Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

I have an AD group XYZ that I have added to SQL Server security with data_reader permissions.

The XYZ group has around 10 users in there who are successfully able to access the SQL Server database. I recently added a new user to this group (at AD level), but this person is not able to access SQL Server (through Mgmt Studio) and he's getting the error below

Login failed for user. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors.

Error: 18456, Severity: 14, State: 11.

I have already verified AD permissions are setup properly, user has restarted his machine, he is not part of any group that has DENY access and the SQL Server XYZ group has been removed and readded to the SQL Server instance in Mgmt Studio and server has been restarted.

Any ideas on how to proceed further?

Thanks!

share|improve this question

migrated from stackoverflow.com Mar 26 '13 at 6:15

This question came from our site for professional and enthusiast programmers.

    
Can you have the new user try from another computer and see if that's the issue? Wondering if it's an AD setup issue, since your other users are working. –  Jason Whitish Mar 25 '13 at 22:23
    
    
Has the user logged off and logged on since the group assignment? If not, the user needs to do that for the group assignment to take effect. See my answer here. –  Jon Seigel Mar 26 '13 at 13:26
    
I had the user restart his laptop and even tried accessing from another computer but no luck.. –  Amam Mar 29 '13 at 14:30
    
Checkout these 2 threads would be help you: social.msdn.microsoft.com/Forums/en-US/sqlgetstarted/thread/… blogs.msdn.com/b/sql_protocols/archive/2006/02/21/536201.aspx Thanks –  user22733 Apr 18 '13 at 11:25

1 Answer 1

States 11 & 12 mean that SQL Server was able to authenticate you, but weren't able to validate with the underlying Windows permissions. It could be that the Windows login has no profile or that permissions could not be checked due to UAC. Try running SSMS as administrator and/or disabling UAC. Another reason could be that the domain controller could not be reached.

Refer to to the below link for more information on Error states. http://sqlblog.com/blogs/aaron_bertrand/archive/2011/01/14/sql-server-v-next-denali-additional-states-for-error-18456.aspx

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.