One of my DBAs is trying to look at the database properties of a database by right clicking and selecting properties and is getting the following error:

Cannot show requested dialog. (SqlMgmt)

An exception occurred while executing a Transact-SQL statement or batch. (Microsoft.SqlServer.ConnectionInfo)

Cannot execute as the database principal because the principal "guest" does not exist, this type of principal cannot be impersonated, or you do not have permission. (Microsoft SQL Server, Error: 15517)

Points of interest:

  • The guest account has been disabled (no connect permission)
  • The DBA is a member of db_owner on the database, but not sysadmin on the instance.
  • He has this permission through a role, but does not have a user directly in the instance let alone the database.
  • This is a windows authenticated login.
  • I tried creating a SQL Id and testing but couldn't replicate.
  • The version of the instance is SQL Server 2016 (SP1) - 13.0.4001.0 (X64)
  • On Windows Server 2012 R2 Standard 6.3

What I don't understand is why he would be impersonating anything since he is a member of db_owner, particularly when trying to open the properties dialog.

I've checked here: Cannot execute as the database principal because the principal “guest” does not exist but the service account running the named account has sysadmin access so this shouldn't be a problem.

  • Ken, I don't have time to type up an answer now, but I can say that the error is not saying necessarily that impersonation is being attempted. It is listing 3 mutually exclusive reasons why the error is happening. Most likely the DBA is in multiple Windows Groups and is mapping to one that does not have access (such as connect any database) or has an explicit DENY. The only reason that it would be trying to use the guest account is due to not having a login token that either has CONNECT permission, is sysadmin, or has a User in that DB with the same SID. I can add more later.. May 4, 2018 at 0:46
  • You are definitely right. There are two AD groups involved, but both have CONNECT SQL at the server level, and CONNECT at the DB level. May 4, 2018 at 2:20
  • Is this happening only to one DBA but others can do the same thing (for the same DB) successfully? Can this DBA view the properties of any other DB successfully? What version of SSMS is this DBA using (since that is where the error is happening)? I used SQL Profiler 17.6 to view what SSMS 17.6 was doing, and it was connecting to not only the requested DB, but also to master, tempdb, and even msdb. Does the DBA have access to all 3? I would expect the first 2 would have to be yes, but also msdb? Error doesn't say which DB is the issue. Can this DBA use this DB via SQLCMD.EXE? May 4, 2018 at 3:52
  • Is it possible that along with the two AD groups, that this DBA has an individual Windows Login mapped to this instance that has more restrictive permissions? May 4, 2018 at 4:18
  • @SolomonRutzky I was going to mention I did check and both AD groups he has access too have access to the DB and nothing else. I'm going to try to run an experiment in a little bit with an ID that has similar permissions. I'll check his SSMS but I would guess it's 16.2 at best. I'd also guess the rest of his team are having the same problem but haven't confirmed. May 4, 2018 at 12:13


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy