1

I know that this issue has been discussed elsewhere and I already read it. Our problem is that this occurs only once a day (roughly), the rest of time everything works fine.

SERVER RS

  • Windows Server 2008 R2 STD
  • Microsoft SQL Server Standard Edition (64-bit) 10.0.6241.0
  • SQL Server runnuing under SQLSVC domain account
  • Computer account in AD delegation tab has set Do not trust this computer for delegation
  • It has linked server to DB configured using logins current security context.

SERVER DB

  • Windows Server 2008 Ent
  • Microsoft SQL Server Enterprise Edition (64-bit) 9.00.5000.00
  • SQL Server runnuing under SQLSVC domain account
  • IP: xx.yy.1.30
  • Computer account in AD delegation tab has set Trust this computer for delegation to any service (Kerberos only)
  • It has linked server configured to RS using logins current security context (no problem there).

On RS server there is a job which runs many steps one of which is procedure on DB server.

Roughly once a day, we have this error.

The error is only logged in RS server as

Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. Reason: Token-based server access
validation failed with an infrastructure error. Check for previous
errors. [CLIENT: xx.yy.1.30] Date       31.05.2017 16:09:02 Log     SQL
Server (Current - 31.05.2017 16:09:00)

and second Source       Logon

Message Error: 18456, Severity: 14, State: 11.

SPNS registred for SQLSVC account is as follows

MSSQLSvc/RS.domain.local:1433
MSSQLSvc/RS.domain.local
MSSQLSvc/DB.domain.local:1433
MSSQLSvc/DB:1433

Delegation on SQLSVC account (in AD) is as follows Trust this user for delegation to specified services only - Use Kerberos only

MSSQLSvc DB.domain.local 1433
MSSQLSvc RS.domain.local
MSSQLSvc RS.domain.local 1433

** here is missing the DB.domain.local (wo port) but in this scenario we are not using double hop.

When the error happens, there is no word in system logs, only SQL log on RS server.

I went and enabled logging Kerberos messages on RS server, with no log information in the moment of error.

I also asked infrastructure guys for help, they say there is also no error logged on AD controllers in timeframe of error.

I would realy apriciated any suggestion on what to do next, because the error happens randomly roughly once a day. Also if you can comment on settings concerning delegation tab in AD computer account (I cant make changes to AD so any change must be justified).

Thank you.

  • Your error points to a transient kerberos issue. Beyond that basics (like verifying that all system clocks are relatively in-sync) there isn't much else you can do. You'll need to work with the infrastructure guys to figure this out. – StrayCatDBA Jun 6 '17 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.