Windows Authentication Failing

  • We have a 3-node Active / Active / Active cluster, with an instance of SQL 2000 on each node. We have set up the DBA AD group as sysadmin on each box, and up until today I could connect to all the instances successfully.

    Today, my windows authentication started giving me the "Login failed for user '(null)'..." error. SQL is still in mixed auth. mode, my ID is still part of the DBA AD group and I can connect to the other two instances on the cluster with Windows Auth.

    The group that controls AD sit across the aisle (literally) from me, and they said they made no changes in AD this week (the Windows Auth login worked on Tuesday).

    Anyone have any ideas what might have happened?

    Thanks in advance for any help.

  • You probly figured this out already,

    but when you get that error it usually means your account got locked, but your security token is out of sinc.

    Log off your machine, and try to log in again.

  • Ray, thanks for the thought - I already tried the logoff / logon maneuver, it didn't help. If my AD account was locked - I wouldn't have been able to connect to the other instances on the same cluster with Windows Auth.

    I also found another occurance of the same, on a SQL 2005 (non-clustered) instance ... it seems to be spreading.

  • Check if you have proper registry permissions set up in the machines where you get an error. this is sure to be a permission problem.

    Cheers,
    Sugeshkumar Rajendran
    SQL Server MVP
    http://sugeshkr.blogspot.com

  • check the SPN ! if you rely on kerberos authentication.

    the service principal name also includes the portnumber of your sqlserver.

    Check the sqlserver error log for the spn message at startup time.

    Johan

    Learn to play, play to learn !

    Dont drive faster than your guardian angel can fly ...
    but keeping both feet on the ground wont get you anywhere :w00t:

    - How to post Performance Problems
    - How to post data/code to get the best help[/url]

    - How to prevent a sore throat after hours of presenting ppt

    press F1 for solution, press shift+F1 for urgent solution 😀

    Need a bit of Powershell? How about this

    Who am I ? Sometimes this is me but most of the time this is me

  • Sugesh - I'm not sure what Registry permissions you are referring to ...

    ALZDBA - the SPN seems to be fine, I think, can I get a little more detail on how to check that, from you.

    As another piece on information - I have multiple ID's that I use to RDP onto the servers in our various domains. If I log on to my PC with my RDP ID in the same domain as my regular ID, I can connect to both boxes via SSMS, using Windows Auth.

    Thanks for the help so far.

  • more on SPN-info

    http://technet2.microsoft.com/windowsserver/en/library/b3a029a1-7ff0-4f6f-87d2-f2e70294a5761033.mspx?mfr=true

    make sure you can see the server registered with the actualy used portnumber ! (be carefull with dynamic ports !)

    Johan

    Learn to play, play to learn !

    Dont drive faster than your guardian angel can fly ...
    but keeping both feet on the ground wont get you anywhere :w00t:

    - How to post Performance Problems
    - How to post data/code to get the best help[/url]

    - How to prevent a sore throat after hours of presenting ppt

    press F1 for solution, press shift+F1 for urgent solution 😀

    Need a bit of Powershell? How about this

    Who am I ? Sometimes this is me but most of the time this is me

  • Thanks, ALZDBA, I'll check into that, and leave a reply on whether thats the issue or not.

  • Check the times on the servers and please let us know if you determine the cause.

  • So far - Service Principal Names are not the issue, the servers all have the same times, AD changes are not the cause either. We are going to move the cluster group to another node and test connectivity again. Then reboot the server (curent cluster group host) and move the cluster group back and try again.

    We can't identify a definitive cause, so we're in the "try it and see" phase, I'll let you know how it goes...

  • Please do.

    Also, just to be clear, are you connecting to the actual instances or virtual instances?

    Any failover events? Can you double check that

    - you're hitting the virtual instances correctly

    - you're in the DBA AD group (no strange changes)

    - No deny groups

    - your workstation time is the same as the servers

    - Does it cause you issues from any workstation?

  • Hello Simon,

    Our users used to get this error occasionally when they connect to our development environments and the reason found is that the password policy expires every 30 days. These users do change their password but don't restart their systems and as a result whenever they try to access the SQL box which is already registered with the previous password, they encounter this error message " Login failed for user (null)".

    Have you changed your password? If so, try to restart your system and then access the cluster nodes.

    Hope this helps.

    Thanks


    Lucky

  • Steve / Lucky,

    everything looks good on the cluster - no failovers, time is good all around - everything is successfully synched up on the time servers, I'm still in the DBA's AD group, I did change my password recently, but the last change was about a week before the problem arose, I take my laptop home every night (joys of being DBA on call !!) so it gets cold booted at least once a day.

    If I RDP onto our Idera DM box, I can connect using my windows ID, just not from my laptop (tested by creating an ODBC connection in both places). The problem seems to be restricted to my laptop and the one virtual server.

  • Ahh, I hate those. Any chance you can open a case with MS? If you have TechNet or MSDN, I think you get some free ones.

    This is likely some crazy caching thing on your laptop.

  • If the Fileover / Reboot / Failover doesn't resolve the problem, I will open a ticket with MS. It's just an inconvenience for me, but it's a production server - Altiris / SolarWinds / VM Center / etc live on this server, so we need to be sure it's not a problem that could spread to other apps.

    The reboot sequence wont happen until later in the week ... I'll keep you posted.

    Thanks for all the good suggestions / thoughts.

Viewing 15 posts - 1 through 15 (of 16 total)

You must be logged in to reply to this topic. Login to reply