We are getting the above error on a SQL 2012 server running Windows Server 2008R2 when connecting using an application and a service account. The server also has Config Manager database and GAP policy applied
The login will work if the user is sysadmin (but the application won't)
Of course we have looked at Aaron Bertrand's post on 18456 errors, which states:
States 11 & 12 mean that SQL Server was able to authenticate you, but weren't able to validate with the underlying Windows permissions. It could be that the Windows login has no profile or that permissions could not be checked due to UAC. Try running SSMS as administrator and/or disabling UAC. Another reason could be that the domain controller could not be reached. You may need to resort to re-creating the login (see this post from Simon Sabin).
So we have ensured that we have a profile on the servers by logging on with the service account.
We have run the application as administrator
We have confirmed connectivity to the DC
We have removed and re-created the login
We have confirmed there are no DENYs for the user or group
We have confirmed that the user and also the public role has connect permissions to the ConfigMgrEndpoint as well as SQL
What have we missed?
What else do we need to do to resolve this issue?