Solved

SQL SSPI Error (register SPN)

Posted on 2014-07-24
4
1,968 Views
Last Modified: 2014-07-24
Hi

We are seeing the following error on one of our SQL 2008 always on boxes (2008 R2):

DESCRIPTION:      SSPI handshake failed with error code 0x8009030c, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure. The logon attempt failed   [CLIENT: 10.165.2.103]

I couldn't find anything useful online and the client IP listed (10.165.2.103) is not a valid IP address on our network.

The SQL resource says all we need to do is manually register the SPN, but I have my doubts about the validity of this statement.  This is an error that Argent detected, but I can't get them to actually identify what the actual problem is (the spn is the symptom).  I don't want to re-register an SPN and restarting the MSSQLSERVER service if there isn't an actual problem.

Any help is appreciated.  Thanks.

Tony
0
Comment
Question by:tonyjoewalker
  • 2
  • 2
4 Comments
 
LVL 40

Accepted Solution

by:
lcohan earned 500 total points
ID: 40218039
That means someone tried a Integrated (Windows login) Authentication connection from that IP and it (luckily) failed with password error. Please check event viewer to see if there's anything else about this failed login in there and note that this message will appear when for instance a Windows domain password expires and it usually stops once the client resets the password.
0
 

Author Comment

by:tonyjoewalker
ID: 40218053
Thank you!

I found the client PC in question.  The service account that is running the MSSQLSERVER service is configured on twelve SQL servers and none are actually having any issues.

Our SQL resource insists the service account needs to be domain admin and we have to manually register these SPN's.  I don't get where any of these ideas even come from.  :(

I really appreciate the answer!!
0
 

Author Closing Comment

by:tonyjoewalker
ID: 40218055
Excellent!  Thank you!
0
 
LVL 40

Expert Comment

by:lcohan
ID: 40218077
That is totally wrong in my opinion - at the most a "minimally-privileged domain user account" but not domain admin - and here are some links to support that - maybe if you pass them they will take some action...

http://msdn.microsoft.com/en-us/library/ms143504(v=sql.105).aspx
http://blogs.technet.com/b/canitpro/archive/2012/02/08/the-sql-guy-post-15-best-practices-for-using-sql-server-service-accounts.aspx
http://www.sqlservercentral.com/Forums/Topic959128-1526-1.aspx
0

Featured Post

Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Writing SQL Select Query result to a text file 12 56
How to search for strings inside db views 4 36
SQL DATEADD 10 71
How can I get the entire database script? 7 14
I have written a PowerShell script to "walk" the security structure of each SQL instance to find:         Each Login (Windows or SQL)             * Its Server Roles             * Every database to which the login is mapped             * The associated "Database User" for this …
Use this article to create a batch file to backup a Microsoft SQL Server database to a Windows folder.  The folder can be on the local hard drive or on a network share.  This batch file will query the SQL server to get the current date & time and wi…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Although Jacob Bernoulli (1654-1705) has been credited as the creator of "Binomial Distribution Table", Gottfried Leibniz (1646-1716) did his dissertation on the subject in 1666; Leibniz you may recall is the co-inventor of "Calculus" and beat Isaac…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question