I have a SQL Instance that was previously on an old domain within my company and was moved to a new domain prior to my time as DBA. After the move, none of the logins / AD Groups from the old domain were removed. I recently started removing the old domain logins and since then users are unable to connect. The users are part of the new domain and are members of an AD Group that has appropriate permissions.

I'm at a loss as to why the users can't connect and my next move is to nuke the existing AD Group and rebuild it to try again, but I'd rather not do that just on the off chance that's the problem.

As always, any help is greatly appreciated.

  • I would start by verifying the domain of the users in CMD along with the domain of the SQL Server. From there, I would begin looking at the SQL Server Audit logs for failed connections. Are the users even reaching the DB? Find where the point of failure is then refer to that point and analyze the logs for details. Afterwards we can probably toss a few helpful bits at you. Aug 1, 2018 at 17:25
  • This stack link has a script to view the permissions of AD users, I'd try that in a test environment and then run on your box to see if this helps analyze why too. dba.stackexchange.com/a/173959/112253 Aug 1, 2018 at 17:27
  • Thanks for the help. I verified the domain of the SQL Server and the users. I found in the error log a message "Login failed for user... Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors. Error 18456, Severity 14, State 11". I also used the script in the link you provided and found some newer employees are showing connection permissions via the new AD group, but older employees that were originally part of the old domain are returning no connection permissions, even though they're part of the same AD Group.
    – JonDBA5420
    Aug 1, 2018 at 18:23
  • I would try this article next, it should give you more of a basis to go off of. blog.sqlauthority.com/2015/08/19/… Aug 2, 2018 at 13:18


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.