I have a HADR cluster running on Windows 2012 R2 and SQL Server 2016 with Availability Groups. The services were running under a high level domain account. Due to internal audits, I have been asked to change the user name they are running under to a lower level account.
So I have a 2 node cluster (SERVER1\TEST1 and SERVER2\TEST1) and a listener (DB1). Before I changed the account name I could connect to either SERVER1\TEST1, SERVER2\TEST1 or DB1 from SSMS. Since I changed the account that SQL Server and SQL Server Agent are running as, I can no longer connect to DB1. I get
" The target principal name is incorrect. Cannot generate SSPI context. (Microsoft SQL Server, Error: 0)".
The eventvwr is clean, and the sql error log has "Started listening on virtual network name 'DB1'. No user action is required." Connecting to SERVER1\TEST1 or SERVER2\TEST1 works fine/
What do I need to look at? What is the minimum security access the new user should have?