Cannot get write permissions to a folder

I have a server ser1 which has the sql server running under the
security context of the local admin.Whn i try to copy the backup files
from this server to a network share it acnnot access the share unless
the sever has all authenticated user write permisssions.On setting the
auditing on we found that ser1$ uis the account which is trying to
write to the share.My question is as follows:- what is the difference
between the domaonname\ser1 and domainname\ser1$ account.I cannot see
this ser1$ account in the domain so I caaanot give it permissions.Is
there a way I could get to this account and give it permissions to
tighter up the security?
Thanks in anticipation.
AjayI'm not a network adminstrator, but I tried the same thing before and it
doesn't work. If you want SQL to have access to network resources it has to
run under a domain account. Then you can grant permissions to that account
on the network share you are trying to access. You will either need to setup
sql server to run under a domain account or have sql server write the backup
locally and schedule a job that can run with domain credentials to copy the
backup to the network share.
Mark
"Ag" <ajaygarg1962@.gmail.com> wrote in message
news:1154617829.443666.306270@.i42g2000cwa.googlegroups.com...
>I have a server ser1 which has the sql server running under the
> security context of the local admin.Whn i try to copy the backup files
> from this server to a network share it acnnot access the share unless
> the sever has all authenticated user write permisssions.On setting the
> auditing on we found that ser1$ uis the account which is trying to
> write to the share.My question is as follows:- what is the difference
> between the domaonname\ser1 and domainname\ser1$ account.I cannot see
> this ser1$ account in the domain so I caaanot give it permissions.Is
> there a way I could get to this account and give it permissions to
> tighter up the security?
> Thanks in anticipation.
>
> Ajay
>|||Mark Miller wrote:
> I'm not a network adminstrator, but I tried the same thing before and it
> doesn't work. If you want SQL to have access to network resources it has to
> run under a domain account. Then you can grant permissions to that account
> on the network share you are trying to access. You will either need to setup
> sql server to run under a domain account or have sql server write the backup
> locally and schedule a job that can run with domain credentials to copy the
> backup to the network share.
> Mark
> "Ag" <ajaygarg1962@.gmail.com> wrote in message
> news:1154617829.443666.306270@.i42g2000cwa.googlegroups.com...
> >I have a server ser1 which has the sql server running under the
> > security context of the local admin.Whn i try to copy the backup files
> > from this server to a network share it acnnot access the share unless
> > the sever has all authenticated user write permisssions.On setting the
> > auditing on we found that ser1$ uis the account which is trying to
> > write to the share.My question is as follows:- what is the difference
> > between the domaonname\ser1 and domainname\ser1$ account.I cannot see
> > this ser1$ account in the domain so I caaanot give it permissions.Is
> > there a way I could get to this account and give it permissions to
> > tighter up the security?
> >
> > Thanks in anticipation.
> >
> >
> > Ajay
Thanks Mark for the response:-
Here is what I notices and I was able to resolve the issue:-
ser1$ is the computername account which is trying to acces a directory
whenever the sql server uses a local admin account.We can resolve this
in three ways:-
1.Give the network share permissions for the the
domainname/computername account in this case domainname/compuetname$ .
2.Change sql servr to use a domain account means chaning the apps to
use the domain acocunt a non starteer in my enviormment as the apps are
owned by the vendors.
3.Use a proxy account for the sql server agent so that even if sql runs
on a local admin account the proxy account would enable the agent to
use a doain account.
Thanks for your response.
Ajay
> >|||Ag wrote:
> Mark Miller wrote:
>> I'm not a network adminstrator, but I tried the same thing before and it
>> doesn't work. If you want SQL to have access to network resources it has to
>> run under a domain account. Then you can grant permissions to that account
>> on the network share you are trying to access. You will either need to setup
>> sql server to run under a domain account or have sql server write the backup
>> locally and schedule a job that can run with domain credentials to copy the
>> backup to the network share.
>> Mark
>> "Ag" <ajaygarg1962@.gmail.com> wrote in message
>> news:1154617829.443666.306270@.i42g2000cwa.googlegroups.com...
>> I have a server ser1 which has the sql server running under the
>> security context of the local admin.Whn i try to copy the backup files
>> from this server to a network share it acnnot access the share unless
>> the sever has all authenticated user write permisssions.On setting the
>> auditing on we found that ser1$ uis the account which is trying to
>> write to the share.My question is as follows:- what is the difference
>> between the domaonname\ser1 and domainname\ser1$ account.I cannot see
>> this ser1$ account in the domain so I caaanot give it permissions.Is
>> there a way I could get to this account and give it permissions to
>> tighter up the security?
>> Thanks in anticipation.
>>
>> Ajay
> Thanks Mark for the response:-
> Here is what I notices and I was able to resolve the issue:-
> ser1$ is the computername account which is trying to acces a directory
> whenever the sql server uses a local admin account.We can resolve this
> in three ways:-
> 1.Give the network share permissions for the the
> domainname/computername account in this case domainname/compuetname$ .
> 2.Change sql servr to use a domain account means chaning the apps to
> use the domain acocunt a non starteer in my enviormment as the apps are
> owned by the vendors.
This is just plain wrong. Changing the account that the SQL Server and
SQL Agent services run under has absolutely nothing to do with the
logins use by applications to connect to SQL databases. If you want to
access network resources from within SQL, this is how you do it. Change
the MSSQLSERVER and SQLSERVERAGENT services to run as a domain user, and
grant share permissions to that domain user.
> 3.Use a proxy account for the sql server agent so that even if sql runs
> on a local admin account the proxy account would enable the agent to
> use a doain account.
> Thanks for your response.
>
> Ajay
>
Tracy McKibben
MCDBA
http://www.realsqlguy.com|||Tracy McKibben wrote:
> Ag wrote:
> > Mark Miller wrote:
> >> I'm not a network adminstrator, but I tried the same thing before and it
> >> doesn't work. If you want SQL to have access to network resources it has to
> >> run under a domain account. Then you can grant permissions to that account
> >> on the network share you are trying to access. You will either need to setup
> >> sql server to run under a domain account or have sql server write the backup
> >> locally and schedule a job that can run with domain credentials to copy the
> >> backup to the network share.
> >>
> >> Mark
> >>
> >> "Ag" <ajaygarg1962@.gmail.com> wrote in message
> >> news:1154617829.443666.306270@.i42g2000cwa.googlegroups.com...
> >> I have a server ser1 which has the sql server running under the
> >> security context of the local admin.Whn i try to copy the backup files
> >> from this server to a network share it acnnot access the share unless
> >> the sever has all authenticated user write permisssions.On setting the
> >> auditing on we found that ser1$ uis the account which is trying to
> >> write to the share.My question is as follows:- what is the difference
> >> between the domaonname\ser1 and domainname\ser1$ account.I cannot see
> >> this ser1$ account in the domain so I caaanot give it permissions.Is
> >> there a way I could get to this account and give it permissions to
> >> tighter up the security?
> >>
> >> Thanks in anticipation.
> >>
> >>
> >> Ajay
> >
> > Thanks Mark for the response:-
> >
> > Here is what I notices and I was able to resolve the issue:-
> >
> > ser1$ is the computername account which is trying to acces a directory
> > whenever the sql server uses a local admin account.We can resolve this
> > in three ways:-
> >
> > 1.Give the network share permissions for the the
> > domainname/computername account in this case domainname/compuetname$ .
> > 2.Change sql servr to use a domain account means chaning the apps to
> > use the domain acocunt a non starteer in my enviormment as the apps are
> > owned by the vendors.
> This is just plain wrong. Changing the account that the SQL Server and
> SQL Agent services run under has absolutely nothing to do with the
> logins use by applications to connect to SQL databases. If you want to
> access network resources from within SQL, this is how you do it. Change
> the MSSQLSERVER and SQLSERVERAGENT services to run as a domain user, and
> grant share permissions to that domain user.
>
> > 3.Use a proxy account for the sql server agent so that even if sql runs
> > on a local admin account the proxy account would enable the agent to
> > use a doain account.
> >
> > Thanks for your response.
> >
> >
> > Ajay
> >
>
> --
> Tracy McKibben
> MCDBA
> http://www.realsqlguy.com
Maybe i did not explain it right:- AT the sql end changing the sql
server to use the domain service accoutn would make the sql server run
on a domain account but the DSn which is configurd to use the local
admin account and use IIS has been configured to use the local admin by
defualt(that is what irt chooses) SO CHANING THE SECURITY CONTEXT OF
THE SQL SERVER SERVICE AND THE SQL AGENT SERICE WOULD MEAN THAT I
CHANGE THE DSN OF ALL THE APPLICATIONS WHICH ARE CONFIGURED TO LOGIN
USING NT ATHENTICATION AND LOCAL ADMIN account on the box.Surprisingly
most apps reside on the same box as the sql server and use the Local
Admin account and are configured to use a dsn /logins odf the local
account on sql server.
This is diiifcult as it entails coordinatig with vendors and so I wold
not wat to go with this option.

Cannot get write permissions to a folder

I have a server ser1 which has the sql server running under the
security context of the local admin.Whn i try to copy the backup files
from this server to a network share it acnnot access the share unless
the sever has all authenticated user write permisssions.On setting the
auditing on we found that ser1$ uis the account which is trying to
write to the share.My question is as follows:- what is the difference
between the domaonname\ser1 and domainname\ser1$ account.I cannot see
this ser1$ account in the domain so I caaanot give it permissions.Is
there a way I could get to this account and give it permissions to
tighter up the security?
Thanks in anticipation.
AjayI'm not a network adminstrator, but I tried the same thing before and it
doesn't work. If you want SQL to have access to network resources it has to
run under a domain account. Then you can grant permissions to that account
on the network share you are trying to access. You will either need to setup
sql server to run under a domain account or have sql server write the backup
locally and schedule a job that can run with domain credentials to copy the
backup to the network share.
Mark
"Ag" <ajaygarg1962@.gmail.com> wrote in message
news:1154617829.443666.306270@.i42g2000cwa.googlegroups.com...
>I have a server ser1 which has the sql server running under the
> security context of the local admin.Whn i try to copy the backup files
> from this server to a network share it acnnot access the share unless
> the sever has all authenticated user write permisssions.On setting the
> auditing on we found that ser1$ uis the account which is trying to
> write to the share.My question is as follows:- what is the difference
> between the domaonname\ser1 and domainname\ser1$ account.I cannot see
> this ser1$ account in the domain so I caaanot give it permissions.Is
> there a way I could get to this account and give it permissions to
> tighter up the security?
> Thanks in anticipation.
>
> Ajay
>|||Mark Miller wrote:[vbcol=seagreen]
> I'm not a network adminstrator, but I tried the same thing before and it
> doesn't work. If you want SQL to have access to network resources it has t
o
> run under a domain account. Then you can grant permissions to that account
> on the network share you are trying to access. You will either need to set
up
> sql server to run under a domain account or have sql server write the back
up
> locally and schedule a job that can run with domain credentials to copy th
e
> backup to the network share.
> Mark
> "Ag" <ajaygarg1962@.gmail.com> wrote in message
> news:1154617829.443666.306270@.i42g2000cwa.googlegroups.com...
Thanks Mark for the response:-
Here is what I notices and I was able to resolve the issue:-
ser1$ is the computername account which is trying to acces a directory
whenever the sql server uses a local admin account.We can resolve this
in three ways:-
1.Give the network share permissions for the the
domainname/computername account in this case domainname/compuetname$ .
2.Change sql servr to use a domain account means chaning the apps to
use the domain acocunt a non starteer in my enviormment as the apps are
owned by the vendors.
3.Use a proxy account for the sql server agent so that even if sql runs
on a local admin account the proxy account would enable the agent to
use a doain account.
Thanks for your response.
Ajay[vbcol=seagreen]|||Ag wrote:
> Mark Miller wrote:
> Thanks Mark for the response:-
> Here is what I notices and I was able to resolve the issue:-
> ser1$ is the computername account which is trying to acces a directory
> whenever the sql server uses a local admin account.We can resolve this
> in three ways:-
> 1.Give the network share permissions for the the
> domainname/computername account in this case domainname/compuetname$ .
> 2.Change sql servr to use a domain account means chaning the apps to
> use the domain acocunt a non starteer in my enviormment as the apps are
> owned by the vendors.
This is just plain wrong. Changing the account that the SQL Server and
SQL Agent services run under has absolutely nothing to do with the
logins use by applications to connect to SQL databases. If you want to
access network resources from within SQL, this is how you do it. Change
the MSSQLSERVER and SQLSERVERAGENT services to run as a domain user, and
grant share permissions to that domain user.

> 3.Use a proxy account for the sql server agent so that even if sql runs
> on a local admin account the proxy account would enable the agent to
> use a doain account.
> Thanks for your response.
>
> Ajay
>
Tracy McKibben
MCDBA
http://www.realsqlguy.com|||Tracy McKibben wrote:
> Ag wrote:
> This is just plain wrong. Changing the account that the SQL Server and
> SQL Agent services run under has absolutely nothing to do with the
> logins use by applications to connect to SQL databases. If you want to
> access network resources from within SQL, this is how you do it. Change
> the MSSQLSERVER and SQLSERVERAGENT services to run as a domain user, and
> grant share permissions to that domain user.
>
>
> --
> Tracy McKibben
> MCDBA
> http://www.realsqlguy.com
Maybe i did not explain it right:- AT the sql end changing the sql
server to use the domain service accoutn would make the sql server run
on a domain account but the DSn which is configurd to use the local
admin account and use IIS has been configured to use the local admin by
defualt(that is what irt chooses) SO CHANING THE SECURITY CONTEXT OF
THE SQL SERVER SERVICE AND THE SQL AGENT SERICE WOULD MEAN THAT I
CHANGE THE DSN OF ALL THE APPLICATIONS WHICH ARE CONFIGURED TO LOGIN
USING NT ATHENTICATION AND LOCAL ADMIN account on the box.Surprisingly
most apps reside on the same box as the sql server and use the Local
Admin account and are configured to use a dsn /logins odf the local
account on sql server.
This is diiifcult as it entails coordinatig with vendors and so I wold
not wat to go with this option.

Cannot generate SSPI Context?

I am trying to connect to one of our SQL servers via Ent mgr - I cannot
access and receive an error, see below. I can only see the server in Ent Mgr
if I remote to the server where SQL 2000 resides and run Ent mgr from there.
The SQL 2000 Named Intance resides on a Windows server 2003
The error I receive is:
Cannot generate SSPI Context?
After i change the SQL Server Service Account, i am getting above error
message. I change the service account 5 machines but i have only problem
with one server.
Please any body help me?You can define an alias and force the connection to using "name pipe" , there
is an KB article on it..
"Ram" wrote:
> I am trying to connect to one of our SQL servers via Ent mgr - I cannot
> access and receive an error, see below. I can only see the server in Ent Mgr
> if I remote to the server where SQL 2000 resides and run Ent mgr from there.
> The SQL 2000 Named Intance resides on a Windows server 2003
> The error I receive is:
> Cannot generate SSPI Context?
> After i change the SQL Server Service Account, i am getting above error
> message. I change the service account 5 machines but i have only problem
> with one server.
> Please any body help me?
>|||Or you can add the sqlserver service account to 'impersonate a user after
authentication' user rights assignment in security policy.
"Anthony" wrote:
> You can define an alias and force the connection to using "name pipe" , there
> is an KB article on it..
> "Ram" wrote:
> > I am trying to connect to one of our SQL servers via Ent mgr - I cannot
> > access and receive an error, see below. I can only see the server in Ent Mgr
> > if I remote to the server where SQL 2000 resides and run Ent mgr from there.
> >
> > The SQL 2000 Named Intance resides on a Windows server 2003
> >
> > The error I receive is:
> > Cannot generate SSPI Context?
> >
> > After i change the SQL Server Service Account, i am getting above error
> > message. I change the service account 5 machines but i have only problem
> > with one server.
> >
> > Please any body help me?
> >
> >|||Thanks for reply. we already added local administrator group and SQL Server
security as a sys administrator group also. I can connect using SQL
Authetication but i can't connect using Windows authetication. I also Added
Client network utility alias also. still doesn't work.
Ram
"Olu Adedeji" wrote:
> Or you can add the sqlserver service account to 'impersonate a user after
> authentication' user rights assignment in security policy.
> "Anthony" wrote:
> > You can define an alias and force the connection to using "name pipe" , there
> > is an KB article on it..
> >
> > "Ram" wrote:
> >
> > > I am trying to connect to one of our SQL servers via Ent mgr - I cannot
> > > access and receive an error, see below. I can only see the server in Ent Mgr
> > > if I remote to the server where SQL 2000 resides and run Ent mgr from there.
> > >
> > > The SQL 2000 Named Intance resides on a Windows server 2003
> > >
> > > The error I receive is:
> > > Cannot generate SSPI Context?
> > >
> > > After i change the SQL Server Service Account, i am getting above error
> > > message. I change the service account 5 machines but i have only problem
> > > with one server.
> > >
> > > Please any body help me?
> > >
> > >|||Hi Ram,
What operating system you have on computer from which you want to access SQL
server, is that computer member of workgroup or member of domain?
Regards,
Daniel
"Ram" <Ram@.discussions.microsoft.com> wrote in message
news:7B139AF7-E0E0-403F-B37D-96727A54F08E@.microsoft.com...
> Thanks for reply. we already added local administrator group and SQL
Server
> security as a sys administrator group also. I can connect using SQL
> Authetication but i can't connect using Windows authetication. I also
Added
> Client network utility alias also. still doesn't work.
> Ram
> "Olu Adedeji" wrote:
> > Or you can add the sqlserver service account to 'impersonate a user
after
> > authentication' user rights assignment in security policy.
> >
> > "Anthony" wrote:
> >
> > > You can define an alias and force the connection to using "name pipe"
, there
> > > is an KB article on it..
> > >
> > > "Ram" wrote:
> > >
> > > > I am trying to connect to one of our SQL servers via Ent mgr - I
cannot
> > > > access and receive an error, see below. I can only see the server in
Ent Mgr
> > > > if I remote to the server where SQL 2000 resides and run Ent mgr
from there.
> > > >
> > > > The SQL 2000 Named Intance resides on a Windows server 2003
> > > >
> > > > The error I receive is:
> > > > Cannot generate SSPI Context?
> > > >
> > > > After i change the SQL Server Service Account, i am getting above
error
> > > > message. I change the service account 5 machines but i have only
problem
> > > > with one server.
> > > >
> > > > Please any body help me?
> > > >
> > > >|||Hi Ram,
What operating system you have on computer from which you want to access SQL
server, is that computer member of workgroup or member of domain?
Regards,
Daniel
"Ram" <Ram@.discussions.microsoft.com> wrote in message
news:7B139AF7-E0E0-403F-B37D-96727A54F08E@.microsoft.com...
> Thanks for reply. we already added local administrator group and SQL
Server
> security as a sys administrator group also. I can connect using SQL
> Authetication but i can't connect using Windows authetication. I also
Added
> Client network utility alias also. still doesn't work.
> Ram
> "Olu Adedeji" wrote:
> > Or you can add the sqlserver service account to 'impersonate a user
after
> > authentication' user rights assignment in security policy.
> >
> > "Anthony" wrote:
> >
> > > You can define an alias and force the connection to using "name pipe"
, there
> > > is an KB article on it..
> > >
> > > "Ram" wrote:
> > >
> > > > I am trying to connect to one of our SQL servers via Ent mgr - I
cannot
> > > > access and receive an error, see below. I can only see the server in
Ent Mgr
> > > > if I remote to the server where SQL 2000 resides and run Ent mgr
from there.
> > > >
> > > > The SQL 2000 Named Intance resides on a Windows server 2003
> > > >
> > > > The error I receive is:
> > > > Cannot generate SSPI Context?
> > > >
> > > > After i change the SQL Server Service Account, i am getting above
error
> > > > message. I change the service account 5 machines but i have only
problem
> > > > with one server.
> > > >
> > > > Please any body help me?
> > > >
> > > >

Cannot generate SSPI Context?

I am trying to connect to one of our SQL servers via Ent mgr - I cannot
access and receive an error, see below. I can only see the server in Ent Mgr
if I remote to the server where SQL 2000 resides and run Ent mgr from there.
The SQL 2000 Named Intance resides on a Windows server 2003
The error I receive is:
Cannot generate SSPI Context?
After i change the SQL Server Service Account, i am getting above error
message. I change the service account 5 machines but i have only problem
with one server.
Please any body help me?You can define an alias and force the connection to using "name pipe" , ther
e
is an KB article on it..
"Ram" wrote:

> I am trying to connect to one of our SQL servers via Ent mgr - I cannot
> access and receive an error, see below. I can only see the server in Ent M
gr
> if I remote to the server where SQL 2000 resides and run Ent mgr from ther
e.
> The SQL 2000 Named Intance resides on a Windows server 2003
> The error I receive is:
> Cannot generate SSPI Context?
> After i change the SQL Server Service Account, i am getting above error
> message. I change the service account 5 machines but i have only problem
> with one server.
> Please any body help me?
>|||Or you can add the sqlserver service account to 'impersonate a user after
authentication' user rights assignment in security policy.
"Anthony" wrote:
[vbcol=seagreen]
> You can define an alias and force the connection to using "name pipe" , th
ere
> is an KB article on it..
> "Ram" wrote:
>|||Thanks for reply. we already added local administrator group and SQL Server
security as a sys administrator group also. I can connect using SQL
Authetication but i can't connect using Windows authetication. I also Added
Client network utility alias also. still doesn't work.
Ram
"Olu Adedeji" wrote:
[vbcol=seagreen]
> Or you can add the sqlserver service account to 'impersonate a user after
> authentication' user rights assignment in security policy.
> "Anthony" wrote:
>|||Hi Ram,
What operating system you have on computer from which you want to access SQL
server, is that computer member of workgroup or member of domain?
Regards,
Daniel
"Ram" <Ram@.discussions.microsoft.com> wrote in message
news:7B139AF7-E0E0-403F-B37D-96727A54F08E@.microsoft.com...
> Thanks for reply. we already added local administrator group and SQL
Server
> security as a sys administrator group also. I can connect using SQL
> Authetication but i can't connect using Windows authetication. I also
Added[vbcol=seagreen]
> Client network utility alias also. still doesn't work.
> Ram
> "Olu Adedeji" wrote:
>
after[vbcol=seagreen]
, there[vbcol=seagreen]
cannot[vbcol=seagreen]
Ent Mgr[vbcol=seagreen]
from there.[vbcol=seagreen]
error[vbcol=seagreen]
problem[vbcol=seagreen]|||Hi Ram,
What operating system you have on computer from which you want to access SQL
server, is that computer member of workgroup or member of domain?
Regards,
Daniel
"Ram" <Ram@.discussions.microsoft.com> wrote in message
news:7B139AF7-E0E0-403F-B37D-96727A54F08E@.microsoft.com...
> Thanks for reply. we already added local administrator group and SQL
Server
> security as a sys administrator group also. I can connect using SQL
> Authetication but i can't connect using Windows authetication. I also
Added[vbcol=seagreen]
> Client network utility alias also. still doesn't work.
> Ram
> "Olu Adedeji" wrote:
>
after[vbcol=seagreen]
, there[vbcol=seagreen]
cannot[vbcol=seagreen]
Ent Mgr[vbcol=seagreen]
from there.[vbcol=seagreen]
error[vbcol=seagreen]
problem[vbcol=seagreen]

Cannot generate SSPI Context?

I am trying to connect to one of our SQL servers via Ent mgr - I cannot
access and receive an error, see below. I can only see the server in Ent Mgr
if I remote to the server where SQL 2000 resides and run Ent mgr from there.
The SQL 2000 Named Intance resides on a Windows server 2003
The error I receive is:
Cannot generate SSPI Context?
After i change the SQL Server Service Account, i am getting above error
message. I change the service account 5 machines but i have only problem
with one server.
Please any body help me?
You can define an alias and force the connection to using "name pipe" , there
is an KB article on it..
"Ram" wrote:

> I am trying to connect to one of our SQL servers via Ent mgr - I cannot
> access and receive an error, see below. I can only see the server in Ent Mgr
> if I remote to the server where SQL 2000 resides and run Ent mgr from there.
> The SQL 2000 Named Intance resides on a Windows server 2003
> The error I receive is:
> Cannot generate SSPI Context?
> After i change the SQL Server Service Account, i am getting above error
> message. I change the service account 5 machines but i have only problem
> with one server.
> Please any body help me?
>
|||Or you can add the sqlserver service account to 'impersonate a user after
authentication' user rights assignment in security policy.
"Anthony" wrote:
[vbcol=seagreen]
> You can define an alias and force the connection to using "name pipe" , there
> is an KB article on it..
> "Ram" wrote:
|||Thanks for reply. we already added local administrator group and SQL Server
security as a sys administrator group also. I can connect using SQL
Authetication but i can't connect using Windows authetication. I also Added
Client network utility alias also. still doesn't work.
Ram
"Olu Adedeji" wrote:
[vbcol=seagreen]
> Or you can add the sqlserver service account to 'impersonate a user after
> authentication' user rights assignment in security policy.
> "Anthony" wrote:
|||Hi Ram,
What operating system you have on computer from which you want to access SQL
server, is that computer member of workgroup or member of domain?
Regards,
Daniel
"Ram" <Ram@.discussions.microsoft.com> wrote in message
news:7B139AF7-E0E0-403F-B37D-96727A54F08E@.microsoft.com...
> Thanks for reply. we already added local administrator group and SQL
Server
> security as a sys administrator group also. I can connect using SQL
> Authetication but i can't connect using Windows authetication. I also
Added[vbcol=seagreen]
> Client network utility alias also. still doesn't work.
> Ram
> "Olu Adedeji" wrote:
after[vbcol=seagreen]
, there[vbcol=seagreen]
cannot[vbcol=seagreen]
Ent Mgr[vbcol=seagreen]
from there.[vbcol=seagreen]
error[vbcol=seagreen]
problem[vbcol=seagreen]
|||Hi Ram,
What operating system you have on computer from which you want to access SQL
server, is that computer member of workgroup or member of domain?
Regards,
Daniel
"Ram" <Ram@.discussions.microsoft.com> wrote in message
news:7B139AF7-E0E0-403F-B37D-96727A54F08E@.microsoft.com...
> Thanks for reply. we already added local administrator group and SQL
Server
> security as a sys administrator group also. I can connect using SQL
> Authetication but i can't connect using Windows authetication. I also
Added[vbcol=seagreen]
> Client network utility alias also. still doesn't work.
> Ram
> "Olu Adedeji" wrote:
after[vbcol=seagreen]
, there[vbcol=seagreen]
cannot[vbcol=seagreen]
Ent Mgr[vbcol=seagreen]
from there.[vbcol=seagreen]
error[vbcol=seagreen]
problem[vbcol=seagreen]

Cannot generate SSPI context. (Microsoft SQL Server, Error: 0)

Hi,

I am working on sql server 2005 .

when I am trying to connect to server:

following error is occuring:

TITLE: Connect to Server

Cannot connect to servername

ADDITIONAL INFORMATION:

Cannot generate SSPI context. (Microsoft SQL Server, Error: 0)

Could any one help What might be the problem ? for this ?

Thanks,

Ramki

Your SPN is not setup correctly. Take a look at the following article for resolution.
http://support.microsoft.com/kb/811889

Cannot Generate SSPI Context.

we installed SQL Server 2000 and a new test database, 2 groups were created:
BobAdmin
BobUser
in Active Directory Users & Computers
and users added to each group and everything was fine,we are now getting an
error "Cannot Generate SSPI Context. " when we try and open the database app
on the workstations.
The only change is we have changed the Main Administrator Password, would
this affect the server or the log-on's to SQL Server and has anyone fixed
this problem that could help.
Many Thanks
Jimleake@.hotmail.com
Does SQL Server know about these groups?
http://www.aspfaq.com/
(Reverse address to reply.)
"jim" <jim@.discussions.microsoft.com> wrote in message
news:91D673DA-73CA-4EF1-BB77-016AC467138A@.microsoft.com...
> we installed SQL Server 2000 and a new test database, 2 groups were
created:
> BobAdmin
> BobUser
> in Active Directory Users & Computers
> and users added to each group and everything was fine,we are now getting
an
> error "Cannot Generate SSPI Context. " when we try and open the database
app
> on the workstations.
> The only change is we have changed the Main Administrator Password, would
> this affect the server or the log-on's to SQL Server and has anyone fixed
> this problem that could help.
>
> Many Thanks
> Jimleake@.hotmail.com
>
|||I had a similar problem and it turned out to be a DNS issue.
Have you reviewed this article?
http://support.microsoft.com/default...b;en-us;811889
"jim" <jim@.discussions.microsoft.com> wrote in message
news:91D673DA-73CA-4EF1-BB77-016AC467138A@.microsoft.com...
> we installed SQL Server 2000 and a new test database, 2 groups were
created:
> BobAdmin
> BobUser
> in Active Directory Users & Computers
> and users added to each group and everything was fine,we are now getting
an
> error "Cannot Generate SSPI Context. " when we try and open the database
app
> on the workstations.
> The only change is we have changed the Main Administrator Password, would
> this affect the server or the log-on's to SQL Server and has anyone fixed
> this problem that could help.
>
> Many Thanks
> Jimleake@.hotmail.com
>
|||Large time differences between systems can also cause SSPI context failures.
Geoff N. Hiten
Microsoft SQL Server MVP
Senior Database Administrator
Careerbuilder.com
I support the Professional Association for SQL Server
www.sqlpass.org
"jim" <jim@.discussions.microsoft.com> wrote in message
news:91D673DA-73CA-4EF1-BB77-016AC467138A@.microsoft.com...
> we installed SQL Server 2000 and a new test database, 2 groups were
created:
> BobAdmin
> BobUser
> in Active Directory Users & Computers
> and users added to each group and everything was fine,we are now getting
an
> error "Cannot Generate SSPI Context. " when we try and open the database
app
> on the workstations.
> The only change is we have changed the Main Administrator Password, would
> this affect the server or the log-on's to SQL Server and has anyone fixed
> this problem that could help.
>
> Many Thanks
> Jimleake@.hotmail.com
>
|||Also check the step-by-step guide how to troubleshoot this error a
http://support.microsoft.com/default...889#appliesto.
Dejan Sarka, SQL Server MVP
Associate Mentor
Solid Quality Learning
More than just Training
www.SolidQualityLearning.com
"jim" <jim@.discussions.microsoft.com> wrote in message
news:91D673DA-73CA-4EF1-BB77-016AC467138A@.microsoft.com...
> we installed SQL Server 2000 and a new test database, 2 groups were
created:
> BobAdmin
> BobUser
> in Active Directory Users & Computers
> and users added to each group and everything was fine,we are now getting
an
> error "Cannot Generate SSPI Context. " when we try and open the database
app
> on the workstations.
> The only change is we have changed the Main Administrator Password, would
> this affect the server or the log-on's to SQL Server and has anyone fixed
> this problem that could help.
>
> Many Thanks
> Jimleake@.hotmail.com
>

Cannot Generate SSPI Context.

we installed SQL Server 2000 and a new test database, 2 groups were created:
BobAdmin
BobUser
in Active Directory Users & Computers
and users added to each group and everything was fine,we are now getting an
error "Cannot Generate SSPI Context. " when we try and open the database app
on the workstations.
The only change is we have changed the Main Administrator Password, would
this affect the server or the log-on's to SQL Server and has anyone fixed
this problem that could help.
Many Thanks
Jimleake@.hotmail.comDoes SQL Server know about these groups?
http://www.aspfaq.com/
(Reverse address to reply.)
"jim" <jim@.discussions.microsoft.com> wrote in message
news:91D673DA-73CA-4EF1-BB77-016AC467138A@.microsoft.com...
> we installed SQL Server 2000 and a new test database, 2 groups were
created:
> BobAdmin
> BobUser
> in Active Directory Users & Computers
> and users added to each group and everything was fine,we are now getting
an
> error "Cannot Generate SSPI Context. " when we try and open the database
app
> on the workstations.
> The only change is we have changed the Main Administrator Password, would
> this affect the server or the log-on's to SQL Server and has anyone fixed
> this problem that could help.
>
> Many Thanks
> Jimleake@.hotmail.com
>|||I had a similar problem and it turned out to be a DNS issue.
Have you reviewed this article?
http://support.microsoft.com/defaul...kb;en-us;811889
"jim" <jim@.discussions.microsoft.com> wrote in message
news:91D673DA-73CA-4EF1-BB77-016AC467138A@.microsoft.com...
> we installed SQL Server 2000 and a new test database, 2 groups were
created:
> BobAdmin
> BobUser
> in Active Directory Users & Computers
> and users added to each group and everything was fine,we are now getting
an
> error "Cannot Generate SSPI Context. " when we try and open the database
app
> on the workstations.
> The only change is we have changed the Main Administrator Password, would
> this affect the server or the log-on's to SQL Server and has anyone fixed
> this problem that could help.
>
> Many Thanks
> Jimleake@.hotmail.com
>|||Large time differences between systems can also cause SSPI context failures.
Geoff N. Hiten
Microsoft SQL Server MVP
Senior Database Administrator
Careerbuilder.com
I support the Professional Association for SQL Server
www.sqlpass.org
"jim" <jim@.discussions.microsoft.com> wrote in message
news:91D673DA-73CA-4EF1-BB77-016AC467138A@.microsoft.com...
> we installed SQL Server 2000 and a new test database, 2 groups were
created:
> BobAdmin
> BobUser
> in Active Directory Users & Computers
> and users added to each group and everything was fine,we are now getting
an
> error "Cannot Generate SSPI Context. " when we try and open the database
app
> on the workstations.
> The only change is we have changed the Main Administrator Password, would
> this affect the server or the log-on's to SQL Server and has anyone fixed
> this problem that could help.
>
> Many Thanks
> Jimleake@.hotmail.com
>|||Also check the step-by-step guide how to troubleshoot this error a
http://support.microsoft.com/defaul...1889#appliesto.
Dejan Sarka, SQL Server MVP
Associate Mentor
Solid Quality Learning
More than just Training
www.SolidQualityLearning.com
"jim" <jim@.discussions.microsoft.com> wrote in message
news:91D673DA-73CA-4EF1-BB77-016AC467138A@.microsoft.com...
> we installed SQL Server 2000 and a new test database, 2 groups were
created:
> BobAdmin
> BobUser
> in Active Directory Users & Computers
> and users added to each group and everything was fine,we are now getting
an
> error "Cannot Generate SSPI Context. " when we try and open the database
app
> on the workstations.
> The only change is we have changed the Main Administrator Password, would
> this affect the server or the log-on's to SQL Server and has anyone fixed
> this problem that could help.
>
> Many Thanks
> Jimleake@.hotmail.com
>

cannot generate sspi context when server in mixed authentication m

We have a situation for which I have been trying to find an explanation for
over a week. A windows 2005 SP1 server which previously ran in Windows
authentication only suddenly caused "cannot generate sspi context" errors
after we switched it to mixed authentication mode.
-SQL service is running with domain account not trusted for delegation
-We have checked for invalid SPNs in the domain and there are none
registered for the SQL Service on this machine
-TCP/IP protocol is enabled on the server
-Named Pipes connections work fine
-After switching back to Windows authentication and clearing the ticket
cache the problem dissapears
If I understand correctly. The default authentication protocol used over
tcp/ip when connecting to SQL Server is Kerberos but if the client cannot
find a valid SPN for the SQL Service on the server then it should fall back
to NTLM. For some reason however, this is not happening as it should.
What is SQL Server service starting as...local system, domain user or domain
admin?
Kevin Hill
3NF Consulting
http://www.3nf-inc.com/NewsGroups.htm
Real-world stuff I run across with SQL Server:
http://kevin3nf.blogspot.com
"DBA72" <DBA72@.discussions.microsoft.com> wrote in message
news:65AFAA64-4847-4034-8745-211ED18ACB0E@.microsoft.com...
> We have a situation for which I have been trying to find an explanation
> for
> over a week. A windows 2005 SP1 server which previously ran in Windows
> authentication only suddenly caused "cannot generate sspi context" errors
> after we switched it to mixed authentication mode.
> -SQL service is running with domain account not trusted for delegation
> -We have checked for invalid SPNs in the domain and there are none
> registered for the SQL Service on this machine
> -TCP/IP protocol is enabled on the server
> -Named Pipes connections work fine
> -After switching back to Windows authentication and clearing the ticket
> cache the problem dissapears
> If I understand correctly. The default authentication protocol used over
> tcp/ip when connecting to SQL Server is Kerberos but if the client cannot
> find a valid SPN for the SQL Service on the server then it should fall
> back
> to NTLM. For some reason however, this is not happening as it should.
>
|||It is starting with a domain user account.
"Kevin3NF" wrote:

> What is SQL Server service starting as...local system, domain user or domain
> admin?
> --
> Kevin Hill
> 3NF Consulting
> http://www.3nf-inc.com/NewsGroups.htm
> Real-world stuff I run across with SQL Server:
> http://kevin3nf.blogspot.com
>
> "DBA72" <DBA72@.discussions.microsoft.com> wrote in message
> news:65AFAA64-4847-4034-8745-211ED18ACB0E@.microsoft.com...
>
>
|||A domain admin will need to create an SPN for the SQL Server service
manually using SetSPN or ADSI (I think)
Local system or domain admin starting sql does this automatically...domain
user does not
Kevin Hill
3NF Consulting
http://www.3nf-inc.com/NewsGroups.htm
Real-world stuff I run across with SQL Server:
http://kevin3nf.blogspot.com
"DBA72" <DBA72@.discussions.microsoft.com> wrote in message
news:F01518D8-9430-49AB-95AC-076BF1C5CF84@.microsoft.com...[vbcol=seagreen]
> It is starting with a domain user account.
> "Kevin3NF" wrote:
|||"Kevin3NF" wrote:

> A domain admin will need to create an SPN for the SQL Server service
> manually using SetSPN or ADSI (I think)
> Local system or domain admin starting sql does this automatically...domain
> user does not
> --
> Kevin Hill
> 3NF Consulting
> http://www.3nf-inc.com/NewsGroups.htm
> Real-world stuff I run across with SQL Server:
> http://kevin3nf.blogspot.com
>
> "DBA72" <DBA72@.discussions.microsoft.com> wrote in message
> news:F01518D8-9430-49AB-95AC-076BF1C5CF84@.microsoft.com...
>
Kevin,
I think you would be right if I was trying to use Kerberos but as I said,
this is not enabled for the sql service account. What I want to do is use
NTLM over tcp/ip
|||If you are getting SSPI error, something is attempting to use
Kerberos...even if that was not your intention. This is more of an Active
Directory issue than SQL Server, so I'm pretty much at the end of my
knowledge base...
Kevin Hill
3NF Consulting
http://www.3nf-inc.com/NewsGroups.htm
Real-world stuff I run across with SQL Server:
http://kevin3nf.blogspot.com
"DBA72" <DBA72@.discussions.microsoft.com> wrote in message
news:6C11E262-B916-42BA-A294-A16FD71FE5C0@.microsoft.com...
>
> "Kevin3NF" wrote:
> Kevin,
> I think you would be right if I was trying to use Kerberos but as I said,
> this is not enabled for the sql service account. What I want to do is use
> NTLM over tcp/ip

cannot generate sspi context when server in mixed authentication m

We have a situation for which I have been trying to find an explanation for
over a week. A windows 2005 SP1 server which previously ran in Windows
authentication only suddenly caused "cannot generate sspi context" errors
after we switched it to mixed authentication mode.
-SQL service is running with domain account not trusted for delegation
-We have checked for invalid SPNs in the domain and there are none
registered for the SQL Service on this machine
-TCP/IP protocol is enabled on the server
-Named Pipes connections work fine
-After switching back to Windows authentication and clearing the ticket
cache the problem dissapears
If I understand correctly. The default authentication protocol used over
tcp/ip when connecting to SQL Server is Kerberos but if the client cannot
find a valid SPN for the SQL Service on the server then it should fall back
to NTLM. For some reason however, this is not happening as it should.What is SQL Server service starting as...local system, domain user or domain
admin?
Kevin Hill
3NF Consulting
http://www.3nf-inc.com/NewsGroups.htm
Real-world stuff I run across with SQL Server:
http://kevin3nf.blogspot.com
"DBA72" <DBA72@.discussions.microsoft.com> wrote in message
news:65AFAA64-4847-4034-8745-211ED18ACB0E@.microsoft.com...
> We have a situation for which I have been trying to find an explanation
> for
> over a week. A windows 2005 SP1 server which previously ran in Windows
> authentication only suddenly caused "cannot generate sspi context" errors
> after we switched it to mixed authentication mode.
> -SQL service is running with domain account not trusted for delegation
> -We have checked for invalid SPNs in the domain and there are none
> registered for the SQL Service on this machine
> -TCP/IP protocol is enabled on the server
> -Named Pipes connections work fine
> -After switching back to Windows authentication and clearing the ticket
> cache the problem dissapears
> If I understand correctly. The default authentication protocol used over
> tcp/ip when connecting to SQL Server is Kerberos but if the client cannot
> find a valid SPN for the SQL Service on the server then it should fall
> back
> to NTLM. For some reason however, this is not happening as it should.
>

cannot generate SSPI context on Win XP machine

I am running sql server 2005 developper edition on a Windows XP Sp2 machine
that is part of a domain.
I am getting the cannot generate SSPI context error when I am trying to
connect via integrated security. I can connect using username and password.
I looked at the docs but found that the setspn utility is only for servers
(w2k w2003 etc). How do I fix this problem on a Windows XP machine.
Thanks for any help
Bob
Trying to connect from what client to what server using
integrated security? Is this a local connection - just
connecting to the SQL Server on your machine?
Are the services running under a domain account or a built
in account?
-Sue
On Thu, 3 May 2007 12:39:59 -0400, "Robert Dufour"
<bdufour@.sgiims.com> wrote:

>I am running sql server 2005 developper edition on a Windows XP Sp2 machine
>that is part of a domain.
>I am getting the cannot generate SSPI context error when I am trying to
>connect via integrated security. I can connect using username and password.
>I looked at the docs but found that the setspn utility is only for servers
>(w2k w2003 etc). How do I fix this problem on a Windows XP machine.
>Thanks for any help
>Bob
>

cannot generate SSPI context on Win XP machine

I am running sql server 2005 developper edition on a Windows XP Sp2 machine
that is part of a domain.
I am getting the cannot generate SSPI context error when I am trying to
connect via integrated security. I can connect using username and password.
I looked at the docs but found that the setspn utility is only for servers
(w2k w2003 etc). How do I fix this problem on a Windows XP machine.
Thanks for any help
BobTrying to connect from what client to what server using
integrated security? Is this a local connection - just
connecting to the SQL Server on your machine?
Are the services running under a domain account or a built
in account?
-Sue
On Thu, 3 May 2007 12:39:59 -0400, "Robert Dufour"
<bdufour@.sgiims.com> wrote:

>I am running sql server 2005 developper edition on a Windows XP Sp2 machine
>that is part of a domain.
>I am getting the cannot generate SSPI context error when I am trying to
>connect via integrated security. I can connect using username and password.
>I looked at the docs but found that the setspn utility is only for servers
>(w2k w2003 etc). How do I fix this problem on a Windows XP machine.
>Thanks for any help
>Bob
>

Cannot generate SSPI context on laptop from different domain

Hi All,
I have Domain A with several SQL servers installed. One WinXP Pro laptop
user reports that he can't connect to any SQL server instances using Windows
authentication (the servers run win2k3 OS SP1 with SQL 2000 sp4 & 2005 sp1)
and gets the error:
Cannot generate SSPI context. (.Net SqlClient Data Provider)
His laptop is unique in that it's part of another domain, Domain B which has
no trust relationship with Domain A, nor should it. When he is in the office
at Domain A, he logs in to his laptop using cached domain credentials for
Domain B,and has entered a Managed Network Password entry for the SQL server
s
in Domain A.
It appears that if I have him log into his laptop using a local account
rather than his domain account (from Domain B) the Managed Network Password
entry works and he can successfully connect to the SQL servers on Domain A.
Any suggestions on how I can get the Windows security token of the user
account to successfully connect to SQL Server in this situation where he is
using cached domain credentials (Domain B) with a Managed Network Password
(For Domain A). I would prefer not to make a trust between the domains while
still allowing him to connect to SQL using his existing laptop profile.
Thanks!Hi,
I understand that you would like to establish a connection from your laptop
computer in domain B to your SQL Server instance in domain A. The two
separated domains are non-trusted.
If I have misunderstood, please let me know.
As far as I know, if two separated domains have no trust relationship, any
one of the two domains could not connect to the other's SQL Server
instances with Windows Authentication by using its peer domain's user
account. To establish a connection, you can create a same local user
account with the same password on both of the computers which belong to the
two different domains. Cached domain account may have permission to access
the share resources in domain B; however it could not be used to connect to
SQL Server instance. That is not secure.
Appreciate your understanding on this limitation. If you have any other
questions or concerns, please feel free to let us know. Have a good day!
Best regards,
Charles Wang
Microsoft Online Community Support
========================================
=============
Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscript...ault.aspx#notif
ications
If you are using Outlook Express, please make sure you clear the check box
"Tools/Options/Read: Get 300 headers at a time" to see your reply promptly.
Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscript...t/default.aspx.
========================================
==============
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from this issue.
========================================
==============
This posting is provided "AS IS" with no warranties, and confers no rights.
========================================
==============|||Hi,
I am interested in this issue. Would you mind letting me know the result of
the suggestions? If you need further assistance, feel free to let me know.
I will be more than happy to be of assistance.
Charles Wang
Microsoft Online Community Support
========================================
==============
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from this issue.
========================================
==============
This posting is provided "AS IS" with no warranties, and confers no rights.
========================================
==============|||Hey Charles,
Thanks for the suggestion and explanation.
If I understand the workaround you suggest it's similar to the workaround I
implemented in that the user logs into his laptop using a local account
rather than his domain account (cached from Domain B), I then added a Manage
d
Network Password entry for a domain user account for the user in Domain A an
d
he can then successfully connect to the SQL servers on Domain A.
The problem is caused by the fact that the laptop is part of Domain B and
there is no trust relationship set up between the domains. I wanted to solve
the problem by getting the Managed Network Password entry to work while he i
s
logged in to his laptop with his domain account cached from Domain B.
However, I understand from your explanation that this is not feasible.
"Charles Wang[MSFT]" wrote:

> Hi,
> I am interested in this issue. Would you mind letting me know the result o
f
> the suggestions? If you need further assistance, feel free to let me know.
> I will be more than happy to be of assistance.
> Charles Wang
> Microsoft Online Community Support
> ========================================
==============
> When responding to posts, please "Reply to Group" via
> your newsreader so that others may learn and benefit
> from this issue.
> ========================================
==============
> This posting is provided "AS IS" with no warranties, and confers no rights
.
> ========================================
==============
>|||Hi Matt,
Thanks for your response.
Appreciate your understanding that this is a by design limitation. If it is
allowed, SQL Server may face many security issues. At least a simple
scenario that we can imagine is that any other users can use this cache
accout to attack SQL Server.
Your workaround is similar as my suggested workaround. Both of them are
safe, since any user who wants to use the user account to log in SQL Server
must know the correct password. For a cache account, we may just know its
user name, but do not know its password, so there may be potential security
problem if it is allowed to be used to connect to SQL Server.
Please feel free to let me know if you need further assistance on this
issue. Have a good day!
Best regards,
Charles Wang
Microsoft Online Community Support
========================================
=============
Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscript...ault.aspx#notif
ications
If you are using Outlook Express, please make sure you clear the check box
"Tools/Options/Read: Get 300 headers at a time" to see your reply promptly.
Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscript...t/default.aspx.
========================================
==============
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from this issue.
========================================
==============
This posting is provided "AS IS" with no warranties, and confers no rights.
========================================
==============

Cannot generate SSPI context on laptop from different domain

Hi All,
I have Domain A with several SQL servers installed. One WinXP Pro laptop
user reports that he can't connect to any SQL server instances using Windows
authentication (the servers run win2k3 OS SP1 with SQL 2000 sp4 & 2005 sp1)
and gets the error:
Cannot generate SSPI context. (.Net SqlClient Data Provider)
His laptop is unique in that it's part of another domain, Domain B which has
no trust relationship with Domain A, nor should it. When he is in the office
at Domain A, he logs in to his laptop using cached domain credentials for
Domain B,and has entered a Managed Network Password entry for the SQL servers
in Domain A.
It appears that if I have him log into his laptop using a local account
rather than his domain account (from Domain B) the Managed Network Password
entry works and he can successfully connect to the SQL servers on Domain A.
Any suggestions on how I can get the Windows security token of the user
account to successfully connect to SQL Server in this situation where he is
using cached domain credentials (Domain B) with a Managed Network Password
(For Domain A). I would prefer not to make a trust between the domains while
still allowing him to connect to SQL using his existing laptop profile.
Thanks!
Hi,
I understand that you would like to establish a connection from your laptop
computer in domain B to your SQL Server instance in domain A. The two
separated domains are non-trusted.
If I have misunderstood, please let me know.
As far as I know, if two separated domains have no trust relationship, any
one of the two domains could not connect to the other's SQL Server
instances with Windows Authentication by using its peer domain's user
account. To establish a connection, you can create a same local user
account with the same password on both of the computers which belong to the
two different domains. Cached domain account may have permission to access
the share resources in domain B; however it could not be used to connect to
SQL Server instance. That is not secure.
Appreciate your understanding on this limitation. If you have any other
questions or concerns, please feel free to let us know. Have a good day!
Best regards,
Charles Wang
Microsoft Online Community Support
================================================== ===
Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications
If you are using Outlook Express, please make sure you clear the check box
"Tools/Options/Read: Get 300 headers at a time" to see your reply promptly.
Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
================================================== ====
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from this issue.
================================================== ====
This posting is provided "AS IS" with no warranties, and confers no rights.
================================================== ====
|||Hi,
I am interested in this issue. Would you mind letting me know the result of
the suggestions? If you need further assistance, feel free to let me know.
I will be more than happy to be of assistance.
Charles Wang
Microsoft Online Community Support
================================================== ====
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from this issue.
================================================== ====
This posting is provided "AS IS" with no warranties, and confers no rights.
================================================== ====
|||Hey Charles,
Thanks for the suggestion and explanation.
If I understand the workaround you suggest it's similar to the workaround I
implemented in that the user logs into his laptop using a local account
rather than his domain account (cached from Domain B), I then added a Managed
Network Password entry for a domain user account for the user in Domain A and
he can then successfully connect to the SQL servers on Domain A.
The problem is caused by the fact that the laptop is part of Domain B and
there is no trust relationship set up between the domains. I wanted to solve
the problem by getting the Managed Network Password entry to work while he is
logged in to his laptop with his domain account cached from Domain B.
However, I understand from your explanation that this is not feasible.
"Charles Wang[MSFT]" wrote:

> Hi,
> I am interested in this issue. Would you mind letting me know the result of
> the suggestions? If you need further assistance, feel free to let me know.
> I will be more than happy to be of assistance.
> Charles Wang
> Microsoft Online Community Support
> ================================================== ====
> When responding to posts, please "Reply to Group" via
> your newsreader so that others may learn and benefit
> from this issue.
> ================================================== ====
> This posting is provided "AS IS" with no warranties, and confers no rights.
> ================================================== ====
>
|||Hi Matt,
Thanks for your response.
Appreciate your understanding that this is a by design limitation. If it is
allowed, SQL Server may face many security issues. At least a simple
scenario that we can imagine is that any other users can use this cache
accout to attack SQL Server.
Your workaround is similar as my suggested workaround. Both of them are
safe, since any user who wants to use the user account to log in SQL Server
must know the correct password. For a cache account, we may just know its
user name, but do not know its password, so there may be potential security
problem if it is allowed to be used to connect to SQL Server.
Please feel free to let me know if you need further assistance on this
issue. Have a good day!
Best regards,
Charles Wang
Microsoft Online Community Support
================================================== ===
Get notification to my posts through email? Please refer to:
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications
If you are using Outlook Express, please make sure you clear the check box
"Tools/Options/Read: Get 300 headers at a time" to see your reply promptly.
Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
================================================== ====
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from this issue.
================================================== ====
This posting is provided "AS IS" with no warranties, and confers no rights.
================================================== ====

Cannot generate SSPI Context error

I have a recurring problem with the "Cannot generate SSPI context" error. It
works fine for some time, but then it stops working. Generally after half an
hour - two hours time. A logoff/logon always fixes the problem.
I have reviewed the 811889 article, but this doesn't help me. The connection
to the SQL server works fine, but at some time it is like the user looses hi
s
credentials and then can't connect and SSPI won't reconnect him.
Some basic info:
Server is Windows 2000 server SP1 with AD. (was SP4 earlier, with the same
problem, so upgrading to SP4 will not solve the problem by itself. The serve
r
has just been reinstalled from scratch, not finished SPs and updates yet)
SQL Server is MSDE, client logging on with NT security, SQL Server is
installed on the same physical server as the domain controller (only one
domain controller exists)
Client is XP PRO, same problem with SP2 or without SP2
User on client is logged on to domain with Admin+Domain admin privileges
Problem does not exist if client does not log on to domain
Anybody got any ideas on how to solve this problem?
PeterPeter
Where did it happen in an application or when you log in in EM/QA?
If it happend on ther client side , so perhaps some piece of code closes
connection. Can you run SQL Server Profiler to capture what is going on
during a half-two hours?
"Peter B.L. Rasmussen" <PeterBLRasmussen@.discussions.microsoft.com> wrote in
message news:8C22E3CE-23E5-48AB-A30B-22A0506829E2@.microsoft.com...
> I have a recurring problem with the "Cannot generate SSPI context" error.
It
> works fine for some time, but then it stops working. Generally after half
an
> hour - two hours time. A logoff/logon always fixes the problem.
> I have reviewed the 811889 article, but this doesn't help me. The
connection
> to the SQL server works fine, but at some time it is like the user looses
his
> credentials and then can't connect and SSPI won't reconnect him.
> Some basic info:
> Server is Windows 2000 server SP1 with AD. (was SP4 earlier, with the
same
> problem, so upgrading to SP4 will not solve the problem by itself. The
server
> has just been reinstalled from scratch, not finished SPs and updates yet)
> SQL Server is MSDE, client logging on with NT security, SQL Server is
> installed on the same physical server as the domain controller (only one
> domain controller exists)
> Client is XP PRO, same problem with SP2 or without SP2
> User on client is logged on to domain with Admin+Domain admin privileges
> Problem does not exist if client does not log on to domain
> Anybody got any ideas on how to solve this problem?
> Peter
>|||It happens Client-Side, in my application (VB.NET), when I am not working in
the application for some time. Then when the application (or the IDE) tries
to open a connection, it happens. If I keep the connection "alive" by workin
g
in the application (or in the development IDE), it does not happen.
Peter
"Uri Dimant" wrote:

> Peter
> Where did it happen in an application or when you log in in EM/QA?
> If it happend on ther client side , so perhaps some piece of code closes
> connection. Can you run SQL Server Profiler to capture what is going on
> during a half-two hours?
>
>
> "Peter B.L. Rasmussen" <PeterBLRasmussen@.discussions.microsoft.com> wrote
in
> message news:8C22E3CE-23E5-48AB-A30B-22A0506829E2@.microsoft.com...
> It
> an
> connection
> his
> same
> server
>
>|||Peter
Perhaps it is because ADO.NET keeps pool connection by default. Have you ran
SQL Server Profiler?
"Peter B.L. Rasmussen" <PeterBLRasmussen@.discussions.microsoft.com> wrote in
message news:422DFB2A-B95E-4309-B43A-5BD64EBDC093@.microsoft.com...
> It happens Client-Side, in my application (VB.NET), when I am not working
in
> the application for some time. Then when the application (or the IDE)
tries
> to open a connection, it happens. If I keep the connection "alive" by
working[vbcol=seagreen]
> in the application (or in the development IDE), it does not happen.
> Peter
> "Uri Dimant" wrote:
>
closes[vbcol=seagreen]
wrote in[vbcol=seagreen]
error.[vbcol=seagreen]
half[vbcol=seagreen]
looses[vbcol=seagreen]
yet)[vbcol=seagreen]
one[vbcol=seagreen]
privileges[vbcol=seagreen]|||No, I haven't run SQL Server Profiler. Do I have it on MDSE?
"Uri Dimant" wrote:

> Peter
> Perhaps it is because ADO.NET keeps pool connection by default. Have you r
an
> SQL Server Profiler?
> "Peter B.L. Rasmussen" <PeterBLRasmussen@.discussions.microsoft.com> wrote
in
> message news:422DFB2A-B95E-4309-B43A-5BD64EBDC093@.microsoft.com...
> in
> tries
> working
> closes
> wrote in
> error.
> half
> looses
> yet)
> one
> privileges
>
>|||No, I haven't run SQL Server Profiler. Do I have it on MSDE?
"Uri Dimant" wrote:

> Peter
> Perhaps it is because ADO.NET keeps pool connection by default. Have you r
an
> SQL Server Profiler?
> "Peter B.L. Rasmussen" <PeterBLRasmussen@.discussions.microsoft.com> wrote
in
> message news:422DFB2A-B95E-4309-B43A-5BD64EBDC093@.microsoft.com...
> in
> tries
> working
> closes
> wrote in
> error.
> half
> looses
> yet)
> one
> privileges
>
>|||Profiler won't help you tshoot the problem. You need to make network
traces to diagnose where it is failing. An alternative is to change the
client to use Named Pipes to connect. Named Pipes connections are able to
natively impersonate the client without calling the SSPI API.
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.|||Hi Kevin,
Yes, changing to Named Pipes will connect. But I would rather solve the
problem than work around it and learn something in the process. As this
problem only occurs on my development platform, and not at the production
site, I am hesitant on changing the program just to accomodate some troubles
on my site.
I don't know how to make a network trace.
Today I cannot connect at all - even after a windows logoff/logon. I have
found out that I have some old ADODB code in my program that actually
connects fine, and the connection problem only lies in .NET code connections
.
If I use ADODB.ConnectionClass
And this connection string:
Provider=SQLOLEDB;Data Source=W2KServer1\VSdotNET;
Initial Catalog=Sugro011104;Integrated Security=SSPI
I can connect without any problems.
If I use System.Data.SqlClient.SqlConnection
And this Connection String:
data source=W2KServer1\VSdotNET;
initial catalog=Sugro011104;
integrated security=SSPI;
persist security info=True;
workstation id=WORKSTATION2;
packet size=4096
I cannot connect.
So maybe the solution to the problem lies somewhere in the .Net framework?
Peter
"Kevin McDonnell [MSFT]" wrote:

> Profiler won't help you tshoot the problem. You need to make network
> traces to diagnose where it is failing. An alternative is to change the
> client to use Named Pipes to connect. Named Pipes connections are able to
> natively impersonate the client without calling the SSPI API.
> Thanks,
> Kevin McDonnell
> Microsoft Corporation
> This posting is provided AS IS with no warranties, and confers no rights.
>
>|||Hi Peter,
Sorry, looking at your code won't solve the problem. The best tools to
troubleshoot this are:
1. Network traces.
2. Netdiag.exe
To impersonate the client over TCP, we have to establish an additional
session with the DC. This is where it is failing.
It has really nothing to do with SQL or your code per say. Netdiag can be
use to see if there are problems communicating with the DNS server
and/or the Domain Controller. This is where you need to focus.
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.|||Solved.
There was apparently something wrong with my Windows Installation. Stepping
bact two steps with (System Restore? I don't know if that's what it is calle
d
in english-language Windows. The feature that lets you undo installations
etc.) solved the problem.
Peter
"Kevin McDonnell [MSFT]" wrote:

> Hi Peter,
> Sorry, looking at your code won't solve the problem. The best tools to
> troubleshoot this are:
> 1. Network traces.
> 2. Netdiag.exe
> To impersonate the client over TCP, we have to establish an additional
> session with the DC. This is where it is failing.
> It has really nothing to do with SQL or your code per say. Netdiag can be
> use to see if there are problems communicating with the DNS server
> and/or the Domain Controller. This is where you need to focus.
>
> Kevin McDonnell
> Microsoft Corporation
> This posting is provided AS IS with no warranties, and confers no rights.
>
>

Cannot generate SSPI context and Windows 2000 service pack 4

Try these
http://support.microsoft.com/default.aspx?scid=kb;en-
us;814401
http://support.microsoft.com/default.aspx?scid=kb;en-
us;811889
HTH
>--Original Message--
>We have had two instances of installing Windows 2000
Service Pack 4 [*] on machines running SQL Server 2000
SP3a+HF and subsequently seeing errors from SQL Server
client tools (QA and Enterprise Manager):
> Cannot generate SSPI context
>SETSPN -L shows a valid service principle name, and the
other options in KB 811889 have been tried. We are using a
domain user account as the service account for SQL Server.
>What else can we look for to resolve this problem please?
>
>[*] re-building the machine with SP3 and the problem does
not appear. We need W2K SP4 for SQL Server Reporting
Services.
>
>.
>Thanks Ray, but you might have missed the reference in my original email to
KB 811889, we have tried all the suggested resolutions in this KB article, e
xcept contacting PSS to open a case, we're trying this avenue first :-)
The machine in question is a member of the domain and is able to connect to
other domain members and accepts Terminal Services connections (and NTLM aut
henticated HTTP and telnet) without problem, the problem seems to occur spec
ifically with authenticatin
g SQL Server tools and only happens after W2K SP4 is installed.
-- Ray Higdon wrote: --
Try these
http://support.microsoft.com/defaul...kb;en-us;814401
http://support.microsoft.com/defaul...kb;en-us;811889

Cannot generate SSPI context and Windows 2000 service pack 4

We have had two instances of installing Windows 2000 Service Pack 4 [*]
on machines running SQL Server 2000 SP3a+HF and subsequently seeing errors f
rom SQL Server client tools (QA and Enterprise Manager):
Cannot generate SSPI context
SETSPN -L shows a valid service principle name, and the other options in KB
811889 have been tried. We are using a domain user account as the service ac
count for SQL Server.
What else can we look for to resolve this problem please?
[*] re-building the machine with SP3 and the problem does not appear. We
need W2K SP4 for SQL Server Reporting Services.This happens because of a Kerberos authentication protocol issue, I would
suggest you to do the following things
1. Enable Kerberos logging on the client machine (documented at
http://support.microsoft.com/defaul...kb;EN-US;262177). Now try to
connect to the remote SQL Server, if you get the same error message then
check the SYSTEM eventlog. You would find Kerberos failure events which give
you good information about what went wrong.
2. If there are no Kerberos errors on the client machines, you could be
having some error messages on the APPLICATION eventlog of the SQL Server
machine which will say that the SQL Server couldnot decrypt the login
packets from the clients which implies that there are multiple SPNs
registered and the AD picked a wrong one. You can find all the registered
SPNs in your AD by using the command
ldifde -d "CN=Users,DC=betaland" -l servicePrincipalName -F
NewoutputUsers.txt
and then clean up the redundant ones. This is explained in
http://support.microsoft.com/?id=319723
Thanks,
Bala.
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Nigel Williams" <nwilliams@.fictitious.kom> wrote in message
news:DE140101-7F0E-4AE1-86DC-626028B66D5D@.microsoft.com...
> We have had two instances of installing Windows 2000 Service Pack 4 [*] on[/co
lor]
machines running SQL Server 2000 SP3a+HF and subsequently seeing errors from
SQL Server client tools (QA and Enterprise Manager):
> Cannot generate SSPI context
> SETSPN -L shows a valid service principle name, and the other options in
KB 811889 have been tried. We are using a domain user account as the service
account for SQL Server.
> What else can we look for to resolve this problem please?
>
> [*] re-building the machine with SP3 and the problem does not appear. We[/colo
r]
need W2K SP4 for SQL Server Reporting Services.
>

cannot generate SSPI context - time out at client

Hi ,
My client has once again got the "cannot generate SSPI context" error and
this time i managed to notice that the time on the client is abt 20 mins
earlier than that of the server.
How can i synch the time bet the client & the server ? and prevent it from
happening again
apreciate ur advise
tks & rdgs
Message posted via droptable.com
http://www.droptable.com/Uwe/Forum...curity/200512/1Time synchronization is usually done by the Windows Time Service. By
default, time synchronization is done using the standard AD hierarchy.
Clients and member servers get their time from a domain controller in their
domain. Domain controllers get their time from a domain controller in their
parent domain. Forrest root domain controllers are ultimately used as the
time source and use either a hardware clock or NTP source.

> How can i synch the time bet the client & the server ?
One method to resync the time is with the w32tm.exe: w32tm.exe /resync
Another method is with the NET TIME command: NET TIME /DOMAIN:MyDomain /SET

> and prevent it from happening again
See the technet article below for a discussion of the Windows Time Service:
http://www.microsoft.com/technet/pr...0f8236e210.mspx
Happy Holidays
Dan Guzman
SQL Server MVP
"maxzsim via droptable.com" <u14644@.uwe> wrote in message
news:599906d9830e0@.uwe...
> Hi ,
> My client has once again got the "cannot generate SSPI context" error and
> this time i managed to notice that the time on the client is abt 20 mins
> earlier than that of the server.
> How can i synch the time bet the client & the server ? and prevent it from
> happening again
> apreciate ur advise
> tks & rdgs
> --
> Message posted via droptable.com
> http://www.droptable.com/Uwe/Forum...curity/200512/1

Cannot generate SSPI Context - HOW TO TURN OF KERBEROS ON CLIENT

Hi
God damn I have gotta lot of mess due to the "Cannot generate SSPI Context",
clipping my connection to the SQL server (connection OK in 40 - 60 minutes
then "poff" SSPI Context fails.
My environment is as follows.
- Domain recently converted to AD (SQL server also in AD)
- MS SQL 7.0 on Windows 2000 server
- WinXP sp 2 on (most) clients
- Access 2003 on (most) clients
I develop and publish an Access application which run against several db's
on the SQL server. Seems like I'm the only one having the "Cannot generate
SSPI Context" trouble yet. As I learn from different articles on the net,
it's most likely due to some Kerberos security stuff.
How can I turn that thing off, and access our SQL server on the lowest level
of security (with trusted connection). We have firewalls all over the place
protecting us from the outside, and none of our employees have brains to
access the SQL server and do any damage to it through a data connection.
Please anyone!!!
Mr. Smith
Check your time synch and DNS resolution. SSPI context issues can arise
from either of those not working correctly.
Geoff N. Hiten
Microsoft SQL Server MVP
"Mr. Smith" <nospam@.blindfolded.gone> wrote in message
news:OSH1P8iSFHA.1236@.TK2MSFTNGP14.phx.gbl...
> Hi
> God damn I have gotta lot of mess due to the "Cannot generate SSPI
> Context", clipping my connection to the SQL server (connection OK in 40 -
> 60 minutes then "poff" SSPI Context fails.
>
> My environment is as follows.
> - Domain recently converted to AD (SQL server also in AD)
> - MS SQL 7.0 on Windows 2000 server
> - WinXP sp 2 on (most) clients
> - Access 2003 on (most) clients
>
> I develop and publish an Access application which run against several db's
> on the SQL server. Seems like I'm the only one having the "Cannot generate
> SSPI Context" trouble yet. As I learn from different articles on the net,
> it's most likely due to some Kerberos security stuff.
>
> How can I turn that thing off, and access our SQL server on the lowest
> level of security (with trusted connection). We have firewalls all over
> the place protecting us from the outside, and none of our employees have
> brains to access the SQL server and do any damage to it through a data
> connection.
>
> Please anyone!!!
>
> Mr. Smith
>

Cannot generate SSPI Context - HOW TO TURN OF KERBEROS ON CLIENT

Hi
God damn I have gotta lot of mess due to the "Cannot generate SSPI Context",
clipping my connection to the SQL server (connection OK in 40 - 60 minutes
then "poff" SSPI Context fails.
My environment is as follows.
- Domain recently converted to AD (SQL server also in AD)
- MS SQL 7.0 on Windows 2000 server
- WinXP sp 2 on (most) clients
- Access 2003 on (most) clients
I develop and publish an Access application which run against several db's
on the SQL server. Seems like I'm the only one having the "Cannot generate
SSPI Context" trouble yet. As I learn from different articles on the net,
it's most likely due to some Kerberos security stuff.
How can I turn that thing off, and access our SQL server on the lowest level
of security (with trusted connection). We have firewalls all over the place
protecting us from the outside, and none of our employees have brains to
access the SQL server and do any damage to it through a data connection.
Please anyone!!!
Mr. SmithCheck your time synch and DNS resolution. SSPI context issues can arise
from either of those not working correctly.
Geoff N. Hiten
Microsoft SQL Server MVP
"Mr. Smith" <nospam@.blindfolded.gone> wrote in message
news:OSH1P8iSFHA.1236@.TK2MSFTNGP14.phx.gbl...
> Hi
> God damn I have gotta lot of mess due to the "Cannot generate SSPI
> Context", clipping my connection to the SQL server (connection OK in 40 -
> 60 minutes then "poff" SSPI Context fails.
>
> My environment is as follows.
> - Domain recently converted to AD (SQL server also in AD)
> - MS SQL 7.0 on Windows 2000 server
> - WinXP sp 2 on (most) clients
> - Access 2003 on (most) clients
>
> I develop and publish an Access application which run against several db's
> on the SQL server. Seems like I'm the only one having the "Cannot generate
> SSPI Context" trouble yet. As I learn from different articles on the net,
> it's most likely due to some Kerberos security stuff.
>
> How can I turn that thing off, and access our SQL server on the lowest
> level of security (with trusted connection). We have firewalls all over
> the place protecting us from the outside, and none of our employees have
> brains to access the SQL server and do any damage to it through a data
> connection.
>
> Please anyone!!!
>
> Mr. Smith
>