When I installed SQL Server 2017 Standard I installed it under my domain account and added it to the sysadmin role. I have then added the Domain Admins AD group to SQL and have deleted my domain account from SQL Server.

Now when I try to login my login fails with error 18456. All other accounts of the Domain Admins group are able to login.

I ran the following query and it says my domain account is type= user, privilege= admin, mapped login name=domain account and permissions path=DOMAIN\Domain Admins

Exec xp_logininfo 'DOMAIN\USERACCOUNT', 'all'

Looking at the server logs it says:

Reason: Token-based server access validation failed with an infrastructure error. Login lacks Connect SQL permission. [CLIENT: <local machine>]

  • 1
    is the error the same to all logins that are members of the Domain Admins AD group or just yours?
    – Ronaldo
    Jul 25 '20 at 22:15
  • Just mine. All other accounts can login. I even tested by adding a test account to the Domain Admins group and then tried logging in which worked.
    Jul 26 '20 at 15:54
  • Does the failure occur when connecting from a remote server and from a local elevated session? Jul 26 '20 at 19:40
  • @DavidBrowne-Microsoft No, the error doesn't occur from remote server or elevated session. I didn't think to try either of those. It is only happening when locally on the server and running SSMS regularly (not as administrator)
    Jul 26 '20 at 21:12
  • Then it’s UAC. Normal Windows security strips the admin group from your token when you aren’t running an elevated process. Jul 26 '20 at 21:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.