Skip to main content
Question Protected by CommunityBot
Added output of setspn
Source Link
Vladimir Baranov
  • 4.7k
  • 4
  • 26
  • 42

Our company has a domain MAIN_DOMAIN and I log into my Windows laptop as MAIN_DOMAIN\my.name. When I run SSMS on my laptop I can connect to both Server1Server1 and Server2Server2 using Windows authentication.

This is how the linked server is configured on Server1Server1:

On Server1Server1 the MSSQLSERVER service (sqlservr.exe) runs under user called NT Service\MSSQLSERVER.

On Server2Server2 the MSSQLSERVER service (sqlservr.exe) runs under user called NT Service\MSSQLSERVER.

Here is output of setspn -l. I get the same output when I run it on server1 or server2:

C:\Windows\system32>setspn -l SERVER2
Registered ServicePrincipalNames for CN=SERVER2,OU=Azure Resources,OU=Corporate,DC=other_domain,DC=com,DC=au:
        MSSQLSvc/SERVER2.other_domain.com.au:1433
        MSSQLSvc/SERVER2.other_domain.com.au
        WSMAN/SERVER2
        WSMAN/SERVER2.other_domain.com.au
        TERMSRV/SERVER2
        TERMSRV/SERVER2.other_domain.com.au
        RestrictedKrbHost/SERVER2
        HOST/SERVER2
        RestrictedKrbHost/SERVER2.other_domain.com.au
        HOST/SERVER2.other_domain.com.au

C:\Windows\system32>setspn -l SERVER1
Registered ServicePrincipalNames for CN=SERVER1,OU=Azure Resources,OU=Corporate,DC=other_domain,DC=com,DC=au:
        MSSQLSvc/SERVER1.other_domain.com.au:1433
        MSSQLSvc/SERVER1.other_domain.com.au
        Microsoft Virtual Console Service/SERVER1.other_domain.com.au
        Microsoft Virtual Console Service/SERVER1
        Microsoft Virtual System Migration Service/SERVER1.other_domain.com.au
        Microsoft Virtual System Migration Service/SERVER1
        Hyper-V Replica Service/SERVER1.other_domain.com.au
        Hyper-V Replica Service/SERVER1
        WSMAN/SERVER1
        WSMAN/SERVER1.other_domain.com.au
        TERMSRV/SERVER1.other_domain.com.au
        TERMSRV/SERVER1
        RestrictedKrbHost/SERVER1
        HOST/SERVER1
        RestrictedKrbHost/SERVER1.other_domain.com.au
        HOST/SERVER1.other_domain.com.au

Unfortunately, I don't understand what it means. The only thing that I understand here is that MAIN_DOMAIN is not mentioned anywhere.


A different user can run the query involving linked server without problems.

He logs into Server1Server1 using Remote Desktop and using other_domain\his.name. He runs SSMS on that Server1Server1 and connects to SQL Server using Windows authentication.

His login on Server1Server1 has all permissions as well:

Our company has a domain MAIN_DOMAIN and I log into my Windows laptop as MAIN_DOMAIN\my.name. When I run SSMS on my laptop I can connect to both Server1 and Server2 using Windows authentication.

This is how the linked server is configured on Server1:

On Server1 the MSSQLSERVER service (sqlservr.exe) runs under user called NT Service\MSSQLSERVER.

On Server2 the MSSQLSERVER service (sqlservr.exe) runs under user called NT Service\MSSQLSERVER.

A different user can run the query involving linked server without problems.

He logs into Server1 using Remote Desktop and using other_domain\his.name. He runs SSMS on that Server1 and connects to SQL Server using Windows authentication.

His login on Server1 has all permissions as well:

Our company has a domain MAIN_DOMAIN and I log into my Windows laptop as MAIN_DOMAIN\my.name. When I run SSMS on my laptop I can connect to both Server1 and Server2 using Windows authentication.

This is how the linked server is configured on Server1:

On Server1 the MSSQLSERVER service (sqlservr.exe) runs under user called NT Service\MSSQLSERVER.

On Server2 the MSSQLSERVER service (sqlservr.exe) runs under user called NT Service\MSSQLSERVER.

Here is output of setspn -l. I get the same output when I run it on server1 or server2:

C:\Windows\system32>setspn -l SERVER2
Registered ServicePrincipalNames for CN=SERVER2,OU=Azure Resources,OU=Corporate,DC=other_domain,DC=com,DC=au:
        MSSQLSvc/SERVER2.other_domain.com.au:1433
        MSSQLSvc/SERVER2.other_domain.com.au
        WSMAN/SERVER2
        WSMAN/SERVER2.other_domain.com.au
        TERMSRV/SERVER2
        TERMSRV/SERVER2.other_domain.com.au
        RestrictedKrbHost/SERVER2
        HOST/SERVER2
        RestrictedKrbHost/SERVER2.other_domain.com.au
        HOST/SERVER2.other_domain.com.au

C:\Windows\system32>setspn -l SERVER1
Registered ServicePrincipalNames for CN=SERVER1,OU=Azure Resources,OU=Corporate,DC=other_domain,DC=com,DC=au:
        MSSQLSvc/SERVER1.other_domain.com.au:1433
        MSSQLSvc/SERVER1.other_domain.com.au
        Microsoft Virtual Console Service/SERVER1.other_domain.com.au
        Microsoft Virtual Console Service/SERVER1
        Microsoft Virtual System Migration Service/SERVER1.other_domain.com.au
        Microsoft Virtual System Migration Service/SERVER1
        Hyper-V Replica Service/SERVER1.other_domain.com.au
        Hyper-V Replica Service/SERVER1
        WSMAN/SERVER1
        WSMAN/SERVER1.other_domain.com.au
        TERMSRV/SERVER1.other_domain.com.au
        TERMSRV/SERVER1
        RestrictedKrbHost/SERVER1
        HOST/SERVER1
        RestrictedKrbHost/SERVER1.other_domain.com.au
        HOST/SERVER1.other_domain.com.au

Unfortunately, I don't understand what it means. The only thing that I understand here is that MAIN_DOMAIN is not mentioned anywhere.


A different user can run the query involving linked server without problems.

He logs into Server1 using Remote Desktop and using other_domain\his.name. He runs SSMS on that Server1 and connects to SQL Server using Windows authentication.

His login on Server1 has all permissions as well:

edited title
Link
Vladimir Baranov
  • 4.7k
  • 4
  • 26
  • 42

Some users fail to query linked server with "Login failed for user NT AUTHORITY\ANONYMOUS LOGON" when querying linked server

added 3 characters in body
Source Link
Vladimir Baranov
  • 4.7k
  • 4
  • 26
  • 42

But, there is another user who can run this query withwithout problems.

But, there is another user who can run this query with problems.

But, there is another user who can run this query without problems.

Source Link
Vladimir Baranov
  • 4.7k
  • 4
  • 26
  • 42
Loading