain-groups.md) + - [Firewall blocks the DC](firewall-blocks-the-dc.md) + - [Domain trust](domain-trust-error.md) + - [Selective authentication](selective-authentication.md) + - [Account migration](account-migration-error.md) + - [Directory Services specific error messages](directory-services-specific-error-messages.md) + +- Issues specific to Kerberos: + - - Miscellaneous issues - To be added. diff --git a/support/sql/database-engine/connect/cross-domain-groups.md b/support/sql/database-engine/connect/cross-domain-groups.md new file mode 100644 index 0000000000..1dd0e2cc8c --- /dev/null +++ b/support/sql/database-engine/connect/cross-domain-groups.md @@ -0,0 +1,21 @@ +--- +title: Troubleshooting the cross domain groups error +description: This article provides symptoms and resolution for the cross domain groups error. +ms.date: 11/27/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Cross-domain groups error + +This article helps you to resolve the cross-domain groups error. + +## Symptoms + +To be added + +## Resolution + +You can access the database using groups rather than individually. Check the SQL logins to enumerate allowed groups and make sure the user belongs to one of them. diff --git a/support/sql/database-engine/connect/directory-services-specific-error-messages.md b/support/sql/database-engine/connect/directory-services-specific-error-messages.md new file mode 100644 index 0000000000..26dccc8a94 --- /dev/null +++ b/support/sql/database-engine/connect/directory-services-specific-error-messages.md @@ -0,0 +1,24 @@ +--- +title: Troubleshooting the Directory Services specific error messages +description: This article provides symptoms and resolution for troubleshooting the Directory Services specific error messages. +ms.date: 11/28/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Directory Services specific error messages + +This article helps you to resolve the problem related to the directory services specific error messages. + +## Symptoms + +If the SQL Server ERRORLOG file contains the following messages, then this is an Active Directory issue. This might happen if the domain controller can't be contacted by Windows on the SQL Server computer, or the local security service (LSASS) is having a problem. + +- `Error -2146893039 (0x80090311): No authority could be contacted for authentication.` +- `Error -2146893052 (0x80090304): The Local Security Authority cannot be contacted.` + +## Resolution + +If you need further assistance, contact the Microsoft Active Directory team. diff --git a/support/sql/database-engine/connect/domain-trust-error.md b/support/sql/database-engine/connect/domain-trust-error.md new file mode 100644 index 0000000000..207774e2e8 --- /dev/null +++ b/support/sql/database-engine/connect/domain-trust-error.md @@ -0,0 +1,21 @@ +--- +title: Troubleshooting the domain trust error +description: This article provides symptoms and resolution for the domain trust error. +ms.date: 11/27/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Domain trust error + +To be added + +## Symptoms + +The trust level between domains might cause failures in account authentication or the visibility of SPNs. + +## Resolution + +Use the `SETSPN` and `RUNAS` commands to test this independent of your application. diff --git a/support/sql/database-engine/connect/firewall-blocks-the-dc.md b/support/sql/database-engine/connect/firewall-blocks-the-dc.md new file mode 100644 index 0000000000..19a67d32ab --- /dev/null +++ b/support/sql/database-engine/connect/firewall-blocks-the-dc.md @@ -0,0 +1,21 @@ +--- +title: Troubleshooting the firewall blocks the DC error +description: This article provides symptoms and resolution for the firewall blocks the DC error. +ms.date: 11/28/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Firewall blocks the DC + +This article helps you to resolve the Firewall blocks the Domain Controller error. + +## Symptoms + +To be added + +## Resolution + +Make sure the Domain Controller (DC) is accessible from the client or the SQL Server by running the `NLTEST /SC_QUERY:CONTOSO` command. diff --git a/support/sql/database-engine/connect/selective-authentication.md b/support/sql/database-engine/connect/selective-authentication.md new file mode 100644 index 0000000000..5dc549c153 --- /dev/null +++ b/support/sql/database-engine/connect/selective-authentication.md @@ -0,0 +1,21 @@ +--- +title: Troubleshooting the selective authentication related error +description: This article provides symptoms and resolution for the selective authentication related error. +ms.date: 11/28/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Selective authentication error + +Selective Authentication is a feature of domain trusts that allows the domain administrator to limit which users have access to resources in the remote domain. Make sure that the user who cannot connect can log in to the remote domain. + +## Symptoms + +To be added + +## Resolution + +To be added From ae5c1ea4733a98302d5f5009107a2738f479f188 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Wed, 29 Nov 2023 14:02:49 +0530 Subject: [PATCH 022/370] Added topics --- ...tent-authentication-connectivity-issues.md | 2 +- .../connect/disjoint-dns-namespace-error.md | 19 +++++++++++++ .../connect/domain-trust-error.md | 2 +- .../connect/expired-tickets-error.md | 27 +++++++++++++++++++ .../connect/firewall-blocks-the-dc.md | 4 +-- .../connect/netbios-name-error.md | 21 +++++++++++++++ 6 files changed, 71 insertions(+), 4 deletions(-) create mode 100644 support/sql/database-engine/connect/disjoint-dns-namespace-error.md create mode 100644 support/sql/database-engine/connect/expired-tickets-error.md create mode 100644 support/sql/database-engine/connect/netbios-name-error.md diff --git a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md index b3c1dd9d0f..de7405bc4f 100644 --- a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md +++ b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md @@ -116,5 +116,5 @@ Before you start with troubleshooting, it is important to understand the nature - [Directory Services specific error messages](directory-services-specific-error-messages.md) - Issues specific to Kerberos: - - + - Missing SPN - - Miscellaneous issues - To be added. diff --git a/support/sql/database-engine/connect/disjoint-dns-namespace-error.md b/support/sql/database-engine/connect/disjoint-dns-namespace-error.md new file mode 100644 index 0000000000..6c96e1c42d --- /dev/null +++ b/support/sql/database-engine/connect/disjoint-dns-namespace-error.md @@ -0,0 +1,19 @@ +--- +title: Troubleshooting the disjoint DNS namespace error +description: This article provides symptoms and resolution for the disjoint DNS namespace error. +ms.date: 11/27/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Disjoint DNS namespace error + +This article helps you to resolve the disjoint DNS namespace error. If the organizational hierarchy in Active Directory and in DNS don't match, the wrong SPN might be generated if you use the NETBIOS name in the connection string. The SPN will not be found and NTLM credentials will be used instead of Kerberos credentials. + +## Symptoms + + +## Resolution + diff --git a/support/sql/database-engine/connect/domain-trust-error.md b/support/sql/database-engine/connect/domain-trust-error.md index 207774e2e8..9dca8ac55a 100644 --- a/support/sql/database-engine/connect/domain-trust-error.md +++ b/support/sql/database-engine/connect/domain-trust-error.md @@ -10,7 +10,7 @@ ms.custom: sap:Connection issues # Domain trust error -To be added +This article helps you resolve the "Domain trust" error. ## Symptoms diff --git a/support/sql/database-engine/connect/expired-tickets-error.md b/support/sql/database-engine/connect/expired-tickets-error.md new file mode 100644 index 0000000000..ae2663b1af --- /dev/null +++ b/support/sql/database-engine/connect/expired-tickets-error.md @@ -0,0 +1,27 @@ +--- +title: Troubleshooting the expired tickets error +description: This article provides symptoms and resolution for the expired tickets error. +ms.date: 11/29/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Expired tickets error + +This article helps you resolve the Expired tickets error. Kerberos tickets usually have a lifetime of about 10 hours and should be automatically renewed. Using stale tokens can cause a connection to fail. For more information, see [Kerberos authentication troubleshooting guidance](../../../windows-server/windows-security/kerberos-authentication-troubleshooting-guidance.md). + +## Symptoms + +To be added + +## Resolution + +To resolve this error, follow these steps: + +1. Use the `KLIST purge` command to clear user tokens, or log off and back on, or restart the machine. + +1. Use the `KLIST` command with the SSPIClient tool to view and manage Kerberos tickets and service principal names (SPNs) as shown in the following command: + + `KLIST GET MSSQLSvc\SQLProd01.contoso.com:1433` diff --git a/support/sql/database-engine/connect/firewall-blocks-the-dc.md b/support/sql/database-engine/connect/firewall-blocks-the-dc.md index 19a67d32ab..bc88030f8e 100644 --- a/support/sql/database-engine/connect/firewall-blocks-the-dc.md +++ b/support/sql/database-engine/connect/firewall-blocks-the-dc.md @@ -10,7 +10,7 @@ ms.custom: sap:Connection issues # Firewall blocks the DC -This article helps you to resolve the Firewall blocks the Domain Controller error. +This article helps you to resolve the Firewall blocks the Domain Controller (DC) error. ## Symptoms @@ -18,4 +18,4 @@ To be added ## Resolution -Make sure the Domain Controller (DC) is accessible from the client or the SQL Server by running the `NLTEST /SC_QUERY:CONTOSO` command. +Make sure the Domain Controller is accessible from the client or the SQL Server by running the `NLTEST /SC_QUERY:CONTOSO` command. diff --git a/support/sql/database-engine/connect/netbios-name-error.md b/support/sql/database-engine/connect/netbios-name-error.md new file mode 100644 index 0000000000..83b0a16ee1 --- /dev/null +++ b/support/sql/database-engine/connect/netbios-name-error.md @@ -0,0 +1,21 @@ +--- +title: Troubleshooting the NETBIOS name error +description: This article provides symptoms and resolution for troubleshooting the NETBIOS name error. +ms.date: 11/27/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# NETBIOS name error + +This article helps you to resolve an error where the NETBIOS name is specified partially. + +## Symptoms + +When you use just the NETBIOS name, example SQLPROD01, rather than the fully qualified domain (FQDN) name, example SQLPROD01.CONTOSO.COM, the wrong DNS suffix might be appended. + +## Resolution + +Check the network settings for the default suffixes and make sure they are correct or use the FQDN to avoid issues. From 4d3186062b013d5d8b522f07fb3fda98d1b4487b Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Thu, 30 Nov 2023 09:19:38 +0530 Subject: [PATCH 023/370] Removed information --- ...tent-authentication-connectivity-issues.md | 55 ++++++++----------- ...ectory-services-specific-error-messages.md | 24 -------- .../connect/disjoint-dns-namespace-error.md | 4 +- 3 files changed, 26 insertions(+), 57 deletions(-) delete mode 100644 support/sql/database-engine/connect/directory-services-specific-error-messages.md diff --git a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md index de7405bc4f..f9deb9c4b5 100644 --- a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md +++ b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md @@ -8,49 +8,26 @@ ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp ms.custom: sap:Connection issues --- -# Consistent authentication problems +# Consistent authentication issues -A consistent authentication issue in SQL Server typically refers to problems related to authentication and authorization of users or applications trying to access the SQL Server database. These issues can lead to authentication failures, access denied errors, or other security-related problems. +> [!NOTE] +> Before you start troubleshooting, check the [prerequisites](../connect/resolve-connectivity-errors-checklist.md) and go through the checklist. > [!NOTE] > The commands provided in this article are for Windows systems only. -## Recommended pre-requisites for consistent authentication problems - -To troubleshoot consistent authentication issues, follow these steps: - -1. See the recommended [prerequisites and checklist for troubleshooting SQL Server connectivity issues](resolve-connectivity-errors-checklist.md). -1. Collect data to troubleshoot SQL consistent authentication issues. - - This will help you to get a macro perspective of the scope of an issue, that is whether the issue affects single or multiple machines or whether only machines in a specific data center are affected. This can help you focus on the troubleshooting steps. It will also prepare you to discuss the problem with Microsoft Support should you choose to do so. - -1. Make sure you understand the application architecture and summarize the issue like the following description: - - - There are two domains involved: contoso and fabrikam. - - - The client `sparky.contoso.com` runs on Windows 2012. - - - The user `contoso\johndoe` runs on EDGE and connects to a web server `(http://web01.contoso.com/accounting)` using integrated security. - - - The IIS app pool runs as `contoso\web_svc`. - - - The web server connects to SQL Server 2014 (SQLProd01.fabrikam.com\Accounting on port 1433) using the SqlClient .NET 4.6.2 Provider and assigns the user credentials to SQL Server using integrated security. - - - The SQL Server service account is `fabrikam\sql_svc_01`. - -1. Collect the SPN information based on the service accounts identified in the description. For example: - - `SETSPN -L CONTOSO\WEB_SVC > c:\temp\spns.txt` - Creates a new file. - `SETSPN -L FABRIKAM\SQL_SVC_01 >> c:\temp\spns.txt` - Appends to a file. +A consistent authentication issue in SQL Server typically refers to problems related to authentication and authorization of users or applications trying to access the SQL Server database. These issues can lead to authentication failures, access denied errors, or other security-related problems. ## Types of errors -Before you start to troubleshoot errors, it's important to understand what each error means and also what is the type of error. It's also important to understand the category of the error because the troubleshooting steps also vary. This section provides various types of consistent authentication errors. +Before you start to troubleshoot errors, it's important to understand what each error means and also what is the type of error. + +It's also important to understand the category of the error because the troubleshooting steps also vary. This section provides various types of consistent authentication errors. - Directory Services specific error messages - Refers to the Active Directory error messages. If the SQL Server ERRORLOG file contains the following messages, then this is an Active Directory issue. This might happen if the domain controller can't be contacted by Windows on the SQL Server computer, or the local security service (LSASS) is having a problem. -> Error -2146893039 (0x80090311): No authority could be contacted for authentication. -> Error -2146893052 (0x80090304): The Local Security Authority cannot be contacted. + > Error -2146893039 (0x80090311): No authority could be contacted for authentication. + > Error -2146893052 (0x80090304): The Local Security Authority cannot be contacted. - [Login failed error codes](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true#additional-error-information) - If you are troubleshooting a "Login Failed" error message, the SQL Server ERRORLOG file can provide more information in the SQL State value with error 18456 (Login Failed). @@ -68,6 +45,20 @@ Before you start to troubleshoot errors, it's important to understand what each Before you start with troubleshooting, it is important to understand the nature of an error and the category that it belongs to. This section provides error messages grouped based on a category. Some errors might appear in more than one category. Each of these error scenarios has the symptoms and the solutions as well. Following are the error categories. +|Error |Cause |Resolution | +|---------|---------|---------| +|Row1 | | | +|Row2 | | | +|Row3 | | | +|Row4 | | | +|Row5 | | | +|Row6 | | | +|Row7 | | | +|Row8 | | | +|Row9 | | | +|Row10 | | | + + - Following are the errors specific to failed login: - [Bad password](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) - [Invalid username](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) diff --git a/support/sql/database-engine/connect/directory-services-specific-error-messages.md b/support/sql/database-engine/connect/directory-services-specific-error-messages.md deleted file mode 100644 index 26dccc8a94..0000000000 --- a/support/sql/database-engine/connect/directory-services-specific-error-messages.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Troubleshooting the Directory Services specific error messages -description: This article provides symptoms and resolution for troubleshooting the Directory Services specific error messages. -ms.date: 11/28/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp -ms.custom: sap:Connection issues ---- - -# Directory Services specific error messages - -This article helps you to resolve the problem related to the directory services specific error messages. - -## Symptoms - -If the SQL Server ERRORLOG file contains the following messages, then this is an Active Directory issue. This might happen if the domain controller can't be contacted by Windows on the SQL Server computer, or the local security service (LSASS) is having a problem. - -- `Error -2146893039 (0x80090311): No authority could be contacted for authentication.` -- `Error -2146893052 (0x80090304): The Local Security Authority cannot be contacted.` - -## Resolution - -If you need further assistance, contact the Microsoft Active Directory team. diff --git a/support/sql/database-engine/connect/disjoint-dns-namespace-error.md b/support/sql/database-engine/connect/disjoint-dns-namespace-error.md index 6c96e1c42d..43ff0b39a3 100644 --- a/support/sql/database-engine/connect/disjoint-dns-namespace-error.md +++ b/support/sql/database-engine/connect/disjoint-dns-namespace-error.md @@ -10,10 +10,12 @@ ms.custom: sap:Connection issues # Disjoint DNS namespace error -This article helps you to resolve the disjoint DNS namespace error. If the organizational hierarchy in Active Directory and in DNS don't match, the wrong SPN might be generated if you use the NETBIOS name in the connection string. The SPN will not be found and NTLM credentials will be used instead of Kerberos credentials. +This article helps you to resolve the disjoint DNS namespace error. If the organizational hierarchy in Active Directory (AD) and in DNS don't match, the wrong SPN might be generated if you use the NETBIOS name in the connection string. The SPN will not be found and NTLM credentials will be used instead of Kerberos credentials. ## Symptoms +To be added ## Resolution + Use the fully-qualified name of the server or explicitly specify the SPN name in the connection string to mitigate problems. From f185da6dda0f867a708c8280651d08a4d7ba4074 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Thu, 30 Nov 2023 10:37:05 +0530 Subject: [PATCH 024/370] Removed some articles As they don't have either Symptoms or Solution removed files Added table and content Combining commits --- .../connect/account-disabled-error.md | 21 ------ .../connect/account-migration-error.md | 21 ------ .../connect/bad-metadata-error.md | 23 ------- ...tent-authentication-connectivity-issues.md | 66 +++++++++++++------ .../connect/cross-domain-groups.md | 21 ------ .../connect/disjoint-dns-namespace-error.md | 4 +- .../connect/expired-tickets-error.md | 4 +- .../connect/firewall-blocks-the-dc.md | 21 ------ .../connect/selective-authentication.md | 21 ------ 9 files changed, 49 insertions(+), 153 deletions(-) delete mode 100644 support/sql/database-engine/connect/account-disabled-error.md delete mode 100644 support/sql/database-engine/connect/account-migration-error.md delete mode 100644 support/sql/database-engine/connect/bad-metadata-error.md delete mode 100644 support/sql/database-engine/connect/cross-domain-groups.md delete mode 100644 support/sql/database-engine/connect/firewall-blocks-the-dc.md delete mode 100644 support/sql/database-engine/connect/selective-authentication.md diff --git a/support/sql/database-engine/connect/account-disabled-error.md b/support/sql/database-engine/connect/account-disabled-error.md deleted file mode 100644 index 1b855e0066..0000000000 --- a/support/sql/database-engine/connect/account-disabled-error.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: Troubleshooting the account disabled error -description: This article provides symptoms and resolution for the account disabled error. -ms.date: 11/27/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp -ms.custom: sap:Connection issues ---- - -# Account disabled error - -This article helps you resolve an issue related to the account disabled error. - -## Symptoms - -To be added - -## Resolution - -To be added diff --git a/support/sql/database-engine/connect/account-migration-error.md b/support/sql/database-engine/connect/account-migration-error.md deleted file mode 100644 index 444a90fba9..0000000000 --- a/support/sql/database-engine/connect/account-migration-error.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: Troubleshooting the account migration error -description: This article provides symptoms and resolution for the account migration error. -ms.date: 11/23/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp -ms.custom: sap:Connection issues ---- - -# Account migration error - -This article helps you to resolve the service account not trusted for delegation error. If old user accounts can't connect to the SQL Server, but newly created accounts can, this could be due to account migration. This is an Active Directory issue. - -## Symptoms - -To be added - -## Resolution - -To be added diff --git a/support/sql/database-engine/connect/bad-metadata-error.md b/support/sql/database-engine/connect/bad-metadata-error.md deleted file mode 100644 index 4299f509b7..0000000000 --- a/support/sql/database-engine/connect/bad-metadata-error.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -title: Troubleshooting the bad metadata error -description: This article provides symptoms and resolution for troubleshooting the bad metadata error. -ms.date: 11/23/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp -ms.custom: sap:Connection issues ---- - -# Bad metadata error - -This article helps you to resolve a problem when there is a bad metadata error. - -A View or stored procedure which is used to query views in the linked server, receives login failures whereas a distributed `SELECT` statement copied from them doesn't. This might happen if the View was created and then the linked server was recreated, or a remote table was modified without rebuilding the View. - -## Symptoms - -To be added - -## Resolution - -To be added diff --git a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md index f9deb9c4b5..6ceffb27e3 100644 --- a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md +++ b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md @@ -8,7 +8,9 @@ ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp ms.custom: sap:Connection issues --- -# Consistent authentication issues +# Troubleshoot consistent authentication issues + +_Applies to:_   SQL Server > [!NOTE] > Before you start troubleshooting, check the [prerequisites](../connect/resolve-connectivity-errors-checklist.md) and go through the checklist. @@ -18,20 +20,25 @@ ms.custom: sap:Connection issues A consistent authentication issue in SQL Server typically refers to problems related to authentication and authorization of users or applications trying to access the SQL Server database. These issues can lead to authentication failures, access denied errors, or other security-related problems. -## Types of errors - Before you start to troubleshoot errors, it's important to understand what each error means and also what is the type of error. It's also important to understand the category of the error because the troubleshooting steps also vary. This section provides various types of consistent authentication errors. -- Directory Services specific error messages - Refers to the Active Directory error messages. If the SQL Server ERRORLOG file contains the following messages, then this is an Active Directory issue. This might happen if the domain controller can't be contacted by Windows on the SQL Server computer, or the local security service (LSASS) is having a problem. +## Directory services specific issues + +Refers to the Active Directory errors. If the SQL Server ErrorLog file contains both or either of the following messages, then this is an Active Directory issue. This might happen if the domain controller (DC) can't be contacted by Windows on the SQL Server computer, or the local security service (LSASS) is having a problem. + + `Error -2146893039 (0x80090311): No authority could be contacted for authentication.` + `Error -2146893052 (0x80090304): The Local Security Authority cannot be contacted.` + +## Login failed error codes + + If you are troubleshooting a "Login Failed" error message, the SQL Server ErrorLog file can provide more information in the SQL State value with error 18456 (Login Failed). For more information, see [Login failed error codes](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true#additional-error-information). - > Error -2146893039 (0x80090311): No authority could be contacted for authentication. - > Error -2146893052 (0x80090304): The Local Security Authority cannot be contacted. +## Login failed specific issues -- [Login failed error codes](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true#additional-error-information) - If you are troubleshooting a "Login Failed" error message, the SQL Server ERRORLOG file can provide more information in the SQL State value with error 18456 (Login Failed). +Refers to some of the common login failures. For detailed information, see [MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true). -- [Login failed error messages](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true) - Refers to some of the common login failures. For more information, see [MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true). - [Login failed for user '(null)'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true#login-failed-for-user-(null)) - [Login failed for user ''](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) - [Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) @@ -41,23 +48,40 @@ It's also important to understand the category of the error because the troubles - [SQL Server does not exist or access denied](network-related-or-instance-specific-error-occurred-while-establishing-connection.md) - This can also be a network error. - [SSPI context messages](/troubleshoot/sql/database-engine/connect/cannot-generate-sspi-context-error?branch=main) -## Categorization of error messages +The scenarios explained in this article are broadly classified based on the causes and the category. Before you start with troubleshooting, it is important to understand the nature of an error and the category that it belongs to. This section provides error messages grouped based on a category. Some errors might appear in more than one category. Each of these error scenarios has the symptoms and the solutions as well. Following are the error categories. -|Error |Cause |Resolution | -|---------|---------|---------| -|Row1 | | | -|Row2 | | | -|Row3 | | | -|Row4 | | | -|Row5 | | | -|Row6 | | | -|Row7 | | | -|Row8 | | | -|Row9 | | | -|Row10 | | | +## Kerberos issues + +The following table contains information about issues related to Kerberos authentication: + +|Possible causes |More information | +|---------|---------| +|Not trusted for delegation and Not a constrained target |These are Active Directory (AD) issues. If you are an Administrator, enable the Trusted for delegation setting. | +|Sensitive account | Some accounts may be marked as Sensitive in AD. These accounts can't be delegated to another service in a double-hop scenario. | +|User belongs to many groups |This can happen when a user is a member of many groups in AD. If you use Kerberos over UDP, the entire security token must fit within a single packet. Users that belong to many groups will have a larger security token than those that belong to fewer groups. If you use Kerberos over TCP, you can increase the `MaxTokenSize` setting. For more information, see +[MaxTokenSize and Kerberos Token Bloat](/archive/blogs/shanecothran/maxtokensize-and-kerberos-token-bloat). | +|Clock skew error | This error can occur when clocks on more than one device on a network are not synchronized. For Kerberos server to work, the clocks between machines can't be off for more than five minutes. | +| NTLM and Constrained Delegation error | If the target is a file share, the delegation type of the mid-tier service account must be **Constrained-Any** and not **Constrained-Kerberos**. See Login failed for user NT AUTHORITY\ANONYMOUS LOGON for more information. | +|Per-Service-SID | Is a security feature of SQL Server that limits local connections to use New Technology LAN Manager (NTLM) and not Kerberos as the authentication method. The service can make a single hop to another server using NTLM credentials, but it can't be delegated further without using the constrained delegation. | +|Legacy Providers and Named Pipes | This error might occur when there is a problem with the connection between the client and server. The legacy OLE DB Provider (SQLOLEDB) and ODBC Driver {SQL Server} that come with Windows don't support Kerberos over Named Pipes, only NTLM. Use a TCP connection to allow Kerberos. | +|Kernel mode authentication |This error can occur when you try to open a web site from a remote machine. Normally, the SPN must be on the App Pool account for web servers, but when you use Kernel Mode Authentication, authentication is performed in the kernel and the computer's HOST SPN is used. This setting may be used if the server hosts a number of different web sites using the same host header URL, different App Pool accounts, and [Windows Authentication](/iis/configuration/system.webserver/security/authentication/). | +|Delegating Credentials to Access or Excel | Refers to a process where a user grants permissions to another user. The Joint Engine Technology (JET) and Access Connectivity Engine (ACE) providers are similar to any of the file systems. You must use constrained delegation to allow SQL Server to read files located on another machine. In general, the ACE provider shouldn't be used in a linked server as this is explicitly not supported. The JET provider is deprecated and is available on 32-bit machines only. | +|SQL alias | A SQL [Server alias](network-related-or-instance-specific-error-occurred-while-establishing-connection.md) may cause an unexpected SPN to be generated. This will result in NTLM credentials if the SPN isn't found, or an SSPI failure, if it inadvertently matches the SPN of another server. | +|Website host header | If the website has a host header name, the HOSTS SPN can't be used. An explicit HTTP SPN must be used. If the website doesn't have a host header name, NTLM is used and it can't be delegated to a backend SQL Server or other service. | +|HOSTS file | The hosts file overrides DNS lookups and might generate an unexpected SPN name. This will cause NTLM credentials to be used. If an unexpected IP address is in the hosts file, the SPN generated might not match the backend pointed to. | + + +## Other issues + +The following table contains scenarios related to Internet access related issues: +|Possible cause |More information | +|---------|---------| +|Integrated authentication is not enabled | This might be related to the integrated authentication issues. To resolve this type of error, in the **Internet Options**, make sure that the **Integrated Windows Authentication** is enabled. | +|Wrong Internet zone | This might happen if you try to access a website that is not in the correct Internet zone in IE. The credentials will not work if the web site is not in the Local Intranet zone. | +|IIS Authentication | Configure the website to allow Windows Authentication and the *web.config* file needs to have the `` set. | - Following are the errors specific to failed login: - [Bad password](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) diff --git a/support/sql/database-engine/connect/cross-domain-groups.md b/support/sql/database-engine/connect/cross-domain-groups.md deleted file mode 100644 index 1dd0e2cc8c..0000000000 --- a/support/sql/database-engine/connect/cross-domain-groups.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: Troubleshooting the cross domain groups error -description: This article provides symptoms and resolution for the cross domain groups error. -ms.date: 11/27/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp -ms.custom: sap:Connection issues ---- - -# Cross-domain groups error - -This article helps you to resolve the cross-domain groups error. - -## Symptoms - -To be added - -## Resolution - -You can access the database using groups rather than individually. Check the SQL logins to enumerate allowed groups and make sure the user belongs to one of them. diff --git a/support/sql/database-engine/connect/disjoint-dns-namespace-error.md b/support/sql/database-engine/connect/disjoint-dns-namespace-error.md index 43ff0b39a3..d89e1c718a 100644 --- a/support/sql/database-engine/connect/disjoint-dns-namespace-error.md +++ b/support/sql/database-engine/connect/disjoint-dns-namespace-error.md @@ -10,11 +10,11 @@ ms.custom: sap:Connection issues # Disjoint DNS namespace error -This article helps you to resolve the disjoint DNS namespace error. If the organizational hierarchy in Active Directory (AD) and in DNS don't match, the wrong SPN might be generated if you use the NETBIOS name in the connection string. The SPN will not be found and NTLM credentials will be used instead of Kerberos credentials. +This article helps you to resolve the disjoint DNS namespace error. ## Symptoms -To be added +If the organizational hierarchy in Active Directory (AD) and in DNS don't match, the wrong SPN might be generated if you use the NETBIOS name in the connection string. The SPN will not be found and NTLM credentials will be used instead of Kerberos credentials. ## Resolution diff --git a/support/sql/database-engine/connect/expired-tickets-error.md b/support/sql/database-engine/connect/expired-tickets-error.md index ae2663b1af..0b27e75a74 100644 --- a/support/sql/database-engine/connect/expired-tickets-error.md +++ b/support/sql/database-engine/connect/expired-tickets-error.md @@ -10,11 +10,11 @@ ms.custom: sap:Connection issues # Expired tickets error -This article helps you resolve the Expired tickets error. Kerberos tickets usually have a lifetime of about 10 hours and should be automatically renewed. Using stale tokens can cause a connection to fail. For more information, see [Kerberos authentication troubleshooting guidance](../../../windows-server/windows-security/kerberos-authentication-troubleshooting-guidance.md). +This article helps you resolve the Expired tickets error. ## Symptoms -To be added +Kerberos tickets usually have a lifetime of about 10 hours and should be automatically renewed. Using stale tokens can cause a connection to fail. For more information, see [Kerberos authentication troubleshooting guidance](../../../windows-server/windows-security/kerberos-authentication-troubleshooting-guidance.md). ## Resolution diff --git a/support/sql/database-engine/connect/firewall-blocks-the-dc.md b/support/sql/database-engine/connect/firewall-blocks-the-dc.md deleted file mode 100644 index bc88030f8e..0000000000 --- a/support/sql/database-engine/connect/firewall-blocks-the-dc.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: Troubleshooting the firewall blocks the DC error -description: This article provides symptoms and resolution for the firewall blocks the DC error. -ms.date: 11/28/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp -ms.custom: sap:Connection issues ---- - -# Firewall blocks the DC - -This article helps you to resolve the Firewall blocks the Domain Controller (DC) error. - -## Symptoms - -To be added - -## Resolution - -Make sure the Domain Controller is accessible from the client or the SQL Server by running the `NLTEST /SC_QUERY:CONTOSO` command. diff --git a/support/sql/database-engine/connect/selective-authentication.md b/support/sql/database-engine/connect/selective-authentication.md deleted file mode 100644 index 5dc549c153..0000000000 --- a/support/sql/database-engine/connect/selective-authentication.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: Troubleshooting the selective authentication related error -description: This article provides symptoms and resolution for the selective authentication related error. -ms.date: 11/28/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp -ms.custom: sap:Connection issues ---- - -# Selective authentication error - -Selective Authentication is a feature of domain trusts that allows the domain administrator to limit which users have access to resources in the remote domain. Make sure that the user who cannot connect can log in to the remote domain. - -## Symptoms - -To be added - -## Resolution - -To be added From 4958f011bae094ffa1792f83dafb2e1ead166cf8 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Fri, 1 Dec 2023 22:51:32 +0530 Subject: [PATCH 025/370] Added atable --- ...bad-server-name-connection-string-error.md | 10 +- ...tent-authentication-connectivity-issues.md | 104 ++++++------------ .../connect/domain-trust-error.md | 4 +- .../local-security-subsystem-issues.md | 4 +- 4 files changed, 43 insertions(+), 79 deletions(-) diff --git a/support/sql/database-engine/connect/bad-server-name-connection-string-error.md b/support/sql/database-engine/connect/bad-server-name-connection-string-error.md index bf9abce649..e800ba321b 100644 --- a/support/sql/database-engine/connect/bad-server-name-connection-string-error.md +++ b/support/sql/database-engine/connect/bad-server-name-connection-string-error.md @@ -10,9 +10,7 @@ ms.custom: sap:Connection issues # Bad server name in connection string error -This article helps you to resolve the problem related to the bad server name error. - -This can be a common issue if you deploy an application that uses a DEV or QA server into production and you fail to update the connection string. +This article helps you to resolve the problem related to the bad server name error. This can be a common issue if you deploy an application that uses a DEV or QA server into production and you fail to update the connection string. ## Symptoms @@ -39,10 +37,10 @@ The SQL Server Errorlog will have one of the following messages: To resolve this issue, follow these steps: -1. Validate that you are connecting to the appropriate server. +1. Validate that you're connecting to the appropriate server. -1. If the server is not the appropriate one, then the connection string. +1. If the server isn't the appropriate one, then the connection string. 1. If the connection string is correct, add the login to the database. -1. If it is a Windows login, add it to a local group or domain group that's allowed to connect to the database server. +1. If it's a Windows login, add it to a local group or domain group that's allowed to connect to the database server. diff --git a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md index 6ceffb27e3..c6bfacc3a3 100644 --- a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md +++ b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md @@ -10,7 +10,7 @@ ms.custom: sap:Connection issues # Troubleshoot consistent authentication issues -_Applies to:_   SQL Server +_Applies to:_   SQL Server > [!NOTE] > Before you start troubleshooting, check the [prerequisites](../connect/resolve-connectivity-errors-checklist.md) and go through the checklist. @@ -26,42 +26,58 @@ It's also important to understand the category of the error because the troubles ## Directory services specific issues -Refers to the Active Directory errors. If the SQL Server ErrorLog file contains both or either of the following messages, then this is an Active Directory issue. This might happen if the domain controller (DC) can't be contacted by Windows on the SQL Server computer, or the local security service (LSASS) is having a problem. +Refers to the Active Directory errors. If the SQL Server ErrorLog file contains both or either of the following messages, then this is an Active Directory (AD) issue. This might happen if the domain controller (DC) can't be contacted by Windows on the SQL Server computer or the local security service (LSASS) is having a problem. `Error -2146893039 (0x80090311): No authority could be contacted for authentication.` `Error -2146893052 (0x80090304): The Local Security Authority cannot be contacted.` ## Login failed error codes - If you are troubleshooting a "Login Failed" error message, the SQL Server ErrorLog file can provide more information in the SQL State value with error 18456 (Login Failed). For more information, see [Login failed error codes](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true#additional-error-information). + If you are troubleshooting a "Login Failed" error message, the SQL Server ErrorLog file can provide more information in the SQL State value with error 18456 (Login Failed). For more information, see [Login failed error codes](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error#additional-error-information). ## Login failed specific issues -Refers to some of the common login failures. For detailed information, see [MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true). +Refers to some of the common login failures. For detailed information, see [MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). - - [Login failed for user '(null)'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16&preserve-view=true#login-failed-for-user-(null)) - - [Login failed for user ''](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) - - [Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) - - [Login failed for user 'username'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) - - [Login failed for user 'DOMAIN\username'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) - - Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. - - [SQL Server does not exist or access denied](network-related-or-instance-specific-error-occurred-while-establishing-connection.md) - This can also be a network error. -- [SSPI context messages](/troubleshoot/sql/database-engine/connect/cannot-generate-sspi-context-error?branch=main) +|Error message |Causes | +|---------|---------| +|[Login failed for user '(null)'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error#login-failed-for-user-(null)) | | +| [Login failed for user ''](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) | | +|[Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) | | +|[Login failed for user 'username'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) | | +|[Login failed for user 'domain\username'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) | | +|Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. | | +|[SQL Server does not exist or access denied](network-related-or-instance-specific-error-occurred-while-establishing-connection.md) - This can also be a network error. | | +|[SSPI context messages](/troubleshoot/sql/database-engine/connect/cannot-generate-sspi-context-error?branch=main) | | -The scenarios explained in this article are broadly classified based on the causes and the category. Before you start with troubleshooting, it is important to understand the nature of an error and the category that it belongs to. This section provides error messages grouped based on a category. Some errors might appear in more than one category. Each of these error scenarios has the symptoms and the solutions as well. Following are the error categories. -## Kerberos issues +The next few sections list some of the scenarios specific to areas such as Kerberos, Active Directory, Domain Controller, connection strings, NTLM, and so on. + +## Active Directory and Domain Controller issues + +The following table provides some solutions to the AD and DC issues: + +|Possible causes |Workarounds | +|---------|---------| +|Account disabled | You might experience this error if the user account has been disabled by an administrator or by a user. In such a case, you can't login with this account or start a service with it. | +|Account not in group | You can access the database using groups rather than individually. Check the SQL logins to enumerate allowed groups and make sure the user belongs to one of them. | +|Cross-Domain groups | Users from the remote domain should belong to a group in the SQL Server domain. If the domains lack proper trust, adding the users in a group in the remote domain might prevent the SQL Server from enumerating the group's membership. | +|Firewall blocks the DC | Make sure the DC is accessible from the client or the SQL Server via `nltest /SC_QUERY:CONTOSO`. | +|DC Offline |This error might occur if there are incorrect Domain Naming Service (DNS) records for DC. NLTEST can be used to force the computer to switch to another DC. See Firewall Blocks the DC. | +|Selective authentication | Refers to a feature of domain trusts that allows the domain administrator to limit which users have access to resources in the remote domain. Make sure the user isn't allowed to authenticate in the remote domain. | +|Account migration | If old user accounts can't connect to the SQL Server, but newly created accounts can, this could be due to account migration. This is an Active Directory issue. | + +## Kerberos authentication issues The following table contains information about issues related to Kerberos authentication: |Possible causes |More information | |---------|---------| -|Not trusted for delegation and Not a constrained target |These are Active Directory (AD) issues. If you are an Administrator, enable the Trusted for delegation setting. | +|Not trusted for delegation and Not a constrained target |These are Active Directory (AD) issues. If you are an Administrator, enable the **Trusted for delegation** setting. | |Sensitive account | Some accounts may be marked as Sensitive in AD. These accounts can't be delegated to another service in a double-hop scenario. | -|User belongs to many groups |This can happen when a user is a member of many groups in AD. If you use Kerberos over UDP, the entire security token must fit within a single packet. Users that belong to many groups will have a larger security token than those that belong to fewer groups. If you use Kerberos over TCP, you can increase the `MaxTokenSize` setting. For more information, see -[MaxTokenSize and Kerberos Token Bloat](/archive/blogs/shanecothran/maxtokensize-and-kerberos-token-bloat). | +|User belongs to many groups | This can happen when a user is a member of many groups in AD. If you use Kerberos over UDP, the entire security token must fit within a single packet. Users that belong to many groups will have a larger security token than those that belong to fewer groups. If you use Kerberos over TCP, you can increase the [`MaxTokenSize`] setting. For more information, see [MaxTokenSize and Kerberos Token Bloat](/archive/blogs/shanecothran/maxtokensize-and-kerberos-token-bloat). | |Clock skew error | This error can occur when clocks on more than one device on a network are not synchronized. For Kerberos server to work, the clocks between machines can't be off for more than five minutes. | | NTLM and Constrained Delegation error | If the target is a file share, the delegation type of the mid-tier service account must be **Constrained-Any** and not **Constrained-Kerberos**. See Login failed for user NT AUTHORITY\ANONYMOUS LOGON for more information. | |Per-Service-SID | Is a security feature of SQL Server that limits local connections to use New Technology LAN Manager (NTLM) and not Kerberos as the authentication method. The service can make a single hop to another server using NTLM credentials, but it can't be delegated further without using the constrained delegation. | @@ -71,7 +87,8 @@ The following table contains information about issues related to Kerberos authen |SQL alias | A SQL [Server alias](network-related-or-instance-specific-error-occurred-while-establishing-connection.md) may cause an unexpected SPN to be generated. This will result in NTLM credentials if the SPN isn't found, or an SSPI failure, if it inadvertently matches the SPN of another server. | |Website host header | If the website has a host header name, the HOSTS SPN can't be used. An explicit HTTP SPN must be used. If the website doesn't have a host header name, NTLM is used and it can't be delegated to a backend SQL Server or other service. | |HOSTS file | The hosts file overrides DNS lookups and might generate an unexpected SPN name. This will cause NTLM credentials to be used. If an unexpected IP address is in the hosts file, the SPN generated might not match the backend pointed to. | - +|Delegating to a file share | Make sure to use constrained delegation in this scenario. | +|HTTP Ports | Normally, HTTP SPNs don't use port numbers, example `http/web01.contoso.com`, but you can enable this through the policy on the clients. The SPN would then have to be in the `http/web01.contoso.com:88` format, to enable Kerberos to function correctly. Otherwise, NTLM credentials are used, which aren't recommended because it would be difficult to diagnose the issue and it might be an excessive administrative overhead. | ## Other issues @@ -82,54 +99,3 @@ The following table contains scenarios related to Internet access related issues |Integrated authentication is not enabled | This might be related to the integrated authentication issues. To resolve this type of error, in the **Internet Options**, make sure that the **Integrated Windows Authentication** is enabled. | |Wrong Internet zone | This might happen if you try to access a website that is not in the correct Internet zone in IE. The credentials will not work if the web site is not in the Local Intranet zone. | |IIS Authentication | Configure the website to allow Windows Authentication and the *web.config* file needs to have the `` set. | - -- Following are the errors specific to failed login: - - [Bad password](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) - - [Invalid username](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) - - [SQL logins are not enabled](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) - - [Named Pipes connections fail because the user doesn't have permission to log into Windows](named-pipes-connection-fail-no-windows-permission.md). - -- Following are the errors specific to the different aspects of SQL Server: - - [Database offline](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) - - [Database permissions](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) - - [No Login](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) - - [Linked Server Account Mapping](linked-server-account-mapping-error.md) - - [Proxy Account](proxy-account-error.md) - - [Bad metadata](bad-metadata-error.md) - -- Following are the errors specific to Connection String: - - [Bad server name in Connection String](bad-server-name-connection-string-error.md) - - [Wrong database name in Connection String](wrong-database-name-in-connection-string.md) - - [Wrong explicit SPN account](wrong-explicit-spn-account-connection-string.md) - - [Explicit SPN is missing](cannot-generate-sspi-context-error.md) - - [Explicit Misplaced SPN](cannot-generate-sspi-context-error.md) - - [Explicit SPN is duplicated](cannot-generate-sspi-context-error.md) - -- Following are the errors specific to the local Windows permissions or Policy settings. - - [Access via Group](access-through-group-windows-permissions.md) - - [Network login disallowed](network-login-disallowed.md) - - [Service account not trusted for delegation](service-account-not-trusted-for-delegation.md) - - [Only admins can login](only-admins-can-login.md) - - [Local Security Subsystem Issues](local-security-subsystem-issues.md) - - [Corrupt user profile](corrupt-user-profile.md) - - [Credential Guard is enabled](/windows/security/identity-protection/credential-guard/considerations-known-issues) - -- Following are the errors specific to NTLM: - - [NTLM Peer Login](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16) - - [Loopback Protection](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16) - - [Always-On Listener Loopback Protection](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16) - - [Double Hop](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16) - - [LANMAN Compatibility Level](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error?view=sql-server-ver16) - -- Issues specific to Active Directory and Domain Controller: - - [Account disabled](account-disabled-error.md) - - [Cross-domain groups](cross-domain-groups.md) - - [Firewall blocks the DC](firewall-blocks-the-dc.md) - - [Domain trust](domain-trust-error.md) - - [Selective authentication](selective-authentication.md) - - [Account migration](account-migration-error.md) - - [Directory Services specific error messages](directory-services-specific-error-messages.md) - -- Issues specific to Kerberos: - - Missing SPN - -- Miscellaneous issues - To be added. diff --git a/support/sql/database-engine/connect/domain-trust-error.md b/support/sql/database-engine/connect/domain-trust-error.md index 9dca8ac55a..1eddd6a21d 100644 --- a/support/sql/database-engine/connect/domain-trust-error.md +++ b/support/sql/database-engine/connect/domain-trust-error.md @@ -10,7 +10,7 @@ ms.custom: sap:Connection issues # Domain trust error -This article helps you resolve the "Domain trust" error. +This article helps you resolve the "Domain trust" error. This error might occur if there is an issue with the trust relationship between two domains. ## Symptoms @@ -18,4 +18,4 @@ The trust level between domains might cause failures in account authentication o ## Resolution -Use the `SETSPN` and `RUNAS` commands to test this independent of your application. +Use the `SETSPN` and `RUNAS` commands to test the trust relationship independent of your application. diff --git a/support/sql/database-engine/connect/local-security-subsystem-issues.md b/support/sql/database-engine/connect/local-security-subsystem-issues.md index 3390fb96f4..b7441d468a 100644 --- a/support/sql/database-engine/connect/local-security-subsystem-issues.md +++ b/support/sql/database-engine/connect/local-security-subsystem-issues.md @@ -1,7 +1,7 @@ --- title: Troubleshooting local security subsystem errors description: This article provides symptoms and resolution for the local security subsystem issues. -ms.date: 11/25/2023 +ms.date: 12/02/2023 author: prmadhes-msft ms.author: prmadhes ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp @@ -28,4 +28,4 @@ You might also see Kerberos errors in the System event log on the SQL Server mac ## Resolution -To be added +Check whether your Service Principal Name (SPN) is registered correctly on the Domain Controller (DC). From c2564869a38c7342b2c76e4830813aac3c1157b3 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Mon, 4 Dec 2023 19:43:13 +0530 Subject: [PATCH 026/370] Removed topics and categorized tables --- ...ccess-through-group-windows-permissions.md | 4 +- ...bad-server-name-connection-string-error.md | 2 +- ...tent-authentication-connectivity-issues.md | 55 ++++++++++--------- ...termine-if-connected-sqlserver-kerberos.md | 10 ++++ .../linked-server-account-mapping-error.md | 12 ++-- .../connect/only-admins-can-login.md | 2 +- .../connect/proxy-account-error.md | 21 ------- ...vice-account-not-trusted-for-delegation.md | 21 ------- 8 files changed, 48 insertions(+), 79 deletions(-) create mode 100644 support/sql/database-engine/connect/determine-if-connected-sqlserver-kerberos.md delete mode 100644 support/sql/database-engine/connect/proxy-account-error.md delete mode 100644 support/sql/database-engine/connect/service-account-not-trusted-for-delegation.md diff --git a/support/sql/database-engine/connect/access-through-group-windows-permissions.md b/support/sql/database-engine/connect/access-through-group-windows-permissions.md index 06ca6533e5..f993b39bea 100644 --- a/support/sql/database-engine/connect/access-through-group-windows-permissions.md +++ b/support/sql/database-engine/connect/access-through-group-windows-permissions.md @@ -12,12 +12,12 @@ ms.custom: sap:Connection issues This article helps you to resolve the access via group Windows permission error. -If the user doesn't belong to a local group used to grant access to the server, the provider should display the "Login failed for user 'contoso/user1'" error message. +If the user doesn't belong to a local group used to grant access to the server, the provider should display the "Login failed for user 'database name/username'" error message. The DBA can double-check the access by looking at the Security\Logins in SSMS. If it's a contained database, the DBA checks under database name. When you run the `xp_logininfo 'contoso/user1'` stored procedure, the following are likely to happen: -- If you receive an error, SQL can't resolve the user name at all. It is likely that a name isn't present in the Active Directory or there might be issues connecting to the Domain Controller (DC). Try using another name to check if the issue is related to a specific account. +- If you receive an error, SQL can't resolve the user name at all. It is likely that a name isn't present in the Active Directory (AD) or there might be issues connecting to the Domain Controller (DC). Try using another name to check if the issue is related to a specific account. - If you are connecting to cross-domain, the group must be in the SQL Server domain, and not the user domain so that its membership can be resolved. diff --git a/support/sql/database-engine/connect/bad-server-name-connection-string-error.md b/support/sql/database-engine/connect/bad-server-name-connection-string-error.md index e800ba321b..3439353dd1 100644 --- a/support/sql/database-engine/connect/bad-server-name-connection-string-error.md +++ b/support/sql/database-engine/connect/bad-server-name-connection-string-error.md @@ -39,7 +39,7 @@ To resolve this issue, follow these steps: 1. Validate that you're connecting to the appropriate server. -1. If the server isn't the appropriate one, then the connection string. +1. If the server isn't the appropriate one, then use the connection string. 1. If the connection string is correct, add the login to the database. diff --git a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md index c6bfacc3a3..b7843ca656 100644 --- a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md +++ b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md @@ -1,7 +1,7 @@ --- title: Introduction to consistent authentication issues description: This article introduces to consistent authentication issues, the types of error messages, and workarounds to troubleshoot various problems. -ms.date: 11/27/2023 +ms.date: 12/04/2023 author: prmadhes-msft ms.author: prmadhes ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp @@ -37,23 +37,26 @@ Refers to the Active Directory errors. If the SQL Server ErrorLog file contains ## Login failed specific issues -Refers to some of the common login failures. For detailed information, see [MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). +Before you start with troubleshooting issues, it's important to understand the nature of an error and the category that it belongs to. This section provides error messages grouped based on a category. Some errors might appear in more than one category. This section lists the possible error messages and its related to possible causes. -|Error message |Causes | +|Error message |Possible causes | |---------|---------| -|[Login failed for user '(null)'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error#login-failed-for-user-(null)) | | -| [Login failed for user ''](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) | | -|[Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) | | -|[Login failed for user 'username'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) | | -|[Login failed for user 'domain\username'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error) | | -|Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. | | -|[SQL Server does not exist or access denied](network-related-or-instance-specific-error-occurred-while-establishing-connection.md) - This can also be a network error. | | -|[SSPI context messages](/troubleshoot/sql/database-engine/connect/cannot-generate-sspi-context-error?branch=main) | | - - -Before you start with troubleshooting, it is important to understand the nature of an error and the category that it belongs to. This section provides error messages grouped based on a category. Some errors might appear in more than one category. Each of these error scenarios has the symptoms and the solutions as well. Following are the error categories. - -The next few sections list some of the scenarios specific to areas such as Kerberos, Active Directory, Domain Controller, connection strings, NTLM, and so on. +|[Login failed for user '(null)'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error#login-failed-for-user-(null))|The password you provided might be incorrect or the user name might not be valid or it might be a case where SQL logins aren't enabled. For more information, see "You're trying to use SQL Server Authentication, but the SQL Server instance is configured for Windows Authentication mode".| +|`SQL Server does not exist or access denied.` | [Named Pipes connections](named-pipes-connection-fail-no-windows-permission.md) fail because the user doesn't have permission to log into Windows. | +|`Cannot open database "test" requested by the login. The login failed.`|The database might be offline, or the permissions might not be sufficient. For more information, see [Database offline in MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error).| +|`A transport-level error has occurred when sending the request to the server.`|Check if the [linked server account mapping](linked-server-account-mapping-error.md) is correct. For more information, see [sp_addlinkedsrvlogin](/sql/relational-databases/system-stored-procedures/sp-addlinkedsrvlogin-transact-sql).| +|`Login failed for user 'username'.` | This can happen if the [proxy account](../../integration-services/ssis-package-doesnt-run-when-called-job-step.md) isn't properly authenticated. | +|`Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'` | | +|`Login failed for user 'username'.`
`Login failed for user 'database\username'`
| Check if there is a [bad server name in connection string](bad-server-name-connection-string-error.md). Also, check if the [user doesn't belong to a local group](access-through-group-windows-permissions.md) that's used to grant access to the server. For more causes, see [NT AUTHORITY\ANONYMOUS LOGON](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). | +|`"Cannot open database "northwind" requested by the login. The login failed."`|Check if the database name in the connection string is correct.| +|SSPI Context errors|The explicit SPN account might be [wrong](wrong-explicit-spn-account-connection-string.md), missing, or misplaced. | +|`"The user account is not allowed the Network Login type"`|You might not be able to [log in to the network](network-login-disallowed.md).| +|Service account not trusted for delegation |Check if the service account isn't trusted for delegation. For more information, see [How to Configure the Server to be Trusted for Delegation - Microsoft Desktop Optimization Pack](/microsoft-desktop-optimization-pack/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation). If a delegation scenario isn't enabled, check the SQL Server *secpol.msc* to see if the SQL Server service account is listed under **Local Policies -> User Rights Assignment -> Impersonate a client after authentication** security policy settings. | +|`"The login is from an untrusted domain and cannot be used with Windows authentication."`|This error might be related to the [Local Security Subsystem](local-security-subsystem-issues.md) issues.| + +For detailed information, see [MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). + +The following section provides some scenarios and related solution related to the AD and DC. ## Active Directory and Domain Controller issues @@ -61,13 +64,13 @@ The following table provides some solutions to the AD and DC issues: |Possible causes |Workarounds | |---------|---------| -|Account disabled | You might experience this error if the user account has been disabled by an administrator or by a user. In such a case, you can't login with this account or start a service with it. | -|Account not in group | You can access the database using groups rather than individually. Check the SQL logins to enumerate allowed groups and make sure the user belongs to one of them. | +|An account is disabled. | You might experience this error if the user account has been disabled by an administrator or by a user. In such a case, you can't login with this account or start a service with it. | +|An account is not in the group. | You can access the database using groups rather than individually. Check the SQL logins to enumerate allowed groups and make sure the user belongs to one of them. | |Cross-Domain groups | Users from the remote domain should belong to a group in the SQL Server domain. If the domains lack proper trust, adding the users in a group in the remote domain might prevent the SQL Server from enumerating the group's membership. | |Firewall blocks the DC | Make sure the DC is accessible from the client or the SQL Server via `nltest /SC_QUERY:CONTOSO`. | -|DC Offline |This error might occur if there are incorrect Domain Naming Service (DNS) records for DC. NLTEST can be used to force the computer to switch to another DC. See Firewall Blocks the DC. | +|Domain Controller is offline |This error might occur if there are incorrect Domain Naming Service (DNS) records for DC. NLTEST can be used to force the computer to switch to another DC. See Firewall Blocks the DC. | |Selective authentication | Refers to a feature of domain trusts that allows the domain administrator to limit which users have access to resources in the remote domain. Make sure the user isn't allowed to authenticate in the remote domain. | -|Account migration | If old user accounts can't connect to the SQL Server, but newly created accounts can, this could be due to account migration. This is an Active Directory issue. | +|Account migration | If old user accounts can't connect to the SQL Server, but newly created accounts can, this could be due to account migration. This is an AD issue. | ## Kerberos authentication issues @@ -78,21 +81,21 @@ The following table contains information about issues related to Kerberos authen |Not trusted for delegation and Not a constrained target |These are Active Directory (AD) issues. If you are an Administrator, enable the **Trusted for delegation** setting. | |Sensitive account | Some accounts may be marked as Sensitive in AD. These accounts can't be delegated to another service in a double-hop scenario. | |User belongs to many groups | This can happen when a user is a member of many groups in AD. If you use Kerberos over UDP, the entire security token must fit within a single packet. Users that belong to many groups will have a larger security token than those that belong to fewer groups. If you use Kerberos over TCP, you can increase the [`MaxTokenSize`] setting. For more information, see [MaxTokenSize and Kerberos Token Bloat](/archive/blogs/shanecothran/maxtokensize-and-kerberos-token-bloat). | -|Clock skew error | This error can occur when clocks on more than one device on a network are not synchronized. For Kerberos server to work, the clocks between machines can't be off for more than five minutes. | -| NTLM and Constrained Delegation error | If the target is a file share, the delegation type of the mid-tier service account must be **Constrained-Any** and not **Constrained-Kerberos**. See Login failed for user NT AUTHORITY\ANONYMOUS LOGON for more information. | +|Clock skew | This error can occur when clocks on more than one device on a network aren't synchronized. For Kerberos server to work, the clocks between machines can't be turned off for more than five minutes. | +| NTLM and Constrained Delegation | If the target is a file share, the delegation type of the mid-tier service account must be **Constrained-Any** and not **Constrained-Kerberos**. For more information, see [Login failed for user NT AUTHORITY\ANONYMOUS LOGON](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). | |Per-Service-SID | Is a security feature of SQL Server that limits local connections to use New Technology LAN Manager (NTLM) and not Kerberos as the authentication method. The service can make a single hop to another server using NTLM credentials, but it can't be delegated further without using the constrained delegation. | |Legacy Providers and Named Pipes | This error might occur when there is a problem with the connection between the client and server. The legacy OLE DB Provider (SQLOLEDB) and ODBC Driver {SQL Server} that come with Windows don't support Kerberos over Named Pipes, only NTLM. Use a TCP connection to allow Kerberos. | -|Kernel mode authentication |This error can occur when you try to open a web site from a remote machine. Normally, the SPN must be on the App Pool account for web servers, but when you use Kernel Mode Authentication, authentication is performed in the kernel and the computer's HOST SPN is used. This setting may be used if the server hosts a number of different web sites using the same host header URL, different App Pool accounts, and [Windows Authentication](/iis/configuration/system.webserver/security/authentication/). | -|Delegating Credentials to Access or Excel | Refers to a process where a user grants permissions to another user. The Joint Engine Technology (JET) and Access Connectivity Engine (ACE) providers are similar to any of the file systems. You must use constrained delegation to allow SQL Server to read files located on another machine. In general, the ACE provider shouldn't be used in a linked server as this is explicitly not supported. The JET provider is deprecated and is available on 32-bit machines only. | +|Kernel mode authentication |This error can occur when you try to open a website from a remote machine. Normally, the SPN must be on the App Pool account for web servers, but when you use Kernel Mode Authentication, authentication is performed in the kernel and the computer's HOST SPN is used. This setting might be used if the server hosts a number of different websites using the same host header URL, different App Pool accounts, and [Windows Authentication](/iis/configuration/system.webserver/security/authentication/). | +|Delegating Credentials to Access or Excel | The Joint Engine Technology (JET) and Access Connectivity Engine (ACE) providers are similar to any of the file systems. You must use constrained delegation to allow SQL Server to read files located on another machine. In general, the ACE provider shouldn't be used in a linked server as this is explicitly not supported. The JET provider is deprecated and is available on 32-bit machines only. | |SQL alias | A SQL [Server alias](network-related-or-instance-specific-error-occurred-while-establishing-connection.md) may cause an unexpected SPN to be generated. This will result in NTLM credentials if the SPN isn't found, or an SSPI failure, if it inadvertently matches the SPN of another server. | |Website host header | If the website has a host header name, the HOSTS SPN can't be used. An explicit HTTP SPN must be used. If the website doesn't have a host header name, NTLM is used and it can't be delegated to a backend SQL Server or other service. | |HOSTS file | The hosts file overrides DNS lookups and might generate an unexpected SPN name. This will cause NTLM credentials to be used. If an unexpected IP address is in the hosts file, the SPN generated might not match the backend pointed to. | |Delegating to a file share | Make sure to use constrained delegation in this scenario. | -|HTTP Ports | Normally, HTTP SPNs don't use port numbers, example `http/web01.contoso.com`, but you can enable this through the policy on the clients. The SPN would then have to be in the `http/web01.contoso.com:88` format, to enable Kerberos to function correctly. Otherwise, NTLM credentials are used, which aren't recommended because it would be difficult to diagnose the issue and it might be an excessive administrative overhead. | +|HTTP Ports | Normally, HTTP SPNs don't use port numbers, example `http/web01.contoso.com`, but you can enable this through the policy on the clients. The SPN would then have to be in the `http/web01.contoso.com:88` format, to enable Kerberos to function correctly. Otherwise, NTLM credentials are used, which aren't recommended because it would be difficult to diagnose the issue and it might be an excessive administrative overhead. | ## Other issues -The following table contains scenarios related to Internet access related issues: +The following table contains the possible cause ad related information about scenarios related to Internet access: |Possible cause |More information | |---------|---------| diff --git a/support/sql/database-engine/connect/determine-if-connected-sqlserver-kerberos.md b/support/sql/database-engine/connect/determine-if-connected-sqlserver-kerberos.md new file mode 100644 index 0000000000..8ca2a6e0d7 --- /dev/null +++ b/support/sql/database-engine/connect/determine-if-connected-sqlserver-kerberos.md @@ -0,0 +1,10 @@ +--- +title: Determine the authentication type +description: This article introduces to consistent authentication issues, the types of error messages, and workarounds to troubleshoot various problems. +ms.date: 11/27/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + diff --git a/support/sql/database-engine/connect/linked-server-account-mapping-error.md b/support/sql/database-engine/connect/linked-server-account-mapping-error.md index dc6b67207b..b0c826d6cf 100644 --- a/support/sql/database-engine/connect/linked-server-account-mapping-error.md +++ b/support/sql/database-engine/connect/linked-server-account-mapping-error.md @@ -10,16 +10,14 @@ ms.custom: sap:Connection issues # Linked server account mapping error -This article helps you to resolve the linked server account mapping error. +This article helps you to resolve the linked server account mapping error. ## Symptoms When you connect to the mid-tier server from the Management Studio, you might see the following error message: -```output -> "Msg 233, Level 20, State 0, Line 0 -A transport-level error has occurred when sending the request to the server. (provider: Shared Memory Provider, error: 0 - No process is on the other end of the pipe.)" -``` +> "Msg 233, Level 20, State 0, Line 0 +> A transport-level error has occurred when sending the request to the server. (provider: Shared Memory Provider, error: 0 - No process is on the other end of the pipe.)" When you connect using application developed using .NET, you might see the following error messages: @@ -27,13 +25,13 @@ When you connect using application developed using .NET, you might see the follo > "Cannot initialize the data source object of OLE DB provider "MSDASQL" for linked server "SQLPROD02"." -If you also see the following error message, it indicates you are using Named Pipes for the linked server connection and a SQL login, and the mid-tier SQL Server service account or machine account doesn’t have login rights to Windows on the backend server: +If you also see the following error message, it indicates you are using Named Pipes for the linked server connection and a SQL login, and the mid-tier SQL Server service account or machine account doesn't have login rights to Windows on the backend server: > "OLE DB provider "MSDASQL" for linked server "SQLPROD02" returned message "[Microsoft][SQL Server Native Client 11.0][SQL Server]Login failed for user 'CONTOSO\SQLPROD01$'." ## Resolution -In the **Linked Server security** dialog, when you select the **Be made without using a security context** option, the "Login Failed for user NT AUTHORITY\ANONYMOUS LOGON" error is displayed. When you select **Be made with this security context**, the SQL login is successful. +In the **Linked Server security** dialog, when you select the **Be made without using a security context** option, the "Login Failed for user NT AUTHORITY\ANONYMOUS LOGON" error is shown. When you select **Be made with this security context**, the SQL login is successful. You can correct this error by forcing TCP/IP or granting the appropriate permissions. In addition to the settings in the **Linked Server security** dialog, you can modify the individual account mappings in the upper portion of the dialog, which overrides the main mapping settings. diff --git a/support/sql/database-engine/connect/only-admins-can-login.md b/support/sql/database-engine/connect/only-admins-can-login.md index 89c1af301c..335030212e 100644 --- a/support/sql/database-engine/connect/only-admins-can-login.md +++ b/support/sql/database-engine/connect/only-admins-can-login.md @@ -20,7 +20,7 @@ The **CrashOnAuditFail** feature is a security feature used by system administra To resolve the error, follow these steps: -1. Start the Registry Editor. +1. Start the Registry editor. 1. Locate the following key, and then check whether the value of this key is set to *2*: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa!crashonauditfail` diff --git a/support/sql/database-engine/connect/proxy-account-error.md b/support/sql/database-engine/connect/proxy-account-error.md deleted file mode 100644 index 5e1a62b580..0000000000 --- a/support/sql/database-engine/connect/proxy-account-error.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: Troubleshooting the proxy account error -description: This article provides symptoms and resolution for the proxy account error. -ms.date: 11/23/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp -ms.custom: sap:Connection issues ---- - -# Proxy account error - -This article helps you resolve the proxy account error. - -## Symptoms - -An SSIS job run by SQL Agent might need permissions other than the SQL Agent service account can provide. - -## Resolution - -Check whether a Proxy account needs to be created or used and if a proxy account is being used, it is the correct account. diff --git a/support/sql/database-engine/connect/service-account-not-trusted-for-delegation.md b/support/sql/database-engine/connect/service-account-not-trusted-for-delegation.md deleted file mode 100644 index b93953778f..0000000000 --- a/support/sql/database-engine/connect/service-account-not-trusted-for-delegation.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: Troubleshooting the service account not trusted for delegation error -description: This article provides symptoms and resolution for the service account not trusted for delegation error. -ms.date: 11/23/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp -ms.custom: sap:Connection issues ---- - -# Service account not trusted for delegation error - -This article helps you to resolve the service account not trusted for delegation error. - -## Symptoms - -(To be added) - -## Resolution - -If a delegation scenario isn't enabled, check the SQL Server *secpol.msc* if the SQL Server service account is listed under **Local Policies > User Rights Assignment > Impersonate a client after authentication** security policy settings. From 6c99cfb6f65dd20e217667bac7f2a1517e3a2030 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Tue, 5 Dec 2023 12:01:47 +0530 Subject: [PATCH 027/370] Updated text Added a topic Combining commits Updated text based on Acrolinx report --- ...ccess-through-group-windows-permissions.md | 4 +- ...bad-server-name-connection-string-error.md | 8 +- ...tent-authentication-connectivity-issues.md | 37 +++-- .../connect/corrupt-user-profile.md | 2 +- ...termine-if-connected-sqlserver-kerberos.md | 10 -- .../determine-the-authentcation-type.md | 139 ++++++++++++++++++ .../connect/disjoint-dns-namespace-error.md | 8 +- 7 files changed, 167 insertions(+), 41 deletions(-) delete mode 100644 support/sql/database-engine/connect/determine-if-connected-sqlserver-kerberos.md create mode 100644 support/sql/database-engine/connect/determine-the-authentcation-type.md diff --git a/support/sql/database-engine/connect/access-through-group-windows-permissions.md b/support/sql/database-engine/connect/access-through-group-windows-permissions.md index f993b39bea..b03ca4ccbc 100644 --- a/support/sql/database-engine/connect/access-through-group-windows-permissions.md +++ b/support/sql/database-engine/connect/access-through-group-windows-permissions.md @@ -1,5 +1,5 @@ --- -title: Troubleshooting the access via group error +title: Troubleshooting the access through group error description: This article provides symptoms and resolution for the access via group error. ms.date: 11/27/2023 author: prmadhes-msft @@ -10,7 +10,7 @@ ms.custom: sap:Connection issues # Access via group error -This article helps you to resolve the access via group Windows permission error. +This article helps you to resolve the access using group Windows permission error. If the user doesn't belong to a local group used to grant access to the server, the provider should display the "Login failed for user 'database name/username'" error message. The DBA can double-check the access by looking at the Security\Logins in SSMS. If it's a contained database, the DBA checks under database name. diff --git a/support/sql/database-engine/connect/bad-server-name-connection-string-error.md b/support/sql/database-engine/connect/bad-server-name-connection-string-error.md index 3439353dd1..45c717a260 100644 --- a/support/sql/database-engine/connect/bad-server-name-connection-string-error.md +++ b/support/sql/database-engine/connect/bad-server-name-connection-string-error.md @@ -19,16 +19,16 @@ SQLOLEDB and SQLNCLI11 OLE DB providers over TCP or Named Pipes show the followi - `Login failed for user 'userx'.`- Message is shown when the providers use an SQL login. - `Login failed for user 'CONTOSO\user1'.`- Message is shown the providers use a Windows login. -The SQL Server and ODBC Driver 13 ODBC Drivers show the following error message: +The SQL Server and ODBC Driver 13 ODBC drivers show the following error message: -`Login failed for user 'CONTOSO\user1'` +> Login failed for user 'CONTOSO\user1' -The SqlClient .NET Provider displays the following error messages: +The SqlClient .NET Provider shows the following error messages: > "Login failed for user ''. -when using TCP and a SQL login or a Windows login" > "Login failed for user 'CONTOSO\user1'. - when using Named Pipes and a SQL login or a Windows login" -The SQL Server Errorlog will have one of the following messages: +The SQL Server error log will have one of the following messages: > "'Login failed for user'. Reason: Could not find a login matching the name provided." > "'Login failed for user 'CONTOSO\USER1'. Reason: Could not find a login matching the name provided." diff --git a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md index b7843ca656..37a0b9a34e 100644 --- a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md +++ b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md @@ -1,6 +1,6 @@ --- title: Introduction to consistent authentication issues -description: This article introduces to consistent authentication issues, the types of error messages, and workarounds to troubleshoot various problems. +description: This article introduces to consistent authentication issues, the types of error messages, and workarounds to troubleshoot various issues. ms.date: 12/04/2023 author: prmadhes-msft ms.author: prmadhes @@ -20,7 +20,7 @@ _Applies to:_   SQL Server A consistent authentication issue in SQL Server typically refers to problems related to authentication and authorization of users or applications trying to access the SQL Server database. These issues can lead to authentication failures, access denied errors, or other security-related problems. -Before you start to troubleshoot errors, it's important to understand what each error means and also what is the type of error. +Before you start to troubleshoot errors, it's important to understand what each error means and also what is the type of error. Some errors might appear in more than one category. It's also important to understand the category of the error because the troubleshooting steps also vary. This section provides various types of consistent authentication errors. @@ -28,36 +28,33 @@ It's also important to understand the category of the error because the troubles Refers to the Active Directory errors. If the SQL Server ErrorLog file contains both or either of the following messages, then this is an Active Directory (AD) issue. This might happen if the domain controller (DC) can't be contacted by Windows on the SQL Server computer or the local security service (LSASS) is having a problem. - `Error -2146893039 (0x80090311): No authority could be contacted for authentication.` - `Error -2146893052 (0x80090304): The Local Security Authority cannot be contacted.` + > Error -2146893039 (0x80090311): No authority could be contacted for authentication. + > Error -2146893052 (0x80090304): The Local Security Authority cannot be contacted. ## Login failed error codes - If you are troubleshooting a "Login Failed" error message, the SQL Server ErrorLog file can provide more information in the SQL State value with error 18456 (Login Failed). For more information, see [Login failed error codes](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error#additional-error-information). + If you are troubleshooting a "Login Failed" error message, the SQL Server error log file can provide more information in the SQL State value with error 18456 (Login Failed). For more information, see [Login failed error codes](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error#additional-error-information). ## Login failed specific issues -Before you start with troubleshooting issues, it's important to understand the nature of an error and the category that it belongs to. This section provides error messages grouped based on a category. Some errors might appear in more than one category. This section lists the possible error messages and its related to possible causes. +This section lists the possible error messages and their possible causes. |Error message |Possible causes | |---------|---------| -|[Login failed for user '(null)'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error#login-failed-for-user-(null))|The password you provided might be incorrect or the user name might not be valid or it might be a case where SQL logins aren't enabled. For more information, see "You're trying to use SQL Server Authentication, but the SQL Server instance is configured for Windows Authentication mode".| +|`Login failed for user '(null)'`|The password you provided might be incorrect or the user name might not be valid or it might be a case where SQL logins aren't enabled. For more information, see [You're trying to use SQL Server Authentication, but the SQL Server instance is configured for Windows Authentication mode](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error#login-failed-for-user-(null)).| |`SQL Server does not exist or access denied.` | [Named Pipes connections](named-pipes-connection-fail-no-windows-permission.md) fail because the user doesn't have permission to log into Windows. | |`Cannot open database "test" requested by the login. The login failed.`|The database might be offline, or the permissions might not be sufficient. For more information, see [Database offline in MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error).| |`A transport-level error has occurred when sending the request to the server.`|Check if the [linked server account mapping](linked-server-account-mapping-error.md) is correct. For more information, see [sp_addlinkedsrvlogin](/sql/relational-databases/system-stored-procedures/sp-addlinkedsrvlogin-transact-sql).| |`Login failed for user 'username'.` | This can happen if the [proxy account](../../integration-services/ssis-package-doesnt-run-when-called-job-step.md) isn't properly authenticated. | -|`Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'` | | |`Login failed for user 'username'.`
`Login failed for user 'database\username'`
| Check if there is a [bad server name in connection string](bad-server-name-connection-string-error.md). Also, check if the [user doesn't belong to a local group](access-through-group-windows-permissions.md) that's used to grant access to the server. For more causes, see [NT AUTHORITY\ANONYMOUS LOGON](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). | |`"Cannot open database "northwind" requested by the login. The login failed."`|Check if the database name in the connection string is correct.| |SSPI Context errors|The explicit SPN account might be [wrong](wrong-explicit-spn-account-connection-string.md), missing, or misplaced. | |`"The user account is not allowed the Network Login type"`|You might not be able to [log in to the network](network-login-disallowed.md).| |Service account not trusted for delegation |Check if the service account isn't trusted for delegation. For more information, see [How to Configure the Server to be Trusted for Delegation - Microsoft Desktop Optimization Pack](/microsoft-desktop-optimization-pack/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation). If a delegation scenario isn't enabled, check the SQL Server *secpol.msc* to see if the SQL Server service account is listed under **Local Policies -> User Rights Assignment -> Impersonate a client after authentication** security policy settings. | -|`"The login is from an untrusted domain and cannot be used with Windows authentication."`|This error might be related to the [Local Security Subsystem](local-security-subsystem-issues.md) issues.| +|"The login is from an untrusted domain and cannot be used with Windows authentication."|This error might be related to the [Local Security Subsystem](local-security-subsystem-issues.md) issues.| For detailed information, see [MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). -The following section provides some scenarios and related solution related to the AD and DC. - ## Active Directory and Domain Controller issues The following table provides some solutions to the AD and DC issues: @@ -67,9 +64,9 @@ The following table provides some solutions to the AD and DC issues: |An account is disabled. | You might experience this error if the user account has been disabled by an administrator or by a user. In such a case, you can't login with this account or start a service with it. | |An account is not in the group. | You can access the database using groups rather than individually. Check the SQL logins to enumerate allowed groups and make sure the user belongs to one of them. | |Cross-Domain groups | Users from the remote domain should belong to a group in the SQL Server domain. If the domains lack proper trust, adding the users in a group in the remote domain might prevent the SQL Server from enumerating the group's membership. | -|Firewall blocks the DC | Make sure the DC is accessible from the client or the SQL Server via `nltest /SC_QUERY:CONTOSO`. | +|Firewall blocks the DC | Make sure the DC is accessible from the client or the SQL Server using the `nltest /SC_QUERY:CONTOSO` command. | |Domain Controller is offline |This error might occur if there are incorrect Domain Naming Service (DNS) records for DC. NLTEST can be used to force the computer to switch to another DC. See Firewall Blocks the DC. | -|Selective authentication | Refers to a feature of domain trusts that allows the domain administrator to limit which users have access to resources in the remote domain. Make sure the user isn't allowed to authenticate in the remote domain. | +|Selective authentication | Make sure the user isn't allowed to authenticate in the remote domain. | |Account migration | If old user accounts can't connect to the SQL Server, but newly created accounts can, this could be due to account migration. This is an AD issue. | ## Kerberos authentication issues @@ -84,21 +81,21 @@ The following table contains information about issues related to Kerberos authen |Clock skew | This error can occur when clocks on more than one device on a network aren't synchronized. For Kerberos server to work, the clocks between machines can't be turned off for more than five minutes. | | NTLM and Constrained Delegation | If the target is a file share, the delegation type of the mid-tier service account must be **Constrained-Any** and not **Constrained-Kerberos**. For more information, see [Login failed for user NT AUTHORITY\ANONYMOUS LOGON](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). | |Per-Service-SID | Is a security feature of SQL Server that limits local connections to use New Technology LAN Manager (NTLM) and not Kerberos as the authentication method. The service can make a single hop to another server using NTLM credentials, but it can't be delegated further without using the constrained delegation. | -|Legacy Providers and Named Pipes | This error might occur when there is a problem with the connection between the client and server. The legacy OLE DB Provider (SQLOLEDB) and ODBC Driver {SQL Server} that come with Windows don't support Kerberos over Named Pipes, only NTLM. Use a TCP connection to allow Kerberos. | -|Kernel mode authentication |This error can occur when you try to open a website from a remote machine. Normally, the SPN must be on the App Pool account for web servers, but when you use Kernel Mode Authentication, authentication is performed in the kernel and the computer's HOST SPN is used. This setting might be used if the server hosts a number of different websites using the same host header URL, different App Pool accounts, and [Windows Authentication](/iis/configuration/system.webserver/security/authentication/). | +|Legacy Providers and Named Pipes | The legacy OLE DB Provider (SQLOLEDB) and ODBC Driver {SQL Server} that come with Windows don't support Kerberos over Named Pipes, only NTLM. Use a TCP connection to allow Kerberos. | +|Kernel mode authentication | Normally, the SPN must be on the App Pool account for web servers, but when you use Kernel Mode Authentication, authentication is performed in the kernel and the computer's HOST SPN is used. This setting might be used if the server hosts a number of different websites using the same host header URL, different App Pool accounts, and [Windows Authentication](/iis/configuration/system.webserver/security/authentication/). | |Delegating Credentials to Access or Excel | The Joint Engine Technology (JET) and Access Connectivity Engine (ACE) providers are similar to any of the file systems. You must use constrained delegation to allow SQL Server to read files located on another machine. In general, the ACE provider shouldn't be used in a linked server as this is explicitly not supported. The JET provider is deprecated and is available on 32-bit machines only. | |SQL alias | A SQL [Server alias](network-related-or-instance-specific-error-occurred-while-establishing-connection.md) may cause an unexpected SPN to be generated. This will result in NTLM credentials if the SPN isn't found, or an SSPI failure, if it inadvertently matches the SPN of another server. | -|Website host header | If the website has a host header name, the HOSTS SPN can't be used. An explicit HTTP SPN must be used. If the website doesn't have a host header name, NTLM is used and it can't be delegated to a backend SQL Server or other service. | -|HOSTS file | The hosts file overrides DNS lookups and might generate an unexpected SPN name. This will cause NTLM credentials to be used. If an unexpected IP address is in the hosts file, the SPN generated might not match the backend pointed to. | +|Web site host header | If the web site has a host header name, the HOSTS SPN can't be used. An explicit HTTP SPN must be used. If the web site doesn't have a host header name, NTLM is used and it can't be delegated to a backend SQL Server or other service. | +|Hosts file | The Hosts file overrides DNS lookups and might generate an unexpected SPN name. This will cause NTLM credentials to be used. If an unexpected IP address is in the Hosts file, the SPN generated might not match the backend pointed to. | |Delegating to a file share | Make sure to use constrained delegation in this scenario. | |HTTP Ports | Normally, HTTP SPNs don't use port numbers, example `http/web01.contoso.com`, but you can enable this through the policy on the clients. The SPN would then have to be in the `http/web01.contoso.com:88` format, to enable Kerberos to function correctly. Otherwise, NTLM credentials are used, which aren't recommended because it would be difficult to diagnose the issue and it might be an excessive administrative overhead. | ## Other issues -The following table contains the possible cause ad related information about scenarios related to Internet access: +The following table contains the possible cause and related information about scenarios related to Internet access: |Possible cause |More information | |---------|---------| |Integrated authentication is not enabled | This might be related to the integrated authentication issues. To resolve this type of error, in the **Internet Options**, make sure that the **Integrated Windows Authentication** is enabled. | -|Wrong Internet zone | This might happen if you try to access a website that is not in the correct Internet zone in IE. The credentials will not work if the web site is not in the Local Intranet zone. | -|IIS Authentication | Configure the website to allow Windows Authentication and the *web.config* file needs to have the `` set. | +|Wrong Internet zone | This might happen if you try to access a web site that is not in the correct Internet zone in IE. The credentials will not work if the web site is not in the Local Intranet zone. | +|IIS Authentication | Configure the web site to allow Windows authentication and the *web.config* file needs to have the `` set. | diff --git a/support/sql/database-engine/connect/corrupt-user-profile.md b/support/sql/database-engine/connect/corrupt-user-profile.md index a275f97d39..15fd47c1c4 100644 --- a/support/sql/database-engine/connect/corrupt-user-profile.md +++ b/support/sql/database-engine/connect/corrupt-user-profile.md @@ -18,4 +18,4 @@ If you log in as the affected user, you will get a temporary profile. This is a ## Resolution -If you are not a guest user, follow the steps explained in [Fix a corrupted user profile in Windows](https://support.microsoft.com/en-us/windows/fix-a-corrupted-user-profile-in-windows-1cf41c18-7ce3-12f9-8e1d-95896661c5c9) to either (a) repair the profile or (b) delete and recreate the profile. +If you aren't a guest user, follow the steps explained in [Fix a corrupted user profile in Windows](https://support.microsoft.com/en-us/windows/fix-a-corrupted-user-profile-in-windows-1cf41c18-7ce3-12f9-8e1d-95896661c5c9) to either (a) repair the profile or (b) delete and recreate the profile. diff --git a/support/sql/database-engine/connect/determine-if-connected-sqlserver-kerberos.md b/support/sql/database-engine/connect/determine-if-connected-sqlserver-kerberos.md deleted file mode 100644 index 8ca2a6e0d7..0000000000 --- a/support/sql/database-engine/connect/determine-if-connected-sqlserver-kerberos.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -title: Determine the authentication type -description: This article introduces to consistent authentication issues, the types of error messages, and workarounds to troubleshoot various problems. -ms.date: 11/27/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp -ms.custom: sap:Connection issues ---- - diff --git a/support/sql/database-engine/connect/determine-the-authentcation-type.md b/support/sql/database-engine/connect/determine-the-authentcation-type.md new file mode 100644 index 0000000000..7cb9af711d --- /dev/null +++ b/support/sql/database-engine/connect/determine-the-authentcation-type.md @@ -0,0 +1,139 @@ +--- +title: Determine the authentication type +description: This article describes about determining the type of authentication. +ms.date: 12/05/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Determine if I am connected to SQL Server using Kerberos authentication + +This article helps you to determine the type of authentication by running a query. Following is a basic query to determine your authentication type. Make sure to run this on a client machine and not on the SQL Server that you are testing. Otherwise the query returns auth_scheme as NTLM even if Kerberos is properly configured. This is due to per-service SID security hardening feature added in Windows 2008, which makes all local connections use NTLM regardless of whether Kerberos is available. + + ```sql + SELECT auth_scheme FROM sys.dm_exec_connections WHERE session_id=@@SPID + ``` + +## Using SQL Server Management Studio + +You can run the following query from the SSMS. + +```sql +SELECT c.session_id, c.net_transport, c.encrypt_option, + c.auth_scheme, s.host_name, @@SERVERNAME as "remote_name", + s.program_name, s.client_interface_name, s.login_name, + s.nt_domain, s.nt_user_name, s.original_login_name, + c.connect_time, s.login_time +FROM sys.dm_exec_connections AS c +JOIN sys.dm_exec_sessions AS s ON c.session_id = s.session_id +WHERE c.session_id=@@SPID +``` + +## Using command line + +Run the following query using the command line. + +```sql +C:\Temp>sqlcmd -S SQLProd01 -E -Q "select auth_scheme from sys.dm_exec_connections where session_id=@@SPID" +auth_scheme +---------------------------------------- +NTLM + +(1 rows affected) +``` + +If either of the previous two options aren't available, consider copying the following script into a Notepad and saving it as *getAuthScheme.vbs*. + +```vbs +' Auth scheme VB script. +' Run on a client machine, not the server. +' If you run locally, you will always get NTLM even if Kerberos is properly enabled. +' +' USAGE: CSCRIPT getAuthScheme.vbs tcp:SQLProd01.contoso.com,1433 ' explicitly specify DNS suffix, protocol, and port # ('tcp' must be lower case) +' USAGE: CSCRIPT getAuthScheme.vbs SQLProd01 ' let the driver figure out the DNS suffix, protocol, and port # +' +Dim cn, rs, s +s = WScript.Arguments.Item(0) ' get the server name from the command-line +Set cn = createobject("adodb.connection") +' +' Various connection strings depending on the driver/Provider installed on your machine +' SQLOLEDB is selected as it is on all windows machines, but may have limitations, such as lack of TLS 1.2 support +' Choose a newer provider or driver if you have it installed. +' +cn.open "Provider=SQLOLEDB;Data Source=" & s & ";Initial Catalog=master;Integrated Security=SSPI" ' On all Windows machines +'cn.open "Provider=SQLNCLI11;Data Source=" & s & ";Initial Catalog=master;Integrated Security=SSPI" ' Newer +'cn.open "Provider=MSOLEDBSQL;Data Source=" & s & ";Initial Catalog=master;Integrated Security=SSPI" ' Latest, good for SQL 2012 and newer +'cn.open "Driver={ODBC Driver 17 for SQL Server};Server=" & s & ";Database=master;Trusted_Connection=Yes" ' Latest +' +' Run the query and display the results +' +set rs = cn.Execute("select auth_scheme from sys.dm_exec_connections where session_id=@@SPID") +WScript.Echo "Auth scheme: " & rs(0) +rs.close +cn.close +``` + +Now, run the following *getAuthScheme.vbs* script from the command prompt: + +```vbs +C:\Temp>cscript getAuthScheme.vbs SQLProd01 +Microsoft (R) Windows Script Host Version 5.812 +Copyright (C) Microsoft Corporation. All rights reserved. + +Auth scheme: NTLM +``` + +## Using PowerShell to run the query + +You can also use a PowerShell script to test the SqlClient .NET Provider and try to isolate the issue from your application. + +```powershell +#------------------------------- +# +# get-SqlAuthScheme.ps1 +# +# PowerShell script to test a System.Data.SqlClient database connection +# +# USAGE: .\get-SqlAuthScheme tcp:SQLProd01.contoso.com,1433 ' explicitly specify DNS suffix, protocol, and port # ('tcp' must be lower case) +# USAGE: .\get-SqlAuthScheme SQLProd01 ' let the driver figure out the DNS suffix, protocol, and port # +# +#------------------------------- +param ([string]$server = "localhost") +Set-ExecutionPolicy Unrestricted-Scope CurrentUser +$connstr = "Server=$server;Database=master;Integrated Security=SSPI" + +[System.Data.SqlClient.SqlConnection] $conn = New-Object System.Data.SqlClient.SqlConnection +$conn.ConnectionString = $connstr + +[System.DateTime] $start = Get-Date + +$conn.Open() + +[System.Data.SqlClient.SqlCommand] $cmd = New-Object System.Data.SqlClient.SqlCommand +$cmd.CommandText = "select auth_scheme from sys.dm_exec_connections where session_id=@@spid" +$cmd.Connection = $conn +$dr = $cmd.ExecuteReader() +$result = $dr.Read() +$auth_scheme = $dr.GetString(0) + +$conn.Close() +$conn.Dispose() + +[System.DateTime] $end = Get-Date +[System.Timespan] $span = ($end - $start) + +"End time: " + $end.ToString("M/d/yyyy HH:mm:ss.fff") +"Elapsed time was " + $span.Milliseconds + " ms." +"Auth scheme for " + $server + ": " + $auth_scheme +``` + +Now, run the PowerShell script from the command prompt: + +```powershell +C:\temp> .\get-sqlauthscheme sqlprod01 +End time: 10/26/2020 18:00:24.753 +Elapsed time was 0 ms. +Auth scheme for sqlprod01: NTLM +``` diff --git a/support/sql/database-engine/connect/disjoint-dns-namespace-error.md b/support/sql/database-engine/connect/disjoint-dns-namespace-error.md index d89e1c718a..8792b56471 100644 --- a/support/sql/database-engine/connect/disjoint-dns-namespace-error.md +++ b/support/sql/database-engine/connect/disjoint-dns-namespace-error.md @@ -1,7 +1,7 @@ --- title: Troubleshooting the disjoint DNS namespace error description: This article provides symptoms and resolution for the disjoint DNS namespace error. -ms.date: 11/27/2023 +ms.date: 12/05/2023 author: prmadhes-msft ms.author: prmadhes ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp @@ -10,12 +10,12 @@ ms.custom: sap:Connection issues # Disjoint DNS namespace error -This article helps you to resolve the disjoint DNS namespace error. +This article helps you to resolve the disjoint DNS namespace error. ## Symptoms -If the organizational hierarchy in Active Directory (AD) and in DNS don't match, the wrong SPN might be generated if you use the NETBIOS name in the connection string. The SPN will not be found and NTLM credentials will be used instead of Kerberos credentials. +If the organizational hierarchy in Active Directory (AD) and in DNS don't match, the wrong Service Provider Name (SPN) might be generated if you use the NETBIOS name in the connection string. The SPN won't be found and NTLM credentials are used instead of Kerberos credentials. ## Resolution - Use the fully-qualified name of the server or explicitly specify the SPN name in the connection string to mitigate problems. + Use the fully-qualified name of the server or specify the SPN name in the connection string to mitigate problems. From 1bc6006071684688cff03adfb8b34154d357e06f Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Wed, 6 Dec 2023 12:47:38 +0530 Subject: [PATCH 028/370] Added 2 scenarios and workarounds Updated consistent authentication issues topic - adding error message and explanation. Removed certain unwanted rows. --- .../connect/cannot-generate-sspi-context-error.md | 6 ++++-- .../consistent-authentication-connectivity-issues.md | 11 ++++++----- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/support/sql/database-engine/connect/cannot-generate-sspi-context-error.md b/support/sql/database-engine/connect/cannot-generate-sspi-context-error.md index 1208741bfb..c7a7e11be5 100644 --- a/support/sql/database-engine/connect/cannot-generate-sspi-context-error.md +++ b/support/sql/database-engine/connect/cannot-generate-sspi-context-error.md @@ -99,7 +99,9 @@ Follow these steps to fix the error using KCM. |Required SPN is missing | This status is reported when the SPN identified in the **Required SPN** column is missing for the SQL Server startup account in the Active Directory. | 1. Select **Fix** to review the information in the **Warning** dialog box.
2. Select **Yes** to add the missing SPN to Active Directory.
3. If your domain account has the necessary permissions to update Active Directory, the required SPN will be added to Active Directory.
4. If your domain account doesn't have necessary permissions to update Active Directory, use **Generate** or **Generate All** to generate the script that will help the Active Directory administrator add the missing SPNs.
5. After the SPNs are added, run Kerberos Configuration Manager again to verify that the SPN issues are resolved. |TCP must be enabled to use Kerberos configuration | This occurs when TCP isn't enabled on the client computer. | To enable TCP/IP protocol for the SQL Server instance, follow these steps:
1. In SQL Server Configuration Manager, in the **console** pane, expand **SQL Server Network Configuration**.
2. In the **console** pane, select **Protocols** for \.
3. In the **details** pane, right-click **TCP/IP**, and then select **Enable**.
4. In the **console** pane, select **SQL Server Services**.
5. In the **details** pane, right-click SQL Server (\), and then select **Restart** to stop and restart the SQL Server service.
For more information, see [Enable or Disable a Server Network Protocol](/sql/database-engine/configure-windows/enable-or-disable-a-server-network-protocol). | |Dynamic Port | This message shows up for named instances that use dynamic ports (default configuration). In environments where you need to use Kerberos to connect to SQL Server, you should set your named instance to a static port and use that port when registering SPN. | To configure your SQL Server instance to use a static port, follow these steps:
1. In SQL Server Configuration Manager, in the **console** pane, expand **SQL Server Network Configuration**, expand Protocols for \, and then double-click **TCP/IP**.
2. In the **TCP/IP Properties** dialog box, review the **Listen All** setting on the **Protocol** tab.
3. If the **Listen All** setting is set to **Yes**, switch to the **IP Addresses** tab and scroll to the bottom of the Windows to find the **IPAll** setting. Delete the current value that is contained in the **TCP Dynamic Ports** and set the desired value in the **TCP Port** field. Select **OK** and restart the SQL Server instance for the settings to take effect.
4. If the **Listen All** setting is set to **No**, switch to the **IP Addresses** tab and check each of the IP addresses that appear in the IP1, IP2. For enabled IP addresses, remove the current value contained in the **TCP Dynamic Ports** field and set the desired value in the **TCP Port** field. Select **OK** and restart the SQL Server instance for the settings to take effect.
For more information, see [Configure a Server to Listen on a Specific TCP Port](/sql/database-engine/configure-windows/configure-a-server-to-listen-on-a-specific-tcp-port). | - |Duplicate SPN |You can encounter the situation when the same SPN is registered under different accounts in Active Directory. | 1. Select the **Fix** button, view the information in the **Warning** dialog box, and select **Yes** if you can add the missing SPN to Active Directory.
2. If your domain account has the necessary permissions to update Active Directory, the incorrect SPN will be deleted.
3. If your domain account doesn't have necessary permissions to update Active Directory, use the **Generate** or **Generate All** button to generate the necessary script that you can hand over to your Active Directory administrator to remove the duplicate SPNs. Once the SPNs are removed, rerun the KCM to verify that the SPN issues are resolved.| + |Duplicate SPN |You can encounter the situation when the same SPN is registered under different accounts in Active Directory. | 1. Select the **Fix** button, view the information in the **Warning** dialog box, and select **Yes** if you can add the missing SPN to Active Directory.
2. If your domain account has the necessary permissions to update Active Directory, the incorrect SPN will be deleted.
3. If your domain account doesn't have necessary permissions to update Active Directory, use the **Generate** or **Generate All** button to generate the necessary script that you can hand over to your Active Directory administrator to remove the duplicate SPNs. Once the SPNs are removed, rerun the KCM to verify that the SPN issues are resolved.
4. Additionally, you can use the following commands:
Use `SETSPN -Q spnName` to locate the SPN and its current accounts.
Use `SETSPN -D` to remove the SPN from the incorrect account.| + |SPN on wrong account|You might receive this error if your SPN is configured on the wrong account in Active Directory.|1. Use `SETSPN -Q spnName` to locate the SPN and its current account.
2. Use `SETSPN -D` and `SETSPN -S` to migrate it to the correct account.| + > [!NOTE] > If the domain account that starts KCM doesn't have privileges to manipulate SPNs in Active Directory, you can use the corresponding **Generate** or **Generate All** button under the **SPN script** column to generate the required commands and work with your Active Directory administrator to fix the issues that are identified by KCM. @@ -162,7 +164,7 @@ For detailed diagnostics, use either [Test-NetConnection](/previous-versions/win > - [Troubleshooting TCP/IP](/previous-versions/tn-archive/bb727023(v=technet.10)) > - [Advanced troubleshooting for TCP/IP issues](/windows/client-management/troubleshoot-tcpip) -Check whether any aliases for the destination SQL Server exist in SQL Server Configuration Manager and in the SQL Server Client Network utility. If such an alias exists, ensure it's configured correctly by checking server names, network protocol, port number, and so on. +Check whether any aliases for the destination SQL Server exist in SQL Server Configuration Manager and in the SQL Server Client Network utility. If such an alias exists, ensure it's configured correctly by checking server names, network protocol, port number, and so on. A SQL [Server alias](network-related-or-instance-specific-error-occurred-while-establishing-connection.md) may cause an unexpected SPN to be generated. This will result in NTLM credentials if the SPN isn't found, or an SSPI failure, if it inadvertently matches the SPN of another server. ### Step 2: Verify communication between domains diff --git a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md index 37a0b9a34e..931694dc7a 100644 --- a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md +++ b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md @@ -45,7 +45,9 @@ This section lists the possible error messages and their possible causes. |`SQL Server does not exist or access denied.` | [Named Pipes connections](named-pipes-connection-fail-no-windows-permission.md) fail because the user doesn't have permission to log into Windows. | |`Cannot open database "test" requested by the login. The login failed.`|The database might be offline, or the permissions might not be sufficient. For more information, see [Database offline in MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error).| |`A transport-level error has occurred when sending the request to the server.`|Check if the [linked server account mapping](linked-server-account-mapping-error.md) is correct. For more information, see [sp_addlinkedsrvlogin](/sql/relational-databases/system-stored-procedures/sp-addlinkedsrvlogin-transact-sql).| +|`SSPI (Security Support Provider Interface) Context.`|Check if the SPN is on the wrong account.| |`Login failed for user 'username'.` | This can happen if the [proxy account](../../integration-services/ssis-package-doesnt-run-when-called-job-step.md) isn't properly authenticated. | +|`Login Failed for user: 'NT AUTHORITY\ANONYMOUS LOGON'`|This error might occur if the [SPN is missing, SPN is duplicated, or the SPN is on the wrong account](cannot-generate-sspi-context-error.md).| |`Login failed for user 'username'.`
`Login failed for user 'database\username'`
| Check if there is a [bad server name in connection string](bad-server-name-connection-string-error.md). Also, check if the [user doesn't belong to a local group](access-through-group-windows-permissions.md) that's used to grant access to the server. For more causes, see [NT AUTHORITY\ANONYMOUS LOGON](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). | |`"Cannot open database "northwind" requested by the login. The login failed."`|Check if the database name in the connection string is correct.| |SSPI Context errors|The explicit SPN account might be [wrong](wrong-explicit-spn-account-connection-string.md), missing, or misplaced. | @@ -63,9 +65,9 @@ The following table provides some solutions to the AD and DC issues: |---------|---------| |An account is disabled. | You might experience this error if the user account has been disabled by an administrator or by a user. In such a case, you can't login with this account or start a service with it. | |An account is not in the group. | You can access the database using groups rather than individually. Check the SQL logins to enumerate allowed groups and make sure the user belongs to one of them. | -|Cross-Domain groups | Users from the remote domain should belong to a group in the SQL Server domain. If the domains lack proper trust, adding the users in a group in the remote domain might prevent the SQL Server from enumerating the group's membership. | -|Firewall blocks the DC | Make sure the DC is accessible from the client or the SQL Server using the `nltest /SC_QUERY:CONTOSO` command. | -|Domain Controller is offline |This error might occur if there are incorrect Domain Naming Service (DNS) records for DC. NLTEST can be used to force the computer to switch to another DC. See Firewall Blocks the DC. | +|Cross-Domain groups | Users from the [remote domain should belong to a group](../../../windows-server/windows-security/trust-between-windows-ad-domain-not-work-correctly.md) in the SQL Server domain. If the domains lack proper trust, adding the users in a group in the remote domain might prevent the SQL Server from enumerating the group's membership. | +|Firewall blocks the DC | Make sure the DC is accessible from the client or the SQL Server using the `nltest /SC_QUERY:CONTOSO` command. | +|Domain Controller is offline |This error might occur if there are incorrect Domain Naming Service (DNS) records for DC. NLTEST can be used to force the computer to switch to another DC. See [Active Directory replication Event ID 2087: DNS lookup failure caused replication to fail](../../../windows-server/identity/active-directory-replication-event-id-2087.md). | |Selective authentication | Make sure the user isn't allowed to authenticate in the remote domain. | |Account migration | If old user accounts can't connect to the SQL Server, but newly created accounts can, this could be due to account migration. This is an AD issue. | @@ -82,9 +84,8 @@ The following table contains information about issues related to Kerberos authen | NTLM and Constrained Delegation | If the target is a file share, the delegation type of the mid-tier service account must be **Constrained-Any** and not **Constrained-Kerberos**. For more information, see [Login failed for user NT AUTHORITY\ANONYMOUS LOGON](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). | |Per-Service-SID | Is a security feature of SQL Server that limits local connections to use New Technology LAN Manager (NTLM) and not Kerberos as the authentication method. The service can make a single hop to another server using NTLM credentials, but it can't be delegated further without using the constrained delegation. | |Legacy Providers and Named Pipes | The legacy OLE DB Provider (SQLOLEDB) and ODBC Driver {SQL Server} that come with Windows don't support Kerberos over Named Pipes, only NTLM. Use a TCP connection to allow Kerberos. | -|Kernel mode authentication | Normally, the SPN must be on the App Pool account for web servers, but when you use Kernel Mode Authentication, authentication is performed in the kernel and the computer's HOST SPN is used. This setting might be used if the server hosts a number of different websites using the same host header URL, different App Pool accounts, and [Windows Authentication](/iis/configuration/system.webserver/security/authentication/). | +|Kernel Mode Authentication | Normally, the SPN must be on the App Pool account for web servers, but when you use Kernel Mode Authentication, authentication is performed in the kernel and the computer's HOST SPN is used. This setting might be used if the server hosts a number of different websites using the same host header URL, different App Pool accounts, and [Windows Authentication](/iis/configuration/system.webserver/security/authentication/). | |Delegating Credentials to Access or Excel | The Joint Engine Technology (JET) and Access Connectivity Engine (ACE) providers are similar to any of the file systems. You must use constrained delegation to allow SQL Server to read files located on another machine. In general, the ACE provider shouldn't be used in a linked server as this is explicitly not supported. The JET provider is deprecated and is available on 32-bit machines only. | -|SQL alias | A SQL [Server alias](network-related-or-instance-specific-error-occurred-while-establishing-connection.md) may cause an unexpected SPN to be generated. This will result in NTLM credentials if the SPN isn't found, or an SSPI failure, if it inadvertently matches the SPN of another server. | |Web site host header | If the web site has a host header name, the HOSTS SPN can't be used. An explicit HTTP SPN must be used. If the web site doesn't have a host header name, NTLM is used and it can't be delegated to a backend SQL Server or other service. | |Hosts file | The Hosts file overrides DNS lookups and might generate an unexpected SPN name. This will cause NTLM credentials to be used. If an unexpected IP address is in the Hosts file, the SPN generated might not match the backend pointed to. | |Delegating to a file share | Make sure to use constrained delegation in this scenario. | From 0e0cf8216c2a03090feec14725ed2316191cece5 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Wed, 6 Dec 2023 13:22:09 +0530 Subject: [PATCH 029/370] Added file and updated changes --- .../connect/explicit-spn-is-missing.md | 25 +++++++++++++++++++ .../local-security-subsystem-issues.md | 10 ++++---- 2 files changed, 30 insertions(+), 5 deletions(-) create mode 100644 support/sql/database-engine/connect/explicit-spn-is-missing.md diff --git a/support/sql/database-engine/connect/explicit-spn-is-missing.md b/support/sql/database-engine/connect/explicit-spn-is-missing.md new file mode 100644 index 0000000000..ed9b1cf902 --- /dev/null +++ b/support/sql/database-engine/connect/explicit-spn-is-missing.md @@ -0,0 +1,25 @@ +--- +title: Troubleshooting the explicit misplaced SPN issue +description: This article provides cause, symptoms, and workarounds for troubleshooting the explicit SPN is missing issue. +ms.date: 12/06/2023 +author: prmadhes-msft +ms.author: prmadhes +ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.custom: sap:Connection issues +--- + +# Explicit misplaced SPN error + +This article helps you to resolve the explicit misplaced SPN error. + +## Symptoms + +If the SPN you specify in the connection string exists on a service account that's not used by SQL Server, you will receive an "SSPI Context" error message. + +## Solution + +To resolve this error, follow these steps: + +1. Use `SETSPN -L domain\svcacct` to list SPNs on the SQL Server service account. + +1. Use `SETSPN -Q spnName` to find what account the SPN is on. You can move the SPN using `SETSPN -D` and `SETSPN -A` or choose an SPN already in the correct account. diff --git a/support/sql/database-engine/connect/local-security-subsystem-issues.md b/support/sql/database-engine/connect/local-security-subsystem-issues.md index b7441d468a..984e419b96 100644 --- a/support/sql/database-engine/connect/local-security-subsystem-issues.md +++ b/support/sql/database-engine/connect/local-security-subsystem-issues.md @@ -1,6 +1,6 @@ --- title: Troubleshooting local security subsystem errors -description: This article provides symptoms and resolution for the local security subsystem issues. +description: This article provides symptoms and resolution for the local security subsystem related errors. ms.date: 12/02/2023 author: prmadhes-msft ms.author: prmadhes @@ -8,7 +8,7 @@ ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp ms.custom: sap:Connection issues --- -# Local security subsystem issues +# Local security subsystem errors This article helps to resolve the problem related to local security subsystem issues. @@ -18,13 +18,13 @@ The driver shows the "The login is from an untrusted domain and cannot be used w The SQL Server Errorlog will have the following messages: -`SSPI handshake failed with error code 0x80090311, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure` +> "SSPI handshake failed with error code 0x80090311, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure." -`SSPI handshake failed with error code 0x80090304, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure.` +> "SSPI handshake failed with error code 0x80090304, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure." You might also see Kerberos errors in the System event log on the SQL Server machine for the same time range. The following error codes have specific meanings: -"Error -2146893039 (0x80090311): No authority could be contacted for authentication. This is an Active Directory issue." +> "Error -2146893039 (0x80090311): No authority could be contacted for authentication. This is an Active Directory issue." ## Resolution From ed18b3b8bd77cb94b9edb884b453303934db0d91 Mon Sep 17 00:00:00 2001 From: padmajayaraman Date: Wed, 6 Dec 2023 17:56:22 +0530 Subject: [PATCH 030/370] Added more scenarios to the overview file Updated the author information per Pradeep's suggestion Combining commits Added more scenarios to the main file Removed "access via group" topic. Added more scenarios and provided links. --- ...ccess-through-group-windows-permissions.md | 29 ---------- ...bad-server-name-connection-string-error.md | 6 +- .../cannot-generate-sspi-context-error.md | 1 - ...tent-authentication-connectivity-issues.md | 56 ++++++++++++++++--- .../connect/corrupt-user-profile.md | 6 +- .../determine-the-authentcation-type.md | 6 +- .../connect/disjoint-dns-namespace-error.md | 6 +- .../connect/domain-trust-error.md | 6 +- .../connect/expired-tickets-error.md | 6 +- .../connect/explicit-spn-is-missing.md | 6 +- .../linked-server-account-mapping-error.md | 8 +-- .../local-security-subsystem-issues.md | 10 ++-- ...s-connection-fail-no-windows-permission.md | 7 ++- .../connect/netbios-name-error.md | 6 +- .../connect/network-login-disallowed.md | 6 +- .../connect/sql-logins-are-not-enabled.md | 37 ++++++++++++ ...rong-database-name-in-connection-string.md | 6 +- ...-explicit-spn-account-connection-string.md | 6 +- 18 files changed, 132 insertions(+), 82 deletions(-) delete mode 100644 support/sql/database-engine/connect/access-through-group-windows-permissions.md create mode 100644 support/sql/database-engine/connect/sql-logins-are-not-enabled.md diff --git a/support/sql/database-engine/connect/access-through-group-windows-permissions.md b/support/sql/database-engine/connect/access-through-group-windows-permissions.md deleted file mode 100644 index b03ca4ccbc..0000000000 --- a/support/sql/database-engine/connect/access-through-group-windows-permissions.md +++ /dev/null @@ -1,29 +0,0 @@ ---- -title: Troubleshooting the access through group error -description: This article provides symptoms and resolution for the access via group error. -ms.date: 11/27/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp -ms.custom: sap:Connection issues ---- - -# Access via group error - -This article helps you to resolve the access using group Windows permission error. - -If the user doesn't belong to a local group used to grant access to the server, the provider should display the "Login failed for user 'database name/username'" error message. -The DBA can double-check the access by looking at the Security\Logins in SSMS. If it's a contained database, the DBA checks under database name. - -When you run the `xp_logininfo 'contoso/user1'` stored procedure, the following are likely to happen: - -- If you receive an error, SQL can't resolve the user name at all. It is likely that a name isn't present in the Active Directory (AD) or there might be issues connecting to the Domain Controller (DC). Try using another name to check if the issue is related to a specific account. - -- If you are connecting to cross-domain, the group must be in the SQL Server domain, and not the user domain so that its membership can be resolved. - -- If no rows are returned, then there is no group that provides access to the server. -- If one or more rows are returned, then the user belongs to a group that provides the access. - -## Resolution - -To be added diff --git a/support/sql/database-engine/connect/bad-server-name-connection-string-error.md b/support/sql/database-engine/connect/bad-server-name-connection-string-error.md index 45c717a260..45874f0127 100644 --- a/support/sql/database-engine/connect/bad-server-name-connection-string-error.md +++ b/support/sql/database-engine/connect/bad-server-name-connection-string-error.md @@ -2,9 +2,9 @@ title: Troubleshooting bad server name in connection string issue description: This article provides symptoms and resolution for troubleshooting the bad server name in connection string error. ms.date: 11/27/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +author: Malcolm-Stewart +ms.author: mastewa +ms.reviewer: jopilov, haiyingyu, prmadhes, v-jayaramanp ms.custom: sap:Connection issues --- diff --git a/support/sql/database-engine/connect/cannot-generate-sspi-context-error.md b/support/sql/database-engine/connect/cannot-generate-sspi-context-error.md index c7a7e11be5..01d1a8413e 100644 --- a/support/sql/database-engine/connect/cannot-generate-sspi-context-error.md +++ b/support/sql/database-engine/connect/cannot-generate-sspi-context-error.md @@ -102,7 +102,6 @@ Follow these steps to fix the error using KCM. |Duplicate SPN |You can encounter the situation when the same SPN is registered under different accounts in Active Directory. | 1. Select the **Fix** button, view the information in the **Warning** dialog box, and select **Yes** if you can add the missing SPN to Active Directory.
2. If your domain account has the necessary permissions to update Active Directory, the incorrect SPN will be deleted.
3. If your domain account doesn't have necessary permissions to update Active Directory, use the **Generate** or **Generate All** button to generate the necessary script that you can hand over to your Active Directory administrator to remove the duplicate SPNs. Once the SPNs are removed, rerun the KCM to verify that the SPN issues are resolved.
4. Additionally, you can use the following commands:
Use `SETSPN -Q spnName` to locate the SPN and its current accounts.
Use `SETSPN -D` to remove the SPN from the incorrect account.| |SPN on wrong account|You might receive this error if your SPN is configured on the wrong account in Active Directory.|1. Use `SETSPN -Q spnName` to locate the SPN and its current account.
2. Use `SETSPN -D` and `SETSPN -S` to migrate it to the correct account.| - > [!NOTE] > If the domain account that starts KCM doesn't have privileges to manipulate SPNs in Active Directory, you can use the corresponding **Generate** or **Generate All** button under the **SPN script** column to generate the required commands and work with your Active Directory administrator to fix the issues that are identified by KCM. diff --git a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md index 931694dc7a..4550326223 100644 --- a/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md +++ b/support/sql/database-engine/connect/consistent-authentication-connectivity-issues.md @@ -1,10 +1,10 @@ --- title: Introduction to consistent authentication issues description: This article introduces to consistent authentication issues, the types of error messages, and workarounds to troubleshoot various issues. -ms.date: 12/04/2023 -author: prmadhes-msft -ms.author: prmadhes -ms.reviewer: jopilov, haiyingyu, mastewa, v-jayaramanp +ms.date: 12/07/2023 +author: Malcolm-Stewart +ms.author: mastewa +ms.reviewer: jopilov, haiyingyu, prmadhes v-jayaramanp ms.custom: sap:Connection issues --- @@ -26,7 +26,7 @@ It's also important to understand the category of the error because the troubles ## Directory services specific issues -Refers to the Active Directory errors. If the SQL Server ErrorLog file contains both or either of the following messages, then this is an Active Directory (AD) issue. This might happen if the domain controller (DC) can't be contacted by Windows on the SQL Server computer or the local security service (LSASS) is having a problem. +Refers to the Active Directory errors. If the SQL Server error log file contains both or either of the following messages, then this is an Active Directory (AD) issue. This might happen if the domain controller (DC) can't be contacted by Windows on the SQL Server computer or the local security service (LSASS) is having a problem. > Error -2146893039 (0x80090311): No authority could be contacted for authentication. > Error -2146893052 (0x80090304): The Local Security Authority cannot be contacted. @@ -41,11 +41,12 @@ This section lists the possible error messages and their possible causes. |Error message |Possible causes | |---------|---------| -|`Login failed for user '(null)'`|The password you provided might be incorrect or the user name might not be valid or it might be a case where SQL logins aren't enabled. For more information, see [You're trying to use SQL Server Authentication, but the SQL Server instance is configured for Windows Authentication mode](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error#login-failed-for-user-(null)).| +|`Login failed for user 'userx'. Reason: Password did not match that for the login provided.`|This error might occur if a bad password is used. For more information, see [Login failed for user '' or login failed for user '\'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error)| +|Invalid username|For more information, see [Login failed for user '' or login failed for user '\'](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error).| |`SQL Server does not exist or access denied.` | [Named Pipes connections](named-pipes-connection-fail-no-windows-permission.md) fail because the user doesn't have permission to log into Windows. | |`Cannot open database "test" requested by the login. The login failed.`|The database might be offline, or the permissions might not be sufficient. For more information, see [Database offline in MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error).| |`A transport-level error has occurred when sending the request to the server.`|Check if the [linked server account mapping](linked-server-account-mapping-error.md) is correct. For more information, see [sp_addlinkedsrvlogin](/sql/relational-databases/system-stored-procedures/sp-addlinkedsrvlogin-transact-sql).| -|`SSPI (Security Support Provider Interface) Context.`|Check if the SPN is on the wrong account.| +|`SSPI (Security Support Provider Interface) Context.`|Check if the [SPN is on the wrong account](cannot-generate-sspi-context-error.md).| |`Login failed for user 'username'.` | This can happen if the [proxy account](../../integration-services/ssis-package-doesnt-run-when-called-job-step.md) isn't properly authenticated. | |`Login Failed for user: 'NT AUTHORITY\ANONYMOUS LOGON'`|This error might occur if the [SPN is missing, SPN is duplicated, or the SPN is on the wrong account](cannot-generate-sspi-context-error.md).| |`Login failed for user 'username'.`
`Login failed for user 'database\username'`
| Check if there is a [bad server name in connection string](bad-server-name-connection-string-error.md). Also, check if the [user doesn't belong to a local group](access-through-group-windows-permissions.md) that's used to grant access to the server. For more causes, see [NT AUTHORITY\ANONYMOUS LOGON](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). | @@ -57,6 +58,47 @@ This section lists the possible error messages and their possible causes. For detailed information, see [MSSQLSERVER_18456](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). +## Issues specific to various aspects of SQL Server + +The following table lists some scenarios that are related to aspects as database, logon account permissions, and linked servers. + +|Possible cause |More information | +|---------|---------| +|Database is offline | In many cases, this error is logged right after the server has restarted or after a cluster has failed over. The error doesn't affect as the server starts accepting logins before all databases are online. If the issue persists, and you can't bring the database online in SQL Server Management Studio, then you can contact the SQL Core team to perform further troubleshooting. For detailed information regarding the error, see [Login failed for user '' or login failed for user '\'.](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). | +|Linked Server Account Mapping|This scenario is related to [linked servers](linked-server-account-mapping-error.md).| +|Database permissions | For detailed information regarding the error, see [Login failed for user '' or login failed for user '\'.](/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error). | +|Proxy account | An SSIS job run by SQL Agent might need permissions other than the SQL Agent service account can provide. For more information, see [SSIS package does not run when called from a SQL Server Agent job step.](../../integration-services/ssis-package-doesnt-run-when-called-job-step.md) | +|Bad metadata | A view or stored procedure receives login failures on a linked server whereas a distributed `SELECT` statement copied from them doesn't. This is likely if the View was created and then the linked server was recreated, or a remote table was altered without rebuilding the View. | + +## Issues related to Connection String + +The following table lists the possible cause and further information related to connection string issues. + +|Possible cause |More information | +|---------|---------| +|Bad server name in connection string | This scenario might occur if the specified server name is incorrect or can't be found. For more information, see [bad server name in connection string](bad-server-name-connection-string-error.md). | +|Wrong database name in connection string | This scenario might occur if the [database name is incorrect](wrong-database-name-in-connection-string.md). Check if it spelled correctly. | +|[Wrong explicit SPN account](wrong-explicit-spn-account-connection-string.md), explicit SPN is missing | For more information on these scenarios, see [Cannot generate SSPI context error](cannot-generate-sspi-context-error.md). | +|Explicit misplaced SPN | If the SPN you specify in the connection string exists on a service account that's not used by SQL Server, you will get an SSPI Context error message. | +|Explicit SPN is duplicated | If you recently changed the SQL Server service account from LocalSystem to a domain account, it is easy to forget to remove the SPN from the computer and just create a new SPN on the new service account. This will generate an SSPI Context error.
**Note**: Use `-QF` to search the entire forest. | + +## Windows permissions or Policy settings related issues + +The following table provides further information for each of the AD and DC issues: + +|Possible cause |More information | +|---------|---------| +|Access via group | If the user doesn't belong to a local group used to grant access to the server, the provider should display the "Login failed for user 'database name/username'" error message. The DBA can double-check the access by looking at the Security\Logins in SSMS. If it's a contained database, the DBA checks under database name.
When you run the `xp_logininfo 'contoso/user1'` stored procedure, the following might happen: