0

I'm facing a problem that when I try to connect to the SQL Express instance from client to server. The Server logs an error:

SSPI handshake failed with error code 0x8009030c, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure. The logon attempt failed
[CLIENT: 192.168.245.50]

The account I log on with is sysadmin and have all the possible permissions on the database its trying to connect to but still it fails. But if I add the user that is trying to connect to the local administrators group it works. This is not a good solution, I don't want all users to be local administrators on the server. Why is it that the user needs to be local admin?

And I think the SPN is correctly set.

enter image description here

Its all in same domain and using domain accounts. Windows Autentication is used for login.
Shouldnt be problem with the connectivity to the DC. Named instances name is used (it works if the domain user is local admin).

Log from SQL error log:

03/09/2015 15:22:47,Logon,Unknown,Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. [CLIENT: 192.168.245.50] 03/09/2015 15:22:47,Logon,Unknown,Error: 18452 Severity: 14 State: 1. 03/09/2015 15:22:47,Logon,Unknown,SSPI handshake failed with error code 0x8009030c state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure. The logon attempt failed [CLIENT: 192.168.245.50] 03/09/2015 15:22:47,Logon,Unknown,Error: 17806 Severity: 20 State: 14.

Log from the client trying to connect:

LSRetailPosis.POS.Program: System.Data.SqlClient.SqlException (0x80131904): Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. at System.Data.ProviderBase.DbConnectionPool.TryGetConnection(DbConnection owningObject, UInt32 waitForMultipleObjectsTimeout, Boolean allowCreate, Boolean onlyOneCheckConnection, DbConnectionOptions userOptions, DbConnectionInternal& connection) at System.Data.ProviderBase.DbConnectionPool.TryGetConnection(DbConnection owningObject, TaskCompletionSource1 retry, DbConnectionOptions userOptions, DbConnectionInternal& connection) at System.Data.ProviderBase.DbConnectionFactory.TryGetConnection(DbConnection owningConnection, TaskCompletionSource1 retry, DbConnectionOptions userOptions, DbConnectionInternal oldConnection, DbConnectionInternal& connection) at System.Data.ProviderBase.DbConnectionInternal.TryOpenConnectionInternal(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource1 retry, DbConnectionOptions userOptions) at System.Data.ProviderBase.DbConnectionClosed.TryOpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory, TaskCompletionSource1 retry, DbConnectionOptions userOptions) at System.Data.SqlClient.SqlConnection.TryOpenInner(TaskCompletionSource1 retry) at System.Data.SqlClient.SqlConnection.TryOpen(TaskCompletionSource1 retry) at System.Data.SqlClient.SqlConnection.Open() at LSRetailPosis.Settings.Database.CheckDatabaseExistence() at LSRetailPosis.Settings.Database.CheckDatabaseSettings() at LSRetailPosis.Settings.ApplicationSettings.InitializeSettings(String[] args) at LSRetailPosis.POS.Program.InitializeAndLoadPOS(String[] args, Boolean owned, SplashScreenForm splashScreenForm) at LSRetailPosis.POS.Program.Main(String[] args) ClientConnectionId:d57c7fd9-4a47-41b7-af07-ed93627d2930.

Improve this question
11
  • Is it a windows domain account, a local windows account, or a sql auth account? Are you both on the same domain? Any issues with connectivity to the domain controller? Are you specifying the instance name when connecting? Can you provide the error messages from the SQL Server error log, which may contain a little more detail? (The state in SQL Server's error log will be something other than 14, which I believe in the error message your client is showing is actually the severity.)
    – Aaron Bertrand
    Mar 9, 2015 at 14:18
  • Updated the question with answers.
    – Daniel Björk
    Mar 9, 2015 at 14:32
  • So here is a clue: The login is from an untrusted domain... have you considered using SQL auth remotely if you can't set up domain trusts / Kerberos etc. between the two machines?
    – Aaron Bertrand
    Mar 9, 2015 at 15:19
  • It's Dyanmics AX POS client, I cant use SQL auth. It´s the same domain. If i login with my own account that is local admin on the SQL server it works.
    – Daniel Björk
    Mar 9, 2015 at 15:23
  • It doesn't seem like SQL Server thinks the account is coming from the same domain.
    – Aaron Bertrand
    Mar 9, 2015 at 15:31

1 Answer 1

Reset to default
0

I found a solution to this problem.

I added the domain user to: Local Security Policy -> Local Policies -> User Rights Assignment -> Access this computer from the Network

enter image description here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.