1

When I installed SQL Server 2017 Standard I installed it under my domain account and added it to the sysadmin role. I have then added the Domain Admins AD group to SQL and have deleted my domain account from SQL Server.

Now when I try to login my login fails with error 18456. All other accounts of the Domain Admins group are able to login.

I ran the following query and it says my domain account is type= user, privilege= admin, mapped login name=domain account and permissions path=DOMAIN\Domain Admins

Exec xp_logininfo 'DOMAIN\USERACCOUNT', 'all'

Looking at the server logs it says:

Reason: Token-based server access validation failed with an infrastructure error. Login lacks Connect SQL permission. [CLIENT: <local machine>]

Improve this question
7
  • 1
    is the error the same to all logins that are members of the Domain Admins AD group or just yours?
    – Ronaldo
    Jul 25, 2020 at 22:15
  • Just mine. All other accounts can login. I even tested by adding a test account to the Domain Admins group and then tried logging in which worked.
    – MFKDGAF
    Jul 26, 2020 at 15:54
  • Does the failure occur when connecting from a remote server and from a local elevated session?
    – David Browne - Microsoft
    Jul 26, 2020 at 19:40
  • @DavidBrowne-Microsoft No, the error doesn't occur from remote server or elevated session. I didn't think to try either of those. It is only happening when locally on the server and running SSMS regularly (not as administrator)
    – MFKDGAF
    Jul 26, 2020 at 21:12
  • Then it’s UAC. Normal Windows security strips the admin group from your token when you aren’t running an elevated process.
    – David Browne - Microsoft
    Jul 26, 2020 at 21:39

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.