Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1493
  • Last Modified:

VPN "Cannot generate SSPI context"

Hi Experts,

I have a VPN connection that works just fine to connect to SQL 2000 Server using the enterprise manager.  I also have linked tables to the same server and databases.  This connect is through a cable modem.

 Now I am trying to work from a different location which is also a cable modem the problem is that with this connection I get "cannot generate sspi context"  I have looked at the different questions already posted and none seem to fit my scenerio.  Can anyone assist?  Thanks
1 Solution
Aneesh RetnakaranDatabase AdministratorCommented:
One thing to check is the SQL Client Network stack. This is configured in the (SQL Server) Client Network Utility. What you will probably find is that the working clients either have Named Pipes before TCP/IP, or left out TCP/IP. While the problem client will have TCP/IP first, or left out Named Pipes.

At a guess, you are running the SQL Server with a Domain Account, but it does not have the permission to register the SQL Server's SPN (Service Principal Name). This means that it cannot use delegation, which probably isn't a problem for you guys. But when someone tries to attach using TCP/IP, it can't use Kerberos and throws the error.

Clients that connect Named Pipes just by-pass Kerberos and security account delegation.

This will also happen if you are logged into your machine for days or weeks at a time and your password has expired. The PDC knows your password has expired, but your machine doesn't. So when Sql Server goes to authenticate you, you will fail due to password expiration on the domain account, thus receiving the error you mentioned above.

A couple of basic things:
If you're running active directory make sure the SQL Server is in the same AD Forest as you are. If connecting from Win95 or win98 make sure Microsoft Client Network is installed. If on NT make sure net logon service is installed.

You can also get help from the follwoing link: http://support.microsoft.com/?id=811889

Chetan Sachdeva

Featured Post

Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now