7

I have an AD group XYZ that I have added to SQL Server security with data_reader permissions.

The XYZ group has around 10 users in there who are successfully able to access the SQL Server database. I recently added a new user to this group (at AD level), but this person is not able to access SQL Server (through Mgmt Studio) and he's getting the error below

Login failed for user. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors.

Error: 18456, Severity: 14, State: 11.

I have already verified AD permissions are setup properly, user has restarted his machine, he is not part of any group that has DENY access and the SQL Server XYZ group has been removed and readded to the SQL Server instance in Mgmt Studio and server has been restarted.

Any ideas on how to proceed further?

Thanks!

Improve this question
5

6 Answers 6

Reset to default
7

States 11 & 12 mean that SQL Server was able to authenticate you, but weren't able to validate with the underlying Windows permissions. It could be that the Windows login has no profile or that permissions could not be checked due to UAC. Try running SSMS as administrator and/or disabling UAC. Another reason could be that the domain controller could not be reached.

Refer to to the below link for more information on Error states.

Improve this answer
1

We encountered the same issue with a domain user account, however the solution that worked for us was that the login's default database was set to a database the login didn't have access to. I modified that to a database the login did have permissions to, and then login succeeded.

Improve this answer
0

Check the account has the connect endpoint permission. We remove them from public then grant them specifically to each account.

Improve this answer
0

Was getting the state 11 error with a Windows authentication account. I deleted the account from the Security\Logins and re-added. Exact same properties. Then the login succeeded.

Improve this answer
0

In some cases the domain user is part of one or more domain groups. If any of the domain group is disabled/denied access to SQL Server, this kind of error will be thrown. As SQL Server is able to authenticate with Login, but it is not able to complete the login process as the user group is denied access to SQL Server.

The below query will show all the domain group membership of the given user.

EXEC XP_LOGININFO 'DOMAIN\username', 'all'

Based on the above query results, we should be able to check if any group the user belongs to is disabled or denied access to SQL Server. If this group is enabled with access, the error will be gone.

Improve this answer
0

In our scenario, the user was logged into the OS and left the session in disconnected state. The user account was granted membership to a group for SQL access and when user connected to SQL, below error was logged. Error: 18456, Severity: 14, State: 11. Login failed for user. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors.

Simply logging of the user from OS and having him login again resolved the issue. I attributed the issue to effective permissions of the user for previous session that was causing the error. Having the user establish new connection renewed the access tokens and effective permissions.

Hope this helps!

Improve this answer
2
  • 1
    Since the OP notes that, in their case, the user restarted their machine, they presumably did initiate a new connection. That said, it's wise to double-check that the user doesn't have an established connection, and to test this, to rule out an old connection still using old permissions.
    – RDFozz
    Sep 6, 2017 at 15:58
  • I have same issue as Senthil describes but the client has to restart their machine every time they want to access the app. Every time. Access fails, restart, they're in. Next time access fails again. So my question to @RDFozz is how do you "double-check" that the user doesn't have an establish connection"? I've repeatedly asked the users to close all browser windows when they are done with the app.
    – Doreen
    Apr 3, 2019 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.