Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an AD group XYZ that I have added to SQL Server security with data_reader permissions.

The XYZ group has around 10 users in there who are successfully able to access the SQL Server database. I recently added a new user to this group (at AD level), but this person is not able to access SQL Server (through Mgmt Studio) and he's getting the error below

Login failed for user. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors.

Error: 18456, Severity: 14, State: 11.

I have already verified AD permissions are setup properly, user has restarted his machine, he is not part of any group that has DENY access and the SQL Server XYZ group has been removed and readded to the SQL Server instance in Mgmt Studio and server has been restarted.

Any ideas on how to proceed further?


share|improve this question

migrated from Mar 26 '13 at 6:15

This question came from our site for professional and enthusiast programmers.

Can you have the new user try from another computer and see if that's the issue? Wondering if it's an AD setup issue, since your other users are working. – Jason Whitish Mar 25 '13 at 22:23
Has the user logged off and logged on since the group assignment? If not, the user needs to do that for the group assignment to take effect. See my answer here. – Jon Seigel Mar 26 '13 at 13:26
I had the user restart his laptop and even tried accessing from another computer but no luck.. – Amam Mar 29 '13 at 14:30
Checkout these 2 threads would be help you:… Thanks – user22733 Apr 18 '13 at 11:25

States 11 & 12 mean that SQL Server was able to authenticate you, but weren't able to validate with the underlying Windows permissions. It could be that the Windows login has no profile or that permissions could not be checked due to UAC. Try running SSMS as administrator and/or disabling UAC. Another reason could be that the domain controller could not be reached.

Refer to to the below link for more information on Error states.

share|improve this answer

Check the account has the connect endpoint permission. We remove them from public then grant them specifically to each account.

share|improve this answer

We encountered the same issue with a domain user account, however the solution that worked for us was that the login's default database was set to a database the login didn't have access to. I modified that to a database the login did have permissions to, and then login succeeded.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.