Our company has a domain MAIN_DOMAIN
and I log into my Windows laptop as MAIN_DOMAIN\my.name
. When I run SSMS on my laptop I can connect to both Server1Server1
and Server2Server2
using Windows authentication.
This is how the linked server is configured on Server1Server1
:
On Server1Server1
the MSSQLSERVER service (sqlservr.exe) runs under user called NT Service\MSSQLSERVER
.
On Server2Server2
the MSSQLSERVER service (sqlservr.exe) runs under user called NT Service\MSSQLSERVER
.
Here is output of setspn -l
. I get the same output when I run it on server1
or server2
:
C:\Windows\system32>setspn -l SERVER2
Registered ServicePrincipalNames for CN=SERVER2,OU=Azure Resources,OU=Corporate,DC=other_domain,DC=com,DC=au:
MSSQLSvc/SERVER2.other_domain.com.au:1433
MSSQLSvc/SERVER2.other_domain.com.au
WSMAN/SERVER2
WSMAN/SERVER2.other_domain.com.au
TERMSRV/SERVER2
TERMSRV/SERVER2.other_domain.com.au
RestrictedKrbHost/SERVER2
HOST/SERVER2
RestrictedKrbHost/SERVER2.other_domain.com.au
HOST/SERVER2.other_domain.com.au
C:\Windows\system32>setspn -l SERVER1
Registered ServicePrincipalNames for CN=SERVER1,OU=Azure Resources,OU=Corporate,DC=other_domain,DC=com,DC=au:
MSSQLSvc/SERVER1.other_domain.com.au:1433
MSSQLSvc/SERVER1.other_domain.com.au
Microsoft Virtual Console Service/SERVER1.other_domain.com.au
Microsoft Virtual Console Service/SERVER1
Microsoft Virtual System Migration Service/SERVER1.other_domain.com.au
Microsoft Virtual System Migration Service/SERVER1
Hyper-V Replica Service/SERVER1.other_domain.com.au
Hyper-V Replica Service/SERVER1
WSMAN/SERVER1
WSMAN/SERVER1.other_domain.com.au
TERMSRV/SERVER1.other_domain.com.au
TERMSRV/SERVER1
RestrictedKrbHost/SERVER1
HOST/SERVER1
RestrictedKrbHost/SERVER1.other_domain.com.au
HOST/SERVER1.other_domain.com.au
Unfortunately, I don't understand what it means. The only thing that I understand here is that MAIN_DOMAIN
is not mentioned anywhere.
A different user can run the query involving linked server without problems.
He logs into Server1Server1
using Remote Desktop and using other_domain\his.name
. He runs SSMS on that Server1Server1
and connects to SQL Server using Windows authentication.
His login on Server1Server1
has all permissions as well: