I have a HADR cluster running on Windows 2012 R2 and SQL Server 2016 with Availability Groups. The services were running under a high level domain account. Due to internal audits, I have been asked to change the user name they are running under to a lower level account.

So I have a 2 node cluster (SERVER1\TEST1 and SERVER2\TEST1) and a listener (DB1). Before I changed the account name I could connect to either SERVER1\TEST1, SERVER2\TEST1 or DB1 from SSMS. Since I changed the account that SQL Server and SQL Server Agent are running as, I can no longer connect to DB1. I get

" The target principal name is incorrect. Cannot generate SSPI context. (Microsoft SQL Server, Error: 0)".

The eventvwr is clean, and the sql error log has "Started listening on virtual network name 'DB1'. No user action is required." Connecting to SERVER1\TEST1 or SERVER2\TEST1 works fine/

What do I need to look at? What is the minimum security access the new user should have?

  • Have you change your SPN for the listener ? The listener should be listed when you type "SetSpn -L serviceAccount" – Dominique Boucher Jun 16 '20 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.