Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

SQL SSPI Error (register SPN)

Posted on 2014-07-24
4
Medium Priority
?
2,128 Views
Last Modified: 2014-07-24
Hi

We are seeing the following error on one of our SQL 2008 always on boxes (2008 R2):

DESCRIPTION:      SSPI handshake failed with error code 0x8009030c, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure. The logon attempt failed   [CLIENT: 10.165.2.103]

I couldn't find anything useful online and the client IP listed (10.165.2.103) is not a valid IP address on our network.

The SQL resource says all we need to do is manually register the SPN, but I have my doubts about the validity of this statement.  This is an error that Argent detected, but I can't get them to actually identify what the actual problem is (the spn is the symptom).  I don't want to re-register an SPN and restarting the MSSQLSERVER service if there isn't an actual problem.

Any help is appreciated.  Thanks.

Tony
0
Comment
Question by:tonyjoewalker
  • 2
  • 2
4 Comments
 
LVL 40

Accepted Solution

by:
lcohan earned 2000 total points
ID: 40218039
That means someone tried a Integrated (Windows login) Authentication connection from that IP and it (luckily) failed with password error. Please check event viewer to see if there's anything else about this failed login in there and note that this message will appear when for instance a Windows domain password expires and it usually stops once the client resets the password.
0
 

Author Comment

by:tonyjoewalker
ID: 40218053
Thank you!

I found the client PC in question.  The service account that is running the MSSQLSERVER service is configured on twelve SQL servers and none are actually having any issues.

Our SQL resource insists the service account needs to be domain admin and we have to manually register these SPN's.  I don't get where any of these ideas even come from.  :(

I really appreciate the answer!!
0
 

Author Closing Comment

by:tonyjoewalker
ID: 40218055
Excellent!  Thank you!
0
 
LVL 40

Expert Comment

by:lcohan
ID: 40218077
That is totally wrong in my opinion - at the most a "minimally-privileged domain user account" but not domain admin - and here are some links to support that - maybe if you pass them they will take some action...

http://msdn.microsoft.com/en-us/library/ms143504(v=sql.105).aspx
http://blogs.technet.com/b/canitpro/archive/2012/02/08/the-sql-guy-post-15-best-practices-for-using-sql-server-service-accounts.aspx
http://www.sqlservercentral.com/Forums/Topic959128-1526-1.aspx
0

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I have written a PowerShell script to "walk" the security structure of each SQL instance to find:         Each Login (Windows or SQL)             * Its Server Roles             * Every database to which the login is mapped             * The associated "Database User" for this …
In this article I will describe the Detach & Attach method as one possible migration process and I will add the extra tasks needed for an upgrade when and where is applied so it will cover all.
This lesson discusses how to use a Mainform + Subforms in Microsoft Access to find and enter data for payments on orders. The sample data comes from a custom shop that builds and sells movable storage structures that are delivered to your property. …
Screencast - Getting to Know the Pipeline

876 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question