SQL 2000 Windows Auth when a domain controller fails over

Question

SQL 2000 Windows Auth when a domain controller fails over

Rich Hansell

SSCrazy

Points: 2346
More actions
March 6, 2007 at 11:15 am

#171549

We have had a couple recent events where our batch dts has been interrupted because of some work that the AD/NT group has been doing.. specifically they are taking down an occasional DC (of which there are a dozen or so) This causes a short disconnect between SQL and the DC it was talking to..and causes the DTS to fail.. Anyone know of a work around? or perhaps can point me to some MS documentation explaining the exact Authentication process when SQL is running a DTS w/windows auth?
Any help/advice would be fantastic.. TIA

Viewing 5 posts - 1 through 4 (of 4 total)

You must be logged in to reply to this topic. Login to reply

Moreno-84941 Hall of Fame Points: 3258 More actions · Answer 1

If a DC becomes unavailable your sql server should contact the next one. Do you have another DC in the network segment ? If no make sure that your AD/NT group can garantee a DC connectivity, otherwise you could get more problems

Jeff Gray SSChampion Points: 10667 More actions · Answer 2

"...This causes a short disconnect between SQL and the DC it was talking to..and causes the DTS to fail..."

I'm curious as to how you were able to make this determination. Are you sniffing the wire? What are you seeing?

Rich Hansell SSCrazy Points: 2346 More actions · Answer 3

I had our Inf team take a look and he confirmed a loss of connection with the DC at the time the the Authentication error occurred and we confirmed that particular DC was taken offline for maint at that time..

Jeff Gray SSChampion Points: 10667 More actions · Answer 4

I would suspect that for some reason the client is not reaching an alternate DC to get authenticated within the ConnectionTimeout period. I can't find any information on what the default timeout is, but it can be set to an explicit amount in the OLEDB properties of the connection object.

I think that the default value should be long enough for most situations, but if you have a complicated AD or one that has orphans in the DNS (aka "broken") then I can see how this might occur.

This is mostly speculation on my part, but it might be helpful speculation.

http://support.microsoft.com/kb/266080/ describes how the Windows2000 Kerberos authentication works in FAQ form. This might help you figure it out, but you also might be in a "Call Microsoft" situation.