I know there are many blog posts similar to this, and I have read them all and as far as I can tell things are setup correctly, but I still get invalid username or password when kicking off the copy job.  My setup and procedure is below:

  1. Server A hosts source database in Domain A
  2. Server B and C are in a cluster in Domain B.  I am log shipping to both of these servers to prep for eventual migration and adding into an Availability Group.
  3. SQL Server agent accounts are created in AD on both domains as this: Server A:    A\sqlagent - Server B and C:  B\sqlagent
  4. As above shows all 3 servers have the same exact username and password with the exception of the domains being different before each one
  5. Log backups are placed locally on Server A, shared out with full permissions given to the A\sqlagent account.

As far as I am aware, that is all that is needed from a SQL perspective to get cross-domain LS working, however whenever the copy job runs, it fails for "invalid username and password".  We have a VPN tunnel between the 2 domains, however no Trust relationship exists. 

I am able to path out to the backup share on Server A from Server B and C using the admin login to manually pull the backups over if I want, so I know the tunnel is properly working.

There is mention of using a local network account Here when doing cross domain log shipping instead of a domain login, but I am not sure how to create and use that.  Is that created as a different type of account in Active Directory? I already have the A\sqlagent and B\sqlagent created in AD. Does the account need to be created differently to be a local network account? I don't have much experience with AD and accounts.

Is this something that might be caused by network pass-through security?  unfortunately I am not finding any helpful information on setting up network passthrough security online. As far as I am aware, this should happen independently of SQL Server, but if anyone has any info about what might be causing this issue, it would be most appreciated.

  • It should be working. Please make sure shared backup directory is accessible from both servers and you are able to connect database from each other's machine. Please share error you are facing. Jul 10 '19 at 13:23
  • Marking your third point "SQL Server agent accounts are created in AD on both domains as this: Server A: A\sqlagent - Server B and C: B\sqlagent". this may be the reason your log shipping is failing. I hope Both of the domain (A&B) are in a trusted relationship. So use either A/sqlagent or B/sqlagent. Or lack of permission or trusted relationship between domain causing the problem. Jul 10 '19 at 14:59
  • Did you recently change the password for B\sqlagent? If so, did you restart the SQL Agent after making that change?
    – HandyD
    Jul 11 '19 at 6:39
  • 1
    @RajeshRanjan Unfortunately my system administrators didn't want to setup a domain trust, but I was able to fix this without one, but I am not 100% sure what did it. I created a local account on Server A with the same username and password, and also created the same account on ServerB, which I used to run the sql server agent service. Both Server A and Server C were left using the domain account to run SQL Agent. I think the key was the local account created on Server A, as Server C was not changed, and after applying the change to Server A, both B and C could pull the log files normally.
    – DBA Greg14
    Jul 12 '19 at 13:35
  • @Gloeffler Great to know you found some way around to fix it. And thanks for sharing. Jul 12 '19 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.