Solved

SQL SSPI Error (register SPN)

Posted on 2014-07-24
4
1,935 Views
Last Modified: 2014-07-24
Hi

We are seeing the following error on one of our SQL 2008 always on boxes (2008 R2):

DESCRIPTION:      SSPI handshake failed with error code 0x8009030c, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure. The logon attempt failed   [CLIENT: 10.165.2.103]

I couldn't find anything useful online and the client IP listed (10.165.2.103) is not a valid IP address on our network.

The SQL resource says all we need to do is manually register the SPN, but I have my doubts about the validity of this statement.  This is an error that Argent detected, but I can't get them to actually identify what the actual problem is (the spn is the symptom).  I don't want to re-register an SPN and restarting the MSSQLSERVER service if there isn't an actual problem.

Any help is appreciated.  Thanks.

Tony
0
Comment
Question by:tonyjoewalker
  • 2
  • 2
4 Comments
 
LVL 39

Accepted Solution

by:
lcohan earned 500 total points
ID: 40218039
That means someone tried a Integrated (Windows login) Authentication connection from that IP and it (luckily) failed with password error. Please check event viewer to see if there's anything else about this failed login in there and note that this message will appear when for instance a Windows domain password expires and it usually stops once the client resets the password.
0
 

Author Comment

by:tonyjoewalker
ID: 40218053
Thank you!

I found the client PC in question.  The service account that is running the MSSQLSERVER service is configured on twelve SQL servers and none are actually having any issues.

Our SQL resource insists the service account needs to be domain admin and we have to manually register these SPN's.  I don't get where any of these ideas even come from.  :(

I really appreciate the answer!!
0
 

Author Closing Comment

by:tonyjoewalker
ID: 40218055
Excellent!  Thank you!
0
 
LVL 39

Expert Comment

by:lcohan
ID: 40218077
That is totally wrong in my opinion - at the most a "minimally-privileged domain user account" but not domain admin - and here are some links to support that - maybe if you pass them they will take some action...

http://msdn.microsoft.com/en-us/library/ms143504(v=sql.105).aspx
http://blogs.technet.com/b/canitpro/archive/2012/02/08/the-sql-guy-post-15-best-practices-for-using-sql-server-service-accounts.aspx
http://www.sqlservercentral.com/Forums/Topic959128-1526-1.aspx
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

     When we have to pass multiple rows of data to SQL Server, the developers either have to send one row at a time or come up with other workarounds to meet requirements like using XML to pass data, which is complex and tedious to use. There is a …
In this article I will describe the Backup & Restore method as one possible migration process and I will add the extra tasks needed for an upgrade when and where is applied so it will cover all.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now