Cannot generate SSPI context

Posted on 2009-02-19
Last Modified: 2012-05-06
Hello...  I am a SQL Server has SQL Server 2005 and 2008 Express...

When trying to use the SQL Server Management Studio to remotely connect to it...I get a "Cannot Generate SSPI Context" error...

I need help...  Thanks...

Question by:StrongD1
    LVL 60

    Expert Comment

    have you changed your pwd recently?
    LVL 1

    Author Comment

    No... not at all...  this is a small "Lab network" we built to do software development on.  I am a developer, not a SQL Server DBA.... so SQL Server admin stuff is new to me.
    LVL 1

    Accepted Solution

    Ok...I was able to get in.  Here is what I did for the record.

    After reading a ton on here and a ton on Google about this error, a lot of people were saying it could be the Domain Controller...  My DC is a Windows 2003 Enterprise.... my SQL Server DB is on a Windows 2003 Standard.   So I started poking around the DC and I noticed when the Window firewall is on the SQL Server DB machine took forever to logon to the domain... it would take 5 minutes or so...  when I turned off the firewall on the DC, it would login in 5 seconds....   so I turned off the firewall on the DC and everything works...

    Does that make sense to anyone?  That is all I did... I didn't configure anything other turning off the firewall on the DC.


    Expert Comment

    I had this issue before and resolved it. this is due to SPN issue. follow this to resovle Resolution:
    To configure the SQL Server service to create SPNs dynamically, follow these steps:
    1.      Click Start, click Run, type Adsiedit.msc, and then click OK.
    2.      In the ADSI Edit snap-in, expand Domain [DomainName], expand DC= RootDomainName, expand CN=Users, right-click CN= AccountName, and then click Properties.

    "      DomainName is a placeholder for the name of the domain.
    "      RootDomainName is a placeholder for the name of the root domain.
    "      AccountName is a placeholder for the account that you specify to start the SQL Server service.
    "      If you specify the Local System account to start the SQL Server service, AccountName is a placeholder for the account that you use to log on to Microsoft Windows.
    "      If you specify a domain user account to start the SQL Server service, AccountName is a placeholder for the domain user account.

    3.      In the CN= AccountName Properties dialog box, click the Security tab.
    4.      On the Security tab, click Advanced.
    5.      In the Advanced Security Settings dialog box, make sure that SELF is listed under Permission entries.

    If SELF is not listed, click Add, and then add SELF.
    6.      Under Permission entries, click SELF, and then click Edit.
    7.      In the Permission Entry dialog box, click the Properties tab.
    8.      On the Properties tab, click This object only in the Apply onto list, and then make sure that the check boxes for the following permissions are selected under Permissions:
    "      Read servicePrincipalName
    "      Write servicePrincipalName

    9.      Click OK three times, and then exit the ADSI Edit snap-in.


    Expert Comment

    also check the SPN using ldifde.
    LVL 1

    Author Comment

    Yeah... thanks for the info asadeen:....  that is good to know..

    Hopefully we don't run into this problem again...   It seems our domain controllers firewall was causing problems authenicating the SQL Server machine.... I don't think SQL Server machine was even on the domain....  Who know... but thanks for the info.


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Hi all, It is important and often overlooked to understand “Database properties”. Often we see questions about "log files" or "where is the database" and one of the easiest ways to get general information about your database is to use “Database p…
    Occasionally there is a need to clean table columns, especially if you have inherited legacy data. There are obviously many ways to accomplish that, including elaborate UPDATE queries with anywhere from one to numerous REPLACE functions (even within…
    Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

    761 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    7 Experts available now in Live!

    Get 1:1 Help Now