11

I have a Windows Server 2012 R2 domain controller and a database server (W2K12R2/SQL Server 2012).

As allowed usergroup I have given the group "domain-admins" sysadmin rights.

But somehow any domain-administrator can't connect to that SQL Server, but when I add the domain-administrator user directly as allowed user it does work. The active directory does work. RDP-Login works. Am I missing something?

Does anybody know how to grant access to the whole group "domain-admins"?

The error message is:

Servername: SRV-DB
Error Number: 18456
Schweregrad: 14
Status: 1
Line of Code: 65536

In the event log it says (translated):

Error checking the token based server access with infrastructure failure.

State is "1" . I log on to that db-server with RDP as an domain-admin. I have to explicitly start SSMS with "run as administrator". Then I can access the "localhost". If I leave out starting SSMS as admin then I can't do that. I thought being in the group "domain-admins" would be enough.

Improve this question
1

2 Answers 2

Reset to default
17

I found the answer to my problem in this answer by Remus Rusanu.

As an domain-admin connected to that SQL-Server-Host via Remote Desktop. I had to start SQL Server Management Studio explicitly "as an administrator". (right-click -> run as administrator).

If SSMS isn't started in administrator mode, the current login is not in "builtin\administrators"-group. That was the problem.

It comes from Windows user access control (UAC). So that is actually a security "feature".

Improve this answer
2
  • 1
    Ok, so it was exactly what state 11 suggests in the link I posted earlier.
    – Aaron Bertrand
    Nov 24, 2014 at 20:17
  • That's not a "feature", it's exactly how UAC is supposed to work: With UAC, applications and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system.
    – vonPryz
    Jan 22, 2018 at 14:08
-2

It's easy. If you are able to Logon with old credentials ( the Administrator of local computer ) you have to use it to access a Remote Desktop and use it to add the Domain Controller Administrator

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.