I have a Linked Server from SQL 2005 to a SQL 2000 server. I have it
configured to use delegation. This will work fine for a while and then
suddenly stop working. Sometimes it works for an hour, sometimes for a day.
I have to restart the SQL 2005 server and it will begin to work again. The
error is:
TCP Provider: An existing connection was forcibly closed by the remote host.
Login failed for user '(null)'. Reason: Not associated with a trusted SQL
Server connection.
Any ideas?A few others have reported similar issues - with no
solutions. I worked at a place where we had delegation
sporadically failing and then working after reboots. A
ticket was opened with Microsoft but the issue was never
resolved. I would guess it's a Kerberos issue, not a SQL
issue. Make sure AD is clean and you don't have duplicate or
bad SPNs for all machines involved. Make sure all machines
involved have times sync working correctly, using the same
time server.
I'd suggest getting the Kerberos Delegation troubleshooting
doc available at:
http://www.microsoft.com/downloads/...&DisplayLang=en
We also installed a tool that would do verbose logging for
Kerberos errors - I just looked and couldn't find the tool.
Maybe if someone else knows they will jump in and provide a
link for that tool.
It can be a difficult issue to troubleshoot and you may want
to consider opening up a support ticket with Microsoft
Product Support.
-Sue
On Wed, 16 Aug 2006 12:43:01 -0700, Sheriff
<Sheriff@.discussions.microsoft.com> wrote:
>I have a Linked Server from SQL 2005 to a SQL 2000 server. I have it
>configured to use delegation. This will work fine for a while and then
>suddenly stop working. Sometimes it works for an hour, sometimes for a day
.
>I have to restart the SQL 2005 server and it will begin to work again. The
>error is:
>TCP Provider: An existing connection was forcibly closed by the remote host
.
>Login failed for user '(null)'. Reason: Not associated with a trusted SQL
>Server connection.
>Any ideas?|||Is there a solution for this issue.
delegation on linked server fails in our network when we use
nt-authenticated logins. we have a sql server 2000 nodes (n1,n2) on win 2003
cluster.
Any thots,hints,links,pointers appreciated
thanks,
GA
"Sue Hoegemeier" wrote:
> A few others have reported similar issues - with no
> solutions. I worked at a place where we had delegation
> sporadically failing and then working after reboots. A
> ticket was opened with Microsoft but the issue was never
> resolved. I would guess it's a Kerberos issue, not a SQL
> issue. Make sure AD is clean and you don't have duplicate or
> bad SPNs for all machines involved. Make sure all machines
> involved have times sync working correctly, using the same
> time server.
> I'd suggest getting the Kerberos Delegation troubleshooting
> doc available at:
> http://www.microsoft.com/downloads/...&DisplayLang=en
> We also installed a tool that would do verbose logging for
> Kerberos errors - I just looked and couldn't find the tool.
> Maybe if someone else knows they will jump in and provide a
> link for that tool.
> It can be a difficult issue to troubleshoot and you may want
> to consider opening up a support ticket with Microsoft
> Product Support.
> -Sue
> On Wed, 16 Aug 2006 12:43:01 -0700, Sheriff
> <Sheriff@.discussions.microsoft.com> wrote:
>
>|||Are you having a completely different issue?
This post was about delegation working and then suddenly
failing until a reboot. Is this your issue?
-Sue
On Sun, 27 Aug 2006 12:23:01 -0700, DallasBlue
<DallasBlue@.discussions.microsoft.com> wrote:
[vbcol=seagreen]
>Is there a solution for this issue.
>delegation on linked server fails in our network when we use
>nt-authenticated logins. we have a sql server 2000 nodes (n1,n2) on win 200
3
>cluster.
>Any thots,hints,links,pointers appreciated
>thanks,
>GA
>"Sue Hoegemeier" wrote:
>|||looks like it works for few minutes when restarted the nodes...
"Sue Hoegemeier" wrote:
> Are you having a completely different issue?
> This post was about delegation working and then suddenly
> failing until a reboot. Is this your issue?
> -Sue
> On Sun, 27 Aug 2006 12:23:01 -0700, DallasBlue
> <DallasBlue@.discussions.microsoft.com> wrote:
>
>|||yes, when we restat the nodes the kerberos delegation starts to work for few
minutes and then stops with the 'login failed reason (null)' error...
"Sue Hoegemeier" wrote:
> Are you having a completely different issue?
> This post was about delegation working and then suddenly
> failing until a reboot. Is this your issue?
> -Sue
> On Sun, 27 Aug 2006 12:23:01 -0700, DallasBlue
> <DallasBlue@.discussions.microsoft.com> wrote:
>
>|||So then you followed everything in the troubleshooting
delegation doc? No one has every really posted any
resolution. I had posted a lot of steps Microsoft will have
you do when/if you open a ticket. That's about all I know
about it. It's not really a SQL issue, it's a kerberos
issue. Whether it's AD problems or issues with tickets
expiring, it's hard to say.
-Sue
On Tue, 29 Aug 2006 14:38:02 -0700, DallasBlue
<DallasBlue@.discussions.microsoft.com> wrote:
[vbcol=seagreen]
>yes, when we restat the nodes the kerberos delegation starts to work for fe
w
>minutes and then stops with the 'login failed reason (null)' error...
>"Sue Hoegemeier" wrote:
>|||do have a ticket open with microsoft for more than a month now, but no
resolution yet. "Troubleshooting Kerberos delation" is nearly a 90 page doc.
tried a lot of things nothing seems to fix it...
"Sue Hoegemeier" wrote:
> So then you followed everything in the troubleshooting
> delegation doc? No one has every really posted any
> resolution. I had posted a lot of steps Microsoft will have
> you do when/if you open a ticket. That's about all I know
> about it. It's not really a SQL issue, it's a kerberos
> issue. Whether it's AD problems or issues with tickets
> expiring, it's hard to say.
> -Sue
> On Tue, 29 Aug 2006 14:38:02 -0700, DallasBlue
> <DallasBlue@.discussions.microsoft.com> wrote:
>
>|||Yup...a client site I was at had the issue and an open case
with PSS. At first I thought it was expiring tickets causing
the problem but then it looked more like it could be
duplicate/bad SPNs. We'd clean out AD and then find
duplicate SPNs errors after removing all dupes. Don't know
what else to tell you - I haven't seen anyone who has a
ticket open post a solution. And the place I was at never
got a resolution to the problem either.
-Sue
On Wed, 30 Aug 2006 14:50:03 -0700, DallasBlue
<DallasBlue@.discussions.microsoft.com> wrote:
[vbcol=seagreen]
>do have a ticket open with microsoft for more than a month now, but no
>resolution yet. "Troubleshooting Kerberos delation" is nearly a 90 page doc
.
>tried a lot of things nothing seems to fix it...
>"Sue Hoegemeier" wrote:
>|||Things started working with the double hop after forcing the kerberos to use
TCP instead of UDP as in the article 244474 at
support.microsoft.com/kb/244474/
"Sue Hoegemeier" wrote:
> Yup...a client site I was at had the issue and an open case
> with PSS. At first I thought it was expiring tickets causing
> the problem but then it looked more like it could be
> duplicate/bad SPNs. We'd clean out AD and then find
> duplicate SPNs errors after removing all dupes. Don't know
> what else to tell you - I haven't seen anyone who has a
> ticket open post a solution. And the place I was at never
> got a resolution to the problem either.
> -Sue
> On Wed, 30 Aug 2006 14:50:03 -0700, DallasBlue
> <DallasBlue@.discussions.microsoft.com> wrote:
>
>
Showing posts with label delegation. Show all posts
Showing posts with label delegation. Show all posts
Thursday, March 22, 2012
Delegation stops working after a while
I have a linked server set up between two servers (A & B).
Server A is running 2005 and Server B is running 2000.
Both servers SQL services are running using a domain user account and have
their SPN's registered in the AD.
The client connects to Server A using integrated security (TCP/IP and
Kerberos not NTLM) and runs disributed queries using the linked server to
server B.
Delegation is set up in the AD and is working, at least for some time.
After a while (sometimes a couple of minutes, sometimes a couple of hours)
the delegation seems to stop working and the client recieves the error
"Login
failed for user '(null)'. Reason: Not associated with a trusted SQL Server
connection." The client is still connected and authenticated using TCP/IP
and
Kerberos.
After a restart of SQL Server on server A the delegation starts working
again.
I cannt find anything in the eventlogs on either one of the servers or the
client, and nothing in the sql server logs.
Does anybody have any idea of what could be wrong, or give me a though on
where to start looking.
Thanks
/MattiasWe are encountering this problem also. I have contacted MS but they are
still gathering information.
There is at least one other unanswered post on this here as well, see
subject = "SQL2005 Linked server authentication drops".
Are you running sql server under under a domain account that is not in the
local admins group by any chance?
--
-b
"Mattias" wrote:
> I have a linked server set up between two servers (A & B).
> Server A is running 2005 and Server B is running 2000.
> Both servers SQL services are running using a domain user account and have
> their SPN's registered in the AD.
> The client connects to Server A using integrated security (TCP/IP and
> Kerberos not NTLM) and runs disributed queries using the linked server to
> server B.
> Delegation is set up in the AD and is working, at least for some time.
> After a while (sometimes a couple of minutes, sometimes a couple of hours)
> the delegation seems to stop working and the client recieves the error
> "Login
> failed for user '(null)'. Reason: Not associated with a trusted SQL Server
> connection." The client is still connected and authenticated using TCP/IP
> and
> Kerberos.
> After a restart of SQL Server on server A the delegation starts working
> again.
> I cannt find anything in the eventlogs on either one of the servers or the
> client, and nothing in the sql server logs.
> Does anybody have any idea of what could be wrong, or give me a though on
> where to start looking.
> Thanks
> /Mattias
>
>|||I am the other unanswered posting!
It fails intermittently when we run under 'sa' or a domain account that is
in the local admin group.
I have raised this through the Microsoft concierge service and they said
there are others with the same problem but no resolutions as yet!
Wendy
"BBogart" wrote:
> We are encountering this problem also. I have contacted MS but they are
> still gathering information.
> There is at least one other unanswered post on this here as well, see
> subject = "SQL2005 Linked server authentication drops".
> Are you running sql server under under a domain account that is not in the
> local admins group by any chance?
> --
> -b
>
> "Mattias" wrote:
> > I have a linked server set up between two servers (A & B).
> > Server A is running 2005 and Server B is running 2000.
> > Both servers SQL services are running using a domain user account and have
> > their SPN's registered in the AD.
> >
> > The client connects to Server A using integrated security (TCP/IP and
> > Kerberos not NTLM) and runs disributed queries using the linked server to
> > server B.
> > Delegation is set up in the AD and is working, at least for some time.
> >
> > After a while (sometimes a couple of minutes, sometimes a couple of hours)
> > the delegation seems to stop working and the client recieves the error
> > "Login
> > failed for user '(null)'. Reason: Not associated with a trusted SQL Server
> > connection." The client is still connected and authenticated using TCP/IP
> > and
> > Kerberos.
> >
> > After a restart of SQL Server on server A the delegation starts working
> > again.
> >
> > I cannt find anything in the eventlogs on either one of the servers or the
> > client, and nothing in the sql server logs.
> >
> > Does anybody have any idea of what could be wrong, or give me a though on
> > where to start looking.
> >
> > Thanks
> > /Mattias
> >
> >
> >|||We have seen this in our environment too. One moment a linked server query
will work just fine with delegated Windows credentials, the next moment you
receive errors like the following:
OLE DB provider "SQLNCLI" for linked server "THESERVER" returned message
"Communication link failure".
Msg 10054, Level 16, State 1, Line 0
TCP Provider: An existing connection was forcibly closed by the remote host.
Msg 18452, Level 14, State 1, Line 0
Login failed for user '(null)'. Reason: Not associated with a trusted SQL
Server connection.
I am still working on a reproducable way of generating the message, but I
seem to have problems a lot when I initially generate a linked server within
SQL Management Studio 2005. My connections rarely last beyond 24 hours, and
I suspect that something in the Kerberos token is expiring. After I logout
and login, I can usually start a new session that works (just not today).
"Woo" wrote:
> I am the other unanswered posting!
> It fails intermittently when we run under 'sa' or a domain account that is
> in the local admin group.
> I have raised this through the Microsoft concierge service and they said
> there are others with the same problem but no resolutions as yet!
> Wendy
>
>
> "BBogart" wrote:
> > We are encountering this problem also. I have contacted MS but they are
> > still gathering information.
> >
> > There is at least one other unanswered post on this here as well, see
> > subject = "SQL2005 Linked server authentication drops".
> >
> > Are you running sql server under under a domain account that is not in the
> > local admins group by any chance?
> > --
> > -b
> >
> >
> > "Mattias" wrote:
> >
> > > I have a linked server set up between two servers (A & B).
> > > Server A is running 2005 and Server B is running 2000.
> > > Both servers SQL services are running using a domain user account and have
> > > their SPN's registered in the AD.
> > >
> > > The client connects to Server A using integrated security (TCP/IP and
> > > Kerberos not NTLM) and runs disributed queries using the linked server to
> > > server B.
> > > Delegation is set up in the AD and is working, at least for some time.
> > >
> > > After a while (sometimes a couple of minutes, sometimes a couple of hours)
> > > the delegation seems to stop working and the client recieves the error
> > > "Login
> > > failed for user '(null)'. Reason: Not associated with a trusted SQL Server
> > > connection." The client is still connected and authenticated using TCP/IP
> > > and
> > > Kerberos.
> > >
> > > After a restart of SQL Server on server A the delegation starts working
> > > again.
> > >
> > > I cannt find anything in the eventlogs on either one of the servers or the
> > > client, and nothing in the sql server logs.
> > >
> > > Does anybody have any idea of what could be wrong, or give me a though on
> > > where to start looking.
> > >
> > > Thanks
> > > /Mattias
> > >
> > >
> > >|||I also suspect a ticket is expiring.
I am still working with MS on this with no resolution yet.
Once we see a failure, failures continue regardless of logging off and back
on until sql server is restarted. A reboot is not necessary as I previously
thought.
We have seen it take as little as a few hours or up to a week or more for
the failures to start again.
--
-b
"JD Qixcle" wrote:
> We have seen this in our environment too. One moment a linked server query
> will work just fine with delegated Windows credentials, the next moment you
> receive errors like the following:
> OLE DB provider "SQLNCLI" for linked server "THESERVER" returned message
> "Communication link failure".
> Msg 10054, Level 16, State 1, Line 0
> TCP Provider: An existing connection was forcibly closed by the remote host.
> Msg 18452, Level 14, State 1, Line 0
> Login failed for user '(null)'. Reason: Not associated with a trusted SQL
> Server connection.
> I am still working on a reproducable way of generating the message, but I
> seem to have problems a lot when I initially generate a linked server within
> SQL Management Studio 2005. My connections rarely last beyond 24 hours, and
> I suspect that something in the Kerberos token is expiring. After I logout
> and login, I can usually start a new session that works (just not today).
>
>
> "Woo" wrote:
> > I am the other unanswered posting!
> >
> > It fails intermittently when we run under 'sa' or a domain account that is
> > in the local admin group.
> >
> > I have raised this through the Microsoft concierge service and they said
> > there are others with the same problem but no resolutions as yet!
> >
> > Wendy
> >
> >
> >
> >
> > "BBogart" wrote:
> >
> > > We are encountering this problem also. I have contacted MS but they are
> > > still gathering information.
> > >
> > > There is at least one other unanswered post on this here as well, see
> > > subject = "SQL2005 Linked server authentication drops".
> > >
> > > Are you running sql server under under a domain account that is not in the
> > > local admins group by any chance?
> > > --
> > > -b
> > >
> > >
> > > "Mattias" wrote:
> > >
> > > > I have a linked server set up between two servers (A & B).
> > > > Server A is running 2005 and Server B is running 2000.
> > > > Both servers SQL services are running using a domain user account and have
> > > > their SPN's registered in the AD.
> > > >
> > > > The client connects to Server A using integrated security (TCP/IP and
> > > > Kerberos not NTLM) and runs disributed queries using the linked server to
> > > > server B.
> > > > Delegation is set up in the AD and is working, at least for some time.
> > > >
> > > > After a while (sometimes a couple of minutes, sometimes a couple of hours)
> > > > the delegation seems to stop working and the client recieves the error
> > > > "Login
> > > > failed for user '(null)'. Reason: Not associated with a trusted SQL Server
> > > > connection." The client is still connected and authenticated using TCP/IP
> > > > and
> > > > Kerberos.
> > > >
> > > > After a restart of SQL Server on server A the delegation starts working
> > > > again.
> > > >
> > > > I cannt find anything in the eventlogs on either one of the servers or the
> > > > client, and nothing in the sql server logs.
> > > >
> > > > Does anybody have any idea of what could be wrong, or give me a though on
> > > > where to start looking.
> > > >
> > > > Thanks
> > > > /Mattias
> > > >
> > > >
> > > >|||Did you have this issue resolved ?
Any hints / links /pointers/ thots will be appreciated
Thanks,
GA
"BBogart" wrote:
> I also suspect a ticket is expiring.
> I am still working with MS on this with no resolution yet.
> Once we see a failure, failures continue regardless of logging off and back
> on until sql server is restarted. A reboot is not necessary as I previously
> thought.
> We have seen it take as little as a few hours or up to a week or more for
> the failures to start again.
> --
> -b
> "JD Qixcle" wrote:
> > We have seen this in our environment too. One moment a linked server query
> > will work just fine with delegated Windows credentials, the next moment you
> > receive errors like the following:
> >
> > OLE DB provider "SQLNCLI" for linked server "THESERVER" returned message
> > "Communication link failure".
> > Msg 10054, Level 16, State 1, Line 0
> > TCP Provider: An existing connection was forcibly closed by the remote host.
> > Msg 18452, Level 14, State 1, Line 0
> > Login failed for user '(null)'. Reason: Not associated with a trusted SQL
> > Server connection.
> >
> > I am still working on a reproducable way of generating the message, but I
> > seem to have problems a lot when I initially generate a linked server within
> > SQL Management Studio 2005. My connections rarely last beyond 24 hours, and
> > I suspect that something in the Kerberos token is expiring. After I logout
> > and login, I can usually start a new session that works (just not today).
> >
> >
> >
> >
> > "Woo" wrote:
> >
> > > I am the other unanswered posting!
> > >
> > > It fails intermittently when we run under 'sa' or a domain account that is
> > > in the local admin group.
> > >
> > > I have raised this through the Microsoft concierge service and they said
> > > there are others with the same problem but no resolutions as yet!
> > >
> > > Wendy
> > >
> > >
> > >
> > >
> > > "BBogart" wrote:
> > >
> > > > We are encountering this problem also. I have contacted MS but they are
> > > > still gathering information.
> > > >
> > > > There is at least one other unanswered post on this here as well, see
> > > > subject = "SQL2005 Linked server authentication drops".
> > > >
> > > > Are you running sql server under under a domain account that is not in the
> > > > local admins group by any chance?
> > > > --
> > > > -b
> > > >
> > > >
> > > > "Mattias" wrote:
> > > >
> > > > > I have a linked server set up between two servers (A & B).
> > > > > Server A is running 2005 and Server B is running 2000.
> > > > > Both servers SQL services are running using a domain user account and have
> > > > > their SPN's registered in the AD.
> > > > >
> > > > > The client connects to Server A using integrated security (TCP/IP and
> > > > > Kerberos not NTLM) and runs disributed queries using the linked server to
> > > > > server B.
> > > > > Delegation is set up in the AD and is working, at least for some time.
> > > > >
> > > > > After a while (sometimes a couple of minutes, sometimes a couple of hours)
> > > > > the delegation seems to stop working and the client recieves the error
> > > > > "Login
> > > > > failed for user '(null)'. Reason: Not associated with a trusted SQL Server
> > > > > connection." The client is still connected and authenticated using TCP/IP
> > > > > and
> > > > > Kerberos.
> > > > >
> > > > > After a restart of SQL Server on server A the delegation starts working
> > > > > again.
> > > > >
> > > > > I cannt find anything in the eventlogs on either one of the servers or the
> > > > > client, and nothing in the sql server logs.
> > > > >
> > > > > Does anybody have any idea of what could be wrong, or give me a though on
> > > > > where to start looking.
> > > > >
> > > > > Thanks
> > > > > /Mattias
> > > > >
> > > > >
> > > > >|||--
-b
"DallasBlue" wrote:
> Did you have this issue resolved ?
> Any hints / links /pointers/ thots will be appreciated
> Thanks,
> GA
> "BBogart" wrote:
> > I also suspect a ticket is expiring.
> >
> > I am still working with MS on this with no resolution yet.
> >
> > Once we see a failure, failures continue regardless of logging off and back
> > on until sql server is restarted. A reboot is not necessary as I previously
> > thought.
> >
> > We have seen it take as little as a few hours or up to a week or more for
> > the failures to start again.
> > --
> > -b
> >
> > "JD Qixcle" wrote:
> >
> > > We have seen this in our environment too. One moment a linked server query
> > > will work just fine with delegated Windows credentials, the next moment you
> > > receive errors like the following:
> > >
> > > OLE DB provider "SQLNCLI" for linked server "THESERVER" returned message
> > > "Communication link failure".
> > > Msg 10054, Level 16, State 1, Line 0
> > > TCP Provider: An existing connection was forcibly closed by the remote host.
> > > Msg 18452, Level 14, State 1, Line 0
> > > Login failed for user '(null)'. Reason: Not associated with a trusted SQL
> > > Server connection.
> > >
> > > I am still working on a reproducable way of generating the message, but I
> > > seem to have problems a lot when I initially generate a linked server within
> > > SQL Management Studio 2005. My connections rarely last beyond 24 hours, and
> > > I suspect that something in the Kerberos token is expiring. After I logout
> > > and login, I can usually start a new session that works (just not today).
> > >
> > >
> > >
> > >
> > > "Woo" wrote:
> > >
> > > > I am the other unanswered posting!
> > > >
> > > > It fails intermittently when we run under 'sa' or a domain account that is
> > > > in the local admin group.
> > > >
> > > > I have raised this through the Microsoft concierge service and they said
> > > > there are others with the same problem but no resolutions as yet!
> > > >
> > > > Wendy
> > > >
> > > >
> > > >
> > > >
> > > > "BBogart" wrote:
> > > >
> > > > > We are encountering this problem also. I have contacted MS but they are
> > > > > still gathering information.
> > > > >
> > > > > There is at least one other unanswered post on this here as well, see
> > > > > subject = "SQL2005 Linked server authentication drops".
> > > > >
> > > > > Are you running sql server under under a domain account that is not in the
> > > > > local admins group by any chance?
> > > > > --
> > > > > -b
> > > > >
> > > > >
> > > > > "Mattias" wrote:
> > > > >
> > > > > > I have a linked server set up between two servers (A & B).
> > > > > > Server A is running 2005 and Server B is running 2000.
> > > > > > Both servers SQL services are running using a domain user account and have
> > > > > > their SPN's registered in the AD.
> > > > > >
> > > > > > The client connects to Server A using integrated security (TCP/IP and
> > > > > > Kerberos not NTLM) and runs disributed queries using the linked server to
> > > > > > server B.
> > > > > > Delegation is set up in the AD and is working, at least for some time.
> > > > > >
> > > > > > After a while (sometimes a couple of minutes, sometimes a couple of hours)
> > > > > > the delegation seems to stop working and the client recieves the error
> > > > > > "Login
> > > > > > failed for user '(null)'. Reason: Not associated with a trusted SQL Server
> > > > > > connection." The client is still connected and authenticated using TCP/IP
> > > > > > and
> > > > > > Kerberos.
> > > > > >
> > > > > > After a restart of SQL Server on server A the delegation starts working
> > > > > > again.
> > > > > >
> > > > > > I cannt find anything in the eventlogs on either one of the servers or the
> > > > > > client, and nothing in the sql server logs.
> > > > > >
> > > > > > Does anybody have any idea of what could be wrong, or give me a though on
> > > > > > where to start looking.
> > > > > >
> > > > > > Thanks
> > > > > > /Mattias
> > > > > >
> > > > > >
> > > > > >
Server A is running 2005 and Server B is running 2000.
Both servers SQL services are running using a domain user account and have
their SPN's registered in the AD.
The client connects to Server A using integrated security (TCP/IP and
Kerberos not NTLM) and runs disributed queries using the linked server to
server B.
Delegation is set up in the AD and is working, at least for some time.
After a while (sometimes a couple of minutes, sometimes a couple of hours)
the delegation seems to stop working and the client recieves the error
"Login
failed for user '(null)'. Reason: Not associated with a trusted SQL Server
connection." The client is still connected and authenticated using TCP/IP
and
Kerberos.
After a restart of SQL Server on server A the delegation starts working
again.
I cannt find anything in the eventlogs on either one of the servers or the
client, and nothing in the sql server logs.
Does anybody have any idea of what could be wrong, or give me a though on
where to start looking.
Thanks
/MattiasWe are encountering this problem also. I have contacted MS but they are
still gathering information.
There is at least one other unanswered post on this here as well, see
subject = "SQL2005 Linked server authentication drops".
Are you running sql server under under a domain account that is not in the
local admins group by any chance?
--
-b
"Mattias" wrote:
> I have a linked server set up between two servers (A & B).
> Server A is running 2005 and Server B is running 2000.
> Both servers SQL services are running using a domain user account and have
> their SPN's registered in the AD.
> The client connects to Server A using integrated security (TCP/IP and
> Kerberos not NTLM) and runs disributed queries using the linked server to
> server B.
> Delegation is set up in the AD and is working, at least for some time.
> After a while (sometimes a couple of minutes, sometimes a couple of hours)
> the delegation seems to stop working and the client recieves the error
> "Login
> failed for user '(null)'. Reason: Not associated with a trusted SQL Server
> connection." The client is still connected and authenticated using TCP/IP
> and
> Kerberos.
> After a restart of SQL Server on server A the delegation starts working
> again.
> I cannt find anything in the eventlogs on either one of the servers or the
> client, and nothing in the sql server logs.
> Does anybody have any idea of what could be wrong, or give me a though on
> where to start looking.
> Thanks
> /Mattias
>
>|||I am the other unanswered posting!
It fails intermittently when we run under 'sa' or a domain account that is
in the local admin group.
I have raised this through the Microsoft concierge service and they said
there are others with the same problem but no resolutions as yet!
Wendy
"BBogart" wrote:
> We are encountering this problem also. I have contacted MS but they are
> still gathering information.
> There is at least one other unanswered post on this here as well, see
> subject = "SQL2005 Linked server authentication drops".
> Are you running sql server under under a domain account that is not in the
> local admins group by any chance?
> --
> -b
>
> "Mattias" wrote:
> > I have a linked server set up between two servers (A & B).
> > Server A is running 2005 and Server B is running 2000.
> > Both servers SQL services are running using a domain user account and have
> > their SPN's registered in the AD.
> >
> > The client connects to Server A using integrated security (TCP/IP and
> > Kerberos not NTLM) and runs disributed queries using the linked server to
> > server B.
> > Delegation is set up in the AD and is working, at least for some time.
> >
> > After a while (sometimes a couple of minutes, sometimes a couple of hours)
> > the delegation seems to stop working and the client recieves the error
> > "Login
> > failed for user '(null)'. Reason: Not associated with a trusted SQL Server
> > connection." The client is still connected and authenticated using TCP/IP
> > and
> > Kerberos.
> >
> > After a restart of SQL Server on server A the delegation starts working
> > again.
> >
> > I cannt find anything in the eventlogs on either one of the servers or the
> > client, and nothing in the sql server logs.
> >
> > Does anybody have any idea of what could be wrong, or give me a though on
> > where to start looking.
> >
> > Thanks
> > /Mattias
> >
> >
> >|||We have seen this in our environment too. One moment a linked server query
will work just fine with delegated Windows credentials, the next moment you
receive errors like the following:
OLE DB provider "SQLNCLI" for linked server "THESERVER" returned message
"Communication link failure".
Msg 10054, Level 16, State 1, Line 0
TCP Provider: An existing connection was forcibly closed by the remote host.
Msg 18452, Level 14, State 1, Line 0
Login failed for user '(null)'. Reason: Not associated with a trusted SQL
Server connection.
I am still working on a reproducable way of generating the message, but I
seem to have problems a lot when I initially generate a linked server within
SQL Management Studio 2005. My connections rarely last beyond 24 hours, and
I suspect that something in the Kerberos token is expiring. After I logout
and login, I can usually start a new session that works (just not today).
"Woo" wrote:
> I am the other unanswered posting!
> It fails intermittently when we run under 'sa' or a domain account that is
> in the local admin group.
> I have raised this through the Microsoft concierge service and they said
> there are others with the same problem but no resolutions as yet!
> Wendy
>
>
> "BBogart" wrote:
> > We are encountering this problem also. I have contacted MS but they are
> > still gathering information.
> >
> > There is at least one other unanswered post on this here as well, see
> > subject = "SQL2005 Linked server authentication drops".
> >
> > Are you running sql server under under a domain account that is not in the
> > local admins group by any chance?
> > --
> > -b
> >
> >
> > "Mattias" wrote:
> >
> > > I have a linked server set up between two servers (A & B).
> > > Server A is running 2005 and Server B is running 2000.
> > > Both servers SQL services are running using a domain user account and have
> > > their SPN's registered in the AD.
> > >
> > > The client connects to Server A using integrated security (TCP/IP and
> > > Kerberos not NTLM) and runs disributed queries using the linked server to
> > > server B.
> > > Delegation is set up in the AD and is working, at least for some time.
> > >
> > > After a while (sometimes a couple of minutes, sometimes a couple of hours)
> > > the delegation seems to stop working and the client recieves the error
> > > "Login
> > > failed for user '(null)'. Reason: Not associated with a trusted SQL Server
> > > connection." The client is still connected and authenticated using TCP/IP
> > > and
> > > Kerberos.
> > >
> > > After a restart of SQL Server on server A the delegation starts working
> > > again.
> > >
> > > I cannt find anything in the eventlogs on either one of the servers or the
> > > client, and nothing in the sql server logs.
> > >
> > > Does anybody have any idea of what could be wrong, or give me a though on
> > > where to start looking.
> > >
> > > Thanks
> > > /Mattias
> > >
> > >
> > >|||I also suspect a ticket is expiring.
I am still working with MS on this with no resolution yet.
Once we see a failure, failures continue regardless of logging off and back
on until sql server is restarted. A reboot is not necessary as I previously
thought.
We have seen it take as little as a few hours or up to a week or more for
the failures to start again.
--
-b
"JD Qixcle" wrote:
> We have seen this in our environment too. One moment a linked server query
> will work just fine with delegated Windows credentials, the next moment you
> receive errors like the following:
> OLE DB provider "SQLNCLI" for linked server "THESERVER" returned message
> "Communication link failure".
> Msg 10054, Level 16, State 1, Line 0
> TCP Provider: An existing connection was forcibly closed by the remote host.
> Msg 18452, Level 14, State 1, Line 0
> Login failed for user '(null)'. Reason: Not associated with a trusted SQL
> Server connection.
> I am still working on a reproducable way of generating the message, but I
> seem to have problems a lot when I initially generate a linked server within
> SQL Management Studio 2005. My connections rarely last beyond 24 hours, and
> I suspect that something in the Kerberos token is expiring. After I logout
> and login, I can usually start a new session that works (just not today).
>
>
> "Woo" wrote:
> > I am the other unanswered posting!
> >
> > It fails intermittently when we run under 'sa' or a domain account that is
> > in the local admin group.
> >
> > I have raised this through the Microsoft concierge service and they said
> > there are others with the same problem but no resolutions as yet!
> >
> > Wendy
> >
> >
> >
> >
> > "BBogart" wrote:
> >
> > > We are encountering this problem also. I have contacted MS but they are
> > > still gathering information.
> > >
> > > There is at least one other unanswered post on this here as well, see
> > > subject = "SQL2005 Linked server authentication drops".
> > >
> > > Are you running sql server under under a domain account that is not in the
> > > local admins group by any chance?
> > > --
> > > -b
> > >
> > >
> > > "Mattias" wrote:
> > >
> > > > I have a linked server set up between two servers (A & B).
> > > > Server A is running 2005 and Server B is running 2000.
> > > > Both servers SQL services are running using a domain user account and have
> > > > their SPN's registered in the AD.
> > > >
> > > > The client connects to Server A using integrated security (TCP/IP and
> > > > Kerberos not NTLM) and runs disributed queries using the linked server to
> > > > server B.
> > > > Delegation is set up in the AD and is working, at least for some time.
> > > >
> > > > After a while (sometimes a couple of minutes, sometimes a couple of hours)
> > > > the delegation seems to stop working and the client recieves the error
> > > > "Login
> > > > failed for user '(null)'. Reason: Not associated with a trusted SQL Server
> > > > connection." The client is still connected and authenticated using TCP/IP
> > > > and
> > > > Kerberos.
> > > >
> > > > After a restart of SQL Server on server A the delegation starts working
> > > > again.
> > > >
> > > > I cannt find anything in the eventlogs on either one of the servers or the
> > > > client, and nothing in the sql server logs.
> > > >
> > > > Does anybody have any idea of what could be wrong, or give me a though on
> > > > where to start looking.
> > > >
> > > > Thanks
> > > > /Mattias
> > > >
> > > >
> > > >|||Did you have this issue resolved ?
Any hints / links /pointers/ thots will be appreciated
Thanks,
GA
"BBogart" wrote:
> I also suspect a ticket is expiring.
> I am still working with MS on this with no resolution yet.
> Once we see a failure, failures continue regardless of logging off and back
> on until sql server is restarted. A reboot is not necessary as I previously
> thought.
> We have seen it take as little as a few hours or up to a week or more for
> the failures to start again.
> --
> -b
> "JD Qixcle" wrote:
> > We have seen this in our environment too. One moment a linked server query
> > will work just fine with delegated Windows credentials, the next moment you
> > receive errors like the following:
> >
> > OLE DB provider "SQLNCLI" for linked server "THESERVER" returned message
> > "Communication link failure".
> > Msg 10054, Level 16, State 1, Line 0
> > TCP Provider: An existing connection was forcibly closed by the remote host.
> > Msg 18452, Level 14, State 1, Line 0
> > Login failed for user '(null)'. Reason: Not associated with a trusted SQL
> > Server connection.
> >
> > I am still working on a reproducable way of generating the message, but I
> > seem to have problems a lot when I initially generate a linked server within
> > SQL Management Studio 2005. My connections rarely last beyond 24 hours, and
> > I suspect that something in the Kerberos token is expiring. After I logout
> > and login, I can usually start a new session that works (just not today).
> >
> >
> >
> >
> > "Woo" wrote:
> >
> > > I am the other unanswered posting!
> > >
> > > It fails intermittently when we run under 'sa' or a domain account that is
> > > in the local admin group.
> > >
> > > I have raised this through the Microsoft concierge service and they said
> > > there are others with the same problem but no resolutions as yet!
> > >
> > > Wendy
> > >
> > >
> > >
> > >
> > > "BBogart" wrote:
> > >
> > > > We are encountering this problem also. I have contacted MS but they are
> > > > still gathering information.
> > > >
> > > > There is at least one other unanswered post on this here as well, see
> > > > subject = "SQL2005 Linked server authentication drops".
> > > >
> > > > Are you running sql server under under a domain account that is not in the
> > > > local admins group by any chance?
> > > > --
> > > > -b
> > > >
> > > >
> > > > "Mattias" wrote:
> > > >
> > > > > I have a linked server set up between two servers (A & B).
> > > > > Server A is running 2005 and Server B is running 2000.
> > > > > Both servers SQL services are running using a domain user account and have
> > > > > their SPN's registered in the AD.
> > > > >
> > > > > The client connects to Server A using integrated security (TCP/IP and
> > > > > Kerberos not NTLM) and runs disributed queries using the linked server to
> > > > > server B.
> > > > > Delegation is set up in the AD and is working, at least for some time.
> > > > >
> > > > > After a while (sometimes a couple of minutes, sometimes a couple of hours)
> > > > > the delegation seems to stop working and the client recieves the error
> > > > > "Login
> > > > > failed for user '(null)'. Reason: Not associated with a trusted SQL Server
> > > > > connection." The client is still connected and authenticated using TCP/IP
> > > > > and
> > > > > Kerberos.
> > > > >
> > > > > After a restart of SQL Server on server A the delegation starts working
> > > > > again.
> > > > >
> > > > > I cannt find anything in the eventlogs on either one of the servers or the
> > > > > client, and nothing in the sql server logs.
> > > > >
> > > > > Does anybody have any idea of what could be wrong, or give me a though on
> > > > > where to start looking.
> > > > >
> > > > > Thanks
> > > > > /Mattias
> > > > >
> > > > >
> > > > >|||--
-b
"DallasBlue" wrote:
> Did you have this issue resolved ?
> Any hints / links /pointers/ thots will be appreciated
> Thanks,
> GA
> "BBogart" wrote:
> > I also suspect a ticket is expiring.
> >
> > I am still working with MS on this with no resolution yet.
> >
> > Once we see a failure, failures continue regardless of logging off and back
> > on until sql server is restarted. A reboot is not necessary as I previously
> > thought.
> >
> > We have seen it take as little as a few hours or up to a week or more for
> > the failures to start again.
> > --
> > -b
> >
> > "JD Qixcle" wrote:
> >
> > > We have seen this in our environment too. One moment a linked server query
> > > will work just fine with delegated Windows credentials, the next moment you
> > > receive errors like the following:
> > >
> > > OLE DB provider "SQLNCLI" for linked server "THESERVER" returned message
> > > "Communication link failure".
> > > Msg 10054, Level 16, State 1, Line 0
> > > TCP Provider: An existing connection was forcibly closed by the remote host.
> > > Msg 18452, Level 14, State 1, Line 0
> > > Login failed for user '(null)'. Reason: Not associated with a trusted SQL
> > > Server connection.
> > >
> > > I am still working on a reproducable way of generating the message, but I
> > > seem to have problems a lot when I initially generate a linked server within
> > > SQL Management Studio 2005. My connections rarely last beyond 24 hours, and
> > > I suspect that something in the Kerberos token is expiring. After I logout
> > > and login, I can usually start a new session that works (just not today).
> > >
> > >
> > >
> > >
> > > "Woo" wrote:
> > >
> > > > I am the other unanswered posting!
> > > >
> > > > It fails intermittently when we run under 'sa' or a domain account that is
> > > > in the local admin group.
> > > >
> > > > I have raised this through the Microsoft concierge service and they said
> > > > there are others with the same problem but no resolutions as yet!
> > > >
> > > > Wendy
> > > >
> > > >
> > > >
> > > >
> > > > "BBogart" wrote:
> > > >
> > > > > We are encountering this problem also. I have contacted MS but they are
> > > > > still gathering information.
> > > > >
> > > > > There is at least one other unanswered post on this here as well, see
> > > > > subject = "SQL2005 Linked server authentication drops".
> > > > >
> > > > > Are you running sql server under under a domain account that is not in the
> > > > > local admins group by any chance?
> > > > > --
> > > > > -b
> > > > >
> > > > >
> > > > > "Mattias" wrote:
> > > > >
> > > > > > I have a linked server set up between two servers (A & B).
> > > > > > Server A is running 2005 and Server B is running 2000.
> > > > > > Both servers SQL services are running using a domain user account and have
> > > > > > their SPN's registered in the AD.
> > > > > >
> > > > > > The client connects to Server A using integrated security (TCP/IP and
> > > > > > Kerberos not NTLM) and runs disributed queries using the linked server to
> > > > > > server B.
> > > > > > Delegation is set up in the AD and is working, at least for some time.
> > > > > >
> > > > > > After a while (sometimes a couple of minutes, sometimes a couple of hours)
> > > > > > the delegation seems to stop working and the client recieves the error
> > > > > > "Login
> > > > > > failed for user '(null)'. Reason: Not associated with a trusted SQL Server
> > > > > > connection." The client is still connected and authenticated using TCP/IP
> > > > > > and
> > > > > > Kerberos.
> > > > > >
> > > > > > After a restart of SQL Server on server A the delegation starts working
> > > > > > again.
> > > > > >
> > > > > > I cannt find anything in the eventlogs on either one of the servers or the
> > > > > > client, and nothing in the sql server logs.
> > > > > >
> > > > > > Does anybody have any idea of what could be wrong, or give me a though on
> > > > > > where to start looking.
> > > > > >
> > > > > > Thanks
> > > > > > /Mattias
> > > > > >
> > > > > >
> > > > > >
Delegation stops working after a while
I have a linked server set up between two servers (A & B).
Server A is running 2005 and Server B is running 2000.
Both servers SQL services are running using a domain user account and have
their SPN's registered in the AD.
The client connects to Server A using integrated security (TCP/IP and
Kerberos not NTLM) and runs disributed queries using the linked server to
server B.
Delegation is set up in the AD and is working, at least for some time.
After a while (sometimes a couple of minutes, sometimes a couple of hours)
the delegation seems to stop working and the client recieves the error
"Login
failed for user '(null)'. Reason: Not associated with a trusted SQL Server
connection." The client is still connected and authenticated using TCP/IP
and
Kerberos.
After a restart of SQL Server on server A the delegation starts working
again.
I cannt find anything in the eventlogs on either one of the servers or the
client, and nothing in the sql server logs.
Does anybody have any idea of what could be wrong, or give me a though on
where to start looking.
Thanks
/MattiasWe are encountering this problem also. I have contacted MS but they are
still gathering information.
There is at least one other unanswered post on this here as well, see
subject = "SQL2005 Linked server authentication drops".
Are you running sql server under under a domain account that is not in the
local admins group by any chance?
--
-b
"Mattias" wrote:
> I have a linked server set up between two servers (A & B).
> Server A is running 2005 and Server B is running 2000.
> Both servers SQL services are running using a domain user account and have
> their SPN's registered in the AD.
> The client connects to Server A using integrated security (TCP/IP and
> Kerberos not NTLM) and runs disributed queries using the linked server to
> server B.
> Delegation is set up in the AD and is working, at least for some time.
> After a while (sometimes a couple of minutes, sometimes a couple of hours)
> the delegation seems to stop working and the client recieves the error
> "Login
> failed for user '(null)'. Reason: Not associated with a trusted SQL Server
> connection." The client is still connected and authenticated using TCP/IP
> and
> Kerberos.
> After a restart of SQL Server on server A the delegation starts working
> again.
> I cannt find anything in the eventlogs on either one of the servers or the
> client, and nothing in the sql server logs.
> Does anybody have any idea of what could be wrong, or give me a though on
> where to start looking.
> Thanks
> /Mattias
>
>|||I am the other unanswered posting!
It fails intermittently when we run under 'sa' or a domain account that is
in the local admin group.
I have raised this through the Microsoft concierge service and they said
there are others with the same problem but no resolutions as yet!
Wendy
"BBogart" wrote:
[vbcol=seagreen]
> We are encountering this problem also. I have contacted MS but they are
> still gathering information.
> There is at least one other unanswered post on this here as well, see
> subject = "SQL2005 Linked server authentication drops".
> Are you running sql server under under a domain account that is not in the
> local admins group by any chance?
> --
> -b
>
> "Mattias" wrote:
>|||We have seen this in our environment too. One moment a linked server query
will work just fine with delegated Windows credentials, the next moment you
receive errors like the following:
OLE DB provider "SQLNCLI" for linked server "THESERVER" returned message
"Communication link failure".
Msg 10054, Level 16, State 1, Line 0
TCP Provider: An existing connection was forcibly closed by the remote host.
Msg 18452, Level 14, State 1, Line 0
Login failed for user '(null)'. Reason: Not associated with a trusted SQL
Server connection.
I am still working on a reproducable way of generating the message, but I
seem to have problems a lot when I initially generate a linked server within
SQL Management Studio 2005. My connections rarely last beyond 24 hours, and
I suspect that something in the Kerberos token is expiring. After I logout
and login, I can usually start a new session that works (just not today).
"Woo" wrote:
[vbcol=seagreen]
> I am the other unanswered posting!
> It fails intermittently when we run under 'sa' or a domain account that is
> in the local admin group.
> I have raised this through the Microsoft concierge service and they said
> there are others with the same problem but no resolutions as yet!
> Wendy
>
>
> "BBogart" wrote:
>|||I also suspect a ticket is expiring.
I am still working with MS on this with no resolution yet.
Once we see a failure, failures continue regardless of logging off and back
on until sql server is restarted. A reboot is not necessary as I previously
thought.
We have seen it take as little as a few hours or up to a week or more for
the failures to start again.
--
-b
"JD Qixcle" wrote:
[vbcol=seagreen]
> We have seen this in our environment too. One moment a linked server quer
y
> will work just fine with delegated Windows credentials, the next moment yo
u
> receive errors like the following:
> OLE DB provider "SQLNCLI" for linked server "THESERVER" returned message
> "Communication link failure".
> Msg 10054, Level 16, State 1, Line 0
> TCP Provider: An existing connection was forcibly closed by the remote hos
t.
> Msg 18452, Level 14, State 1, Line 0
> Login failed for user '(null)'. Reason: Not associated with a trusted SQL
> Server connection.
> I am still working on a reproducable way of generating the message, but I
> seem to have problems a lot when I initially generate a linked server with
in
> SQL Management Studio 2005. My connections rarely last beyond 24 hours, a
nd
> I suspect that something in the Kerberos token is expiring. After I logou
t
> and login, I can usually start a new session that works (just not today).
>
>
> "Woo" wrote:
>|||Did you have this issue resolved ?
Any hints / links /pointers/ thots will be appreciated
Thanks,
GA
"BBogart" wrote:
[vbcol=seagreen]
> I also suspect a ticket is expiring.
> I am still working with MS on this with no resolution yet.
> Once we see a failure, failures continue regardless of logging off and bac
k
> on until sql server is restarted. A reboot is not necessary as I previous
ly
> thought.
> We have seen it take as little as a few hours or up to a week or more for
> the failures to start again.
> --
> -b
> "JD Qixcle" wrote:
>|||-b
"DallasBlue" wrote:
[vbcol=seagreen]
> Did you have this issue resolved ?
> Any hints / links /pointers/ thots will be appreciated
> Thanks,
> GA
> "BBogart" wrote:
>
Server A is running 2005 and Server B is running 2000.
Both servers SQL services are running using a domain user account and have
their SPN's registered in the AD.
The client connects to Server A using integrated security (TCP/IP and
Kerberos not NTLM) and runs disributed queries using the linked server to
server B.
Delegation is set up in the AD and is working, at least for some time.
After a while (sometimes a couple of minutes, sometimes a couple of hours)
the delegation seems to stop working and the client recieves the error
"Login
failed for user '(null)'. Reason: Not associated with a trusted SQL Server
connection." The client is still connected and authenticated using TCP/IP
and
Kerberos.
After a restart of SQL Server on server A the delegation starts working
again.
I cannt find anything in the eventlogs on either one of the servers or the
client, and nothing in the sql server logs.
Does anybody have any idea of what could be wrong, or give me a though on
where to start looking.
Thanks
/MattiasWe are encountering this problem also. I have contacted MS but they are
still gathering information.
There is at least one other unanswered post on this here as well, see
subject = "SQL2005 Linked server authentication drops".
Are you running sql server under under a domain account that is not in the
local admins group by any chance?
--
-b
"Mattias" wrote:
> I have a linked server set up between two servers (A & B).
> Server A is running 2005 and Server B is running 2000.
> Both servers SQL services are running using a domain user account and have
> their SPN's registered in the AD.
> The client connects to Server A using integrated security (TCP/IP and
> Kerberos not NTLM) and runs disributed queries using the linked server to
> server B.
> Delegation is set up in the AD and is working, at least for some time.
> After a while (sometimes a couple of minutes, sometimes a couple of hours)
> the delegation seems to stop working and the client recieves the error
> "Login
> failed for user '(null)'. Reason: Not associated with a trusted SQL Server
> connection." The client is still connected and authenticated using TCP/IP
> and
> Kerberos.
> After a restart of SQL Server on server A the delegation starts working
> again.
> I cannt find anything in the eventlogs on either one of the servers or the
> client, and nothing in the sql server logs.
> Does anybody have any idea of what could be wrong, or give me a though on
> where to start looking.
> Thanks
> /Mattias
>
>|||I am the other unanswered posting!
It fails intermittently when we run under 'sa' or a domain account that is
in the local admin group.
I have raised this through the Microsoft concierge service and they said
there are others with the same problem but no resolutions as yet!
Wendy
"BBogart" wrote:
[vbcol=seagreen]
> We are encountering this problem also. I have contacted MS but they are
> still gathering information.
> There is at least one other unanswered post on this here as well, see
> subject = "SQL2005 Linked server authentication drops".
> Are you running sql server under under a domain account that is not in the
> local admins group by any chance?
> --
> -b
>
> "Mattias" wrote:
>|||We have seen this in our environment too. One moment a linked server query
will work just fine with delegated Windows credentials, the next moment you
receive errors like the following:
OLE DB provider "SQLNCLI" for linked server "THESERVER" returned message
"Communication link failure".
Msg 10054, Level 16, State 1, Line 0
TCP Provider: An existing connection was forcibly closed by the remote host.
Msg 18452, Level 14, State 1, Line 0
Login failed for user '(null)'. Reason: Not associated with a trusted SQL
Server connection.
I am still working on a reproducable way of generating the message, but I
seem to have problems a lot when I initially generate a linked server within
SQL Management Studio 2005. My connections rarely last beyond 24 hours, and
I suspect that something in the Kerberos token is expiring. After I logout
and login, I can usually start a new session that works (just not today).
"Woo" wrote:
[vbcol=seagreen]
> I am the other unanswered posting!
> It fails intermittently when we run under 'sa' or a domain account that is
> in the local admin group.
> I have raised this through the Microsoft concierge service and they said
> there are others with the same problem but no resolutions as yet!
> Wendy
>
>
> "BBogart" wrote:
>|||I also suspect a ticket is expiring.
I am still working with MS on this with no resolution yet.
Once we see a failure, failures continue regardless of logging off and back
on until sql server is restarted. A reboot is not necessary as I previously
thought.
We have seen it take as little as a few hours or up to a week or more for
the failures to start again.
--
-b
"JD Qixcle" wrote:
[vbcol=seagreen]
> We have seen this in our environment too. One moment a linked server quer
y
> will work just fine with delegated Windows credentials, the next moment yo
u
> receive errors like the following:
> OLE DB provider "SQLNCLI" for linked server "THESERVER" returned message
> "Communication link failure".
> Msg 10054, Level 16, State 1, Line 0
> TCP Provider: An existing connection was forcibly closed by the remote hos
t.
> Msg 18452, Level 14, State 1, Line 0
> Login failed for user '(null)'. Reason: Not associated with a trusted SQL
> Server connection.
> I am still working on a reproducable way of generating the message, but I
> seem to have problems a lot when I initially generate a linked server with
in
> SQL Management Studio 2005. My connections rarely last beyond 24 hours, a
nd
> I suspect that something in the Kerberos token is expiring. After I logou
t
> and login, I can usually start a new session that works (just not today).
>
>
> "Woo" wrote:
>|||Did you have this issue resolved ?
Any hints / links /pointers/ thots will be appreciated
Thanks,
GA
"BBogart" wrote:
[vbcol=seagreen]
> I also suspect a ticket is expiring.
> I am still working with MS on this with no resolution yet.
> Once we see a failure, failures continue regardless of logging off and bac
k
> on until sql server is restarted. A reboot is not necessary as I previous
ly
> thought.
> We have seen it take as little as a few hours or up to a week or more for
> the failures to start again.
> --
> -b
> "JD Qixcle" wrote:
>|||-b
"DallasBlue" wrote:
[vbcol=seagreen]
> Did you have this issue resolved ?
> Any hints / links /pointers/ thots will be appreciated
> Thanks,
> GA
> "BBogart" wrote:
>
Delegation Failure
I have a domain with SBS2003 server running IIS on one machine and Windows
Server 2003 running SQL 2000 on another. IIS uses integrated authentication
only, and delegation between IIS and SQL was working as advertised (all the
right checkboxes in Active Dir we set correctly, SQL used the authenticated
client, etc).
We recently added the server with SQL as a Domain Controller so it could be
used as a backup. Once it came on line, delegation stopped working, and IIS
attempts to log in to SQL as the 'NT AUTHORITY\ANONYMOUS LOGON' user, which,
of course, fails.
I am going to remove the DC off of the SQL server, but I though someone
might know why having the second DC on the SQL server kills delegation.
Thanks,
PaulI can tell you that SQL running on a DC is not recommended nor is it
tested with SQL 2000.
The best way to determine what is wrong is to make network traces from the
client machine, and use Kerbtray on the client to verify that it is in fact
getting Kerberos ticket for IIS.
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.|||Kevin,
Thanks for your reply. I will look into Kerbtray.
Re: SQL2000 on a DC not supported, isn't that what SBS2003 Premium is?
-Paul
"Kevin McDonnell [MSFT]" <kevmc@.online.microsoft.com> wrote in message
news:sT8Angd5DHA.4028@.cpmsftngxa07.phx.gbl...
fact
when it was living on a member server, those accounts were mapped to the
computer account, and this account was used when SQL was accessing network
resources. Now, when SQL lives on the DC, so called "loopback
authentication" is taking place, and SQL comes to DC authenticated as
NetworkServer or LocalSystem, respectively.
Generally speaking, running two important services on one machine is unsafe.
If one is compromised, the other one will fall too. We do not recommend
running anything on a DC.
Dmitri Gavrilov
SDE, Active Directory Core
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Paul L" <nospam@.loring.net> wrote in message
news:u5x2oRc5DHA.2392@.TK2MSFTNGP11.phx.gbl...
authentication
the
authenticated
be
IIS
which,
This is kind of an SBS question, it was wrongly cross posted to a whole
bunch of newsgroups and the discussion might not necessarily accurately
reflect an SBS scenario. Such as the following:
unsafe.
Les Connor [SBS MVP]
--
SBS Rocks !
"Dmitri Gavrilov [MSFT]" <dmitrig@.online.microsoft.com> wrote in message
news:eSmSyWe5DHA.2556@.TK2MSFTNGP09.phx.gbl...
that
unsafe.
rights.
It was "wrongly" posted to the 3 (whole bunch?) newsgroups for the systems
involved. I have a problem that could be in any of the 3 places, SBS, SQL
or AD.
Furthermore, I have no idea what you are trying to say in your reply.
-Paul
"Les Connor [SBS MVP]" <les.connor@.DEL.cfive.ca> wrote in message
news:ekZiRmf5DHA.2720@.TK2MSFTNGP09.phx.gbl...
Yes. The Premium version of SBS contains SQL 2000.
My reply was based upon your statement:
"We recently added the server with SQL as a Domain Controller so it could be
used as a backup"
Based upon this statement, my response is that I would not recommend SQL
2000 on a DC.
My recommendation as far as troubleshooting is the same.
The best way to determine what is wrong is to make network traces from the
client machine, and use Kerbtray from the Windows 2000 Resource kit on the
client to verify that it is in fact
getting Kerberos ticket for IIS.
To download the Kerbtray utility, visit the
following Microsoft Web site:
http://www.microsoft.com/windows200...isting/kerbtray
-o.asp
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.
Server 2003 running SQL 2000 on another. IIS uses integrated authentication
only, and delegation between IIS and SQL was working as advertised (all the
right checkboxes in Active Dir we set correctly, SQL used the authenticated
client, etc).
We recently added the server with SQL as a Domain Controller so it could be
used as a backup. Once it came on line, delegation stopped working, and IIS
attempts to log in to SQL as the 'NT AUTHORITY\ANONYMOUS LOGON' user, which,
of course, fails.
I am going to remove the DC off of the SQL server, but I though someone
might know why having the second DC on the SQL server kills delegation.
Thanks,
PaulI can tell you that SQL running on a DC is not recommended nor is it
tested with SQL 2000.
The best way to determine what is wrong is to make network traces from the
client machine, and use Kerbtray on the client to verify that it is in fact
getting Kerberos ticket for IIS.
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.|||Kevin,
Thanks for your reply. I will look into Kerbtray.
Re: SQL2000 on a DC not supported, isn't that what SBS2003 Premium is?
-Paul
"Kevin McDonnell [MSFT]" <kevmc@.online.microsoft.com> wrote in message
news:sT8Angd5DHA.4028@.cpmsftngxa07.phx.gbl...
quote:
> I can tell you that SQL running on a DC is not recommended nor is it
> tested with SQL 2000.
> The best way to determine what is wrong is to make network traces from the
> client machine, and use Kerbtray on the client to verify that it is in
fact
quote:|||What service account is SQL using? NetworkService or LocalSystem? Note that
> getting Kerberos ticket for IIS.
> Thanks,
> Kevin McDonnell
> Microsoft Corporation
> This posting is provided AS IS with no warranties, and confers no rights.
>
>
when it was living on a member server, those accounts were mapped to the
computer account, and this account was used when SQL was accessing network
resources. Now, when SQL lives on the DC, so called "loopback
authentication" is taking place, and SQL comes to DC authenticated as
NetworkServer or LocalSystem, respectively.
Generally speaking, running two important services on one machine is unsafe.
If one is compromised, the other one will fall too. We do not recommend
running anything on a DC.
Dmitri Gavrilov
SDE, Active Directory Core
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Paul L" <nospam@.loring.net> wrote in message
news:u5x2oRc5DHA.2392@.TK2MSFTNGP11.phx.gbl...
quote:
> I have a domain with SBS2003 server running IIS on one machine and Windows
> Server 2003 running SQL 2000 on another. IIS uses integrated
authentication
quote:
> only, and delegation between IIS and SQL was working as advertised (all
the
quote:
> right checkboxes in Active Dir we set correctly, SQL used the
authenticated
quote:
> client, etc).
> We recently added the server with SQL as a Domain Controller so it could
be
quote:
> used as a backup. Once it came on line, delegation stopped working, and
IIS
quote:
> attempts to log in to SQL as the 'NT AUTHORITY\ANONYMOUS LOGON' user,
which,
quote:|||Let's be careful here ;-).
> of course, fails.
> I am going to remove the DC off of the SQL server, but I though someone
> might know why having the second DC on the SQL server kills delegation.
> Thanks,
> Paul
>
>
This is kind of an SBS question, it was wrongly cross posted to a whole
bunch of newsgroups and the discussion might not necessarily accurately
reflect an SBS scenario. Such as the following:
quote:
> Generally speaking, running two important services on one machine is
unsafe.
quote:
> If one is compromised, the other one will fall too. We do not recommend
> running anything on a DC.
Les Connor [SBS MVP]
--
SBS Rocks !
"Dmitri Gavrilov [MSFT]" <dmitrig@.online.microsoft.com> wrote in message
news:eSmSyWe5DHA.2556@.TK2MSFTNGP09.phx.gbl...
quote:
> What service account is SQL using? NetworkService or LocalSystem? Note
that
quote:
> when it was living on a member server, those accounts were mapped to the
> computer account, and this account was used when SQL was accessing network
> resources. Now, when SQL lives on the DC, so called "loopback
> authentication" is taking place, and SQL comes to DC authenticated as
> NetworkServer or LocalSystem, respectively.
> Generally speaking, running two important services on one machine is
unsafe.
quote:
> If one is compromised, the other one will fall too. We do not recommend
> running anything on a DC.
> --
> Dmitri Gavrilov
> SDE, Active Directory Core
> This posting is provided "AS IS" with no warranties, and confers no
rights.
quote:|||Les,
> Use of included script samples are subject to the terms specified at
> http://www.microsoft.com/info/cpyright.htm
> "Paul L" <nospam@.loring.net> wrote in message
> news:u5x2oRc5DHA.2392@.TK2MSFTNGP11.phx.gbl...
Windows[QUOTE]
> authentication
> the
> authenticated
> be
> IIS
> which,
>
It was "wrongly" posted to the 3 (whole bunch?) newsgroups for the systems
involved. I have a problem that could be in any of the 3 places, SBS, SQL
or AD.
Furthermore, I have no idea what you are trying to say in your reply.
-Paul
"Les Connor [SBS MVP]" <les.connor@.DEL.cfive.ca> wrote in message
news:ekZiRmf5DHA.2720@.TK2MSFTNGP09.phx.gbl...
quote:|||Hi Paul,
> Let's be careful here ;-).
> This is kind of an SBS question, it was wrongly cross posted to a whole
> bunch of newsgroups and the discussion might not necessarily accurately
> reflect an SBS scenario. Such as the following:
>
> unsafe.
> --
> Les Connor [SBS MVP]
> --
> SBS Rocks !
>
> "Dmitri Gavrilov [MSFT]" <dmitrig@.online.microsoft.com> wrote in message
> news:eSmSyWe5DHA.2556@.TK2MSFTNGP09.phx.gbl...
> that
network[QUOTE]
> unsafe.
> rights.
> Windows
(all[QUOTE]
could[QUOTE]
and[QUOTE]
someone[QUOTE]
delegation.[QUOTE]
>
Yes. The Premium version of SBS contains SQL 2000.
My reply was based upon your statement:
"We recently added the server with SQL as a Domain Controller so it could be
used as a backup"
Based upon this statement, my response is that I would not recommend SQL
2000 on a DC.
My recommendation as far as troubleshooting is the same.
The best way to determine what is wrong is to make network traces from the
client machine, and use Kerbtray from the Windows 2000 Resource kit on the
client to verify that it is in fact
getting Kerberos ticket for IIS.
To download the Kerbtray utility, visit the
following Microsoft Web site:
http://www.microsoft.com/windows200...isting/kerbtray
-o.asp
Thanks,
Kevin McDonnell
Microsoft Corporation
This posting is provided AS IS with no warranties, and confers no rights.
Delegation And Windows 2003
I have the following scenario:
Machine 1: IIS Server - running Reporting Services
Machine 2: SQL Server - stores all data that a report will use
These servers run in a Windows 2000 Active Directory domain.
The IIS web site has the directory security set to Windows authentication
and Anonymouse authentication unchecked.
The reports use a shared data source that has the Windows authentication
checkbox checked.
The IIS Server has the delegation checkbox checked in Active Directories and
Users.
Run the report from a browser and get the login failed for the anonymous
user. Run the report from the IIS Server and it works. This is a sure
indication of a delegation issue.
What am I missing?Hi,
From your descriptions, I understood that running the report from a browser
and get the login failed for the anonymous user. Run the report from the
IIS Server and it works. Have I understood you? Correct me if I was wrong.
Based on my socpe, it seems to be a Kerberos issue and the simplest
workaround is changing the shared data source to use SQL authentication to
the SQL Server.
To set up delegation on a computer, the following conditions must be met:
* The account doing the delegation must be set to Trusted for delegation to
any service or Trusted for delegation to specified services only.
* The account that the service is delegating for must not have the Account
is sensitive and cannot be delegated option chosen.
* An administrator must have the Enable computer and user accounts to be
trusted for delegation privilege on the computer in order to enable
delegation.
See the following knowledge base article for more detailed information
Basic Overview of Kerberos User Authentication Protocol in Windows 2000
http://support.microsoft.com/kb/217098
Thank you for your patience and corporation. If you have any questions or
concerns, don't hesitate to let me know. We are always here to be of
assistance!
Sincerely yours,
Michael Cheng
Online Partner Support Specialist
Partner Support Group
Microsoft Global Technical Support Center
---
Get Secure! - http://www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
Please reply to newsgroups only, many thanks!sql
Machine 1: IIS Server - running Reporting Services
Machine 2: SQL Server - stores all data that a report will use
These servers run in a Windows 2000 Active Directory domain.
The IIS web site has the directory security set to Windows authentication
and Anonymouse authentication unchecked.
The reports use a shared data source that has the Windows authentication
checkbox checked.
The IIS Server has the delegation checkbox checked in Active Directories and
Users.
Run the report from a browser and get the login failed for the anonymous
user. Run the report from the IIS Server and it works. This is a sure
indication of a delegation issue.
What am I missing?Hi,
From your descriptions, I understood that running the report from a browser
and get the login failed for the anonymous user. Run the report from the
IIS Server and it works. Have I understood you? Correct me if I was wrong.
Based on my socpe, it seems to be a Kerberos issue and the simplest
workaround is changing the shared data source to use SQL authentication to
the SQL Server.
To set up delegation on a computer, the following conditions must be met:
* The account doing the delegation must be set to Trusted for delegation to
any service or Trusted for delegation to specified services only.
* The account that the service is delegating for must not have the Account
is sensitive and cannot be delegated option chosen.
* An administrator must have the Enable computer and user accounts to be
trusted for delegation privilege on the computer in order to enable
delegation.
See the following knowledge base article for more detailed information
Basic Overview of Kerberos User Authentication Protocol in Windows 2000
http://support.microsoft.com/kb/217098
Thank you for your patience and corporation. If you have any questions or
concerns, don't hesitate to let me know. We are always here to be of
assistance!
Sincerely yours,
Michael Cheng
Online Partner Support Specialist
Partner Support Group
Microsoft Global Technical Support Center
---
Get Secure! - http://www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
Please reply to newsgroups only, many thanks!sql
Subscribe to:
Posts (Atom)