SCVMM 2008 R2 - "The SQL Server service account does not have permission to access Active Directory Domain Services (AD DS)."

I know this question has been asked before, but never for R2, that I can tell, and the posted fixes aren't working. I have just installed SCVMM 2008 R2 on a Windows Server 2008 R2 server, using a remote SQL 2008 SP1 database. When I attempt to connect to SCVMM, I get the following error:
"The SQL Server service account does not have permission to access Active Directory Domain Services (AD DS).
Ensure that the SQL Server service is running under a domain account or a computer account that has permission to access AD DS. For more information, see "Some applications and APIs require access to authorization information on account objects" in the Microsoft Knowledge Base at http://go.microsoft.com/fwlink/?LinkId=121054.
ID: 2607"
What I've seen online is that this is usually becuase the domain account SCVMM is running as does not have the proper permissions on the SQL database. Here's what I've confirmed:
1) My SCVMM service account is a local admin on the SCVMM server
2) My SCVMM service account is a dbowner on the SCVMM database in SQL
3) My SQL service account is a dbowner on the SCVMM database in SQL
4) My SQL service account is a domain user (even made it a domain admin, just in case, and it still "doesn't have access to AD DS," which is obviously untrue)
5) Neither service account is locked out
Has anyone run in to this? It says in Technet that remote SQL 2008 is supported, as long as the SQL management studio is installed to the SCVMM server, and I installed and patched before I began the SCVMM installation. I just don't know what else to try - I have no errors in event logs, no issues during the installation itself...
Andrew Topp

That answer was very unhelpful fr33m4n. The individual mentions that they've received the error that points to the KB article. I currently receive the same error -- there seems to be no resolution. I've run the Microsoft VBS script to add TAUG to the WAAG
as suggested by 331951, and that made absolutely no difference.
1) My SCVMM service account is a local admin on the SCVMM server
2) My SCVMM service account is a dbowner on the SCVMM database in SQL
3) My SQL service account is a dbowner on the SCVMM database in SQL
4) My SQL service account is a domain user (even made it a domain admin, just in case, and it still
"doesn't have access to AD DS," which is obviously untrue)
The user is also a member of WAAG, the machines have delegated authority to each other. Is there any other solution?

Similar Messages

I keep getting the error message Apple ID does not have permission to access iTunes Connect. please explain why?

Question:
I try to log into my itunes connect acct and I I still keep getting the error message
Apple ID does not have permission to access iTunes Connect.
please explain why?

PS I have also read all of the old postings in regards to this and nothing is working.

I cant login to DPS App Builder. Get this error: ERROR This account does not have permission to access App Builder. Learn more about how to resolve this problem.

I cant login to DPS App Builder. Get this error: ERROR This account does not have permission to access App Builder. Learn more about how to resolve this problem.

Then you either need to:
1) Sign up for Creative Cloud so you can build a Single Edition app. Be warned though: this approach will no longer be valid as of May 1st when we retire support for Single Edition in Creative Cloud, and Single Edition apps are only on iPad devices.
2) Sign up for a full DPS license. You can request pricing information by filling in Adobe | Request for consultation.
Neil

SQL server agent job running as Agent Service Account whose service account does not have r/w access but is still able to write?

Hi. I am newer to SQL server security and am reviewing some of our SQL server's configuration to make sure the services are running under accounts with least privilege. I have a SQL server 2012 instance whose Agent service is configured to run
under an AD user account named 'SQLServices'. The jobs on this server are configured to run as 'SQL server agent service account', which means they should execute as user 'SQLServices'. The jobs are set up to execute SSIS packages which read and
write to a database on the same server where the agent job is scheduled and SSIS package installed (all on same server). The jobs are currently executing without error and are reading writing data correctly. Upon close examination, it turns out the
SQLServices account is not assigned to the 'sysadmin' role and had no users mapped to any databases on this server. How are these jobs working? I verified in profiler that the login name indeed is 'SqlServices'. I also verified
that SQLServices login has no database access by remote-ing onto the server and trying to log into the DB, and access was denied as expected. According to the literature, the Agent service needs to be a member of 'sysadmin role' but I am reading
some cases where that is not necessarily the case. So this is not so concerning. What is concerning is that the login 'SQLServices' had no access to the databases on that server yet it is reading and writing to the databases as if it does.
The only thing I can think of is maybe jobs run as 'SQL server agent service account' on the same server as the databases it r/w to somehow has some kind of default access. What am I missing here? Any input would be helpful.

After 2 days on this forum I found the answer to my own question. In retrospect, I should have posted this under 'SQL Server Security', but I didn't know it existed.
The 2 threads below explain that Sql agent actually runs using SID (service) NT SERVICE\SQLSERVERAGENT if you chose that when you installed. This will automatically create an associated login NT SERVICE\SQLSERVERAGENT in SQL server with sqladmin
role. This is the login that Agent uses to connect to the local instance of SQL server. If you changed to domain account to run the service during install or after using config manager, basically NT SERVICE\SQLSERVERAGENT is still
used to connect to your local instance behind the scenes (even though you will still see your domain user as account), and the domain account is used to reach outside the server.
https://social.msdn.microsoft.com/Forums/sqlserver/en-US/9e6bb2de-8fd0-45de-ab02-d59bbe05f72e/servicedatabase-accounts-nt-servicemssqlserver-nt-servicesqlserveragent-what-are-they-for
https://social.technet.microsoft.com/Forums/sqlserver/en-US/b83a52fd-fe11-4c28-a27b-88be8ae79f2a/how-do-i-change-sql-server-agent-service-account-to-nt-servicesqlserveragent?forum=sqlsecurity

VMM Shared ISO error "User account does not have permission required to open attachment"

I had this error once because the local service account was selected during installation of VMM. I have reinstalled VMM with a Domain service account and the error went away. However, the error is back.
"User account does not have permission required to open attachment '\\[servername]\VMMLibrary\server.ISO'. Error: 'General access denied error' (0x80070005). (Virtual machine ID GUID)"
I tried to create this VM on Host1 and got the error.
I then went to Host2 and was able to create the VM while using the same ISO on the same VMM library that failed on the Host1.
Both hosts have agent 3.2.7634.0 and are both running Hyper-V Server 2012 R2.
What is wrong with Host1 and how do I correct it?
Thank you.

This is a share configuration permissions issue.
http://technet.microsoft.com/en-us/library/ee340124.aspx
Brian Ehlert
http://ITProctology.blogspot.com
Learn. Apply. Repeat.

Why when I try to login the Itunes Connect with my Apple ID it always says: "Apple ID does not have permission to access iTunes Connect."?

Why when I try to login the Itunes Connect with my Apple ID it always says: "Apple ID does not have permission to access iTunes Connect."?

Look on one of your bank statements and be sure to enter the billing address exactly as it shows on the statement. Some folks forget where they actually get the statement. They put their home address in iTunes/Mac App Store and they actually get the statement at their place of employment or vice versa.

Project Server 2013 - User does not have permission to create a WSS site

We have Auto-Publish enabled for the project by the Owner. The issue is that when a user submits his updates, the updates are auto approved and auto-published but it also ends up showing below error to the user.
General
•User does not have permission to create a WSS site.:
◦GeneralSecurityAccessDenied (20010). Details: id='20010' name='GeneralSecurityAccessDenied' uid='---'.
•Queue:
◦GeneralQueueJobFailed (26000) - CreateWssSite.CreateWssSiteMessage. Details: id='26000' name='GeneralQueueJobFailed' uid='---' JobUID='---' ComputerName='---' GroupType='CreateWssSite' MessageType='CreateWssSiteMessage' MessageId='1' Stage='' CorrelationUID='54a0c79c-da9b-c011-2554-5fb474e440c6'.
For more details, check the ULS logs on machine --- for entries with JobUID ---.
And in the Project Queue, the failed job type and job state are
Job type- Project Site Update
Job State - Failed But Not Blocking Correlation
We have disabled Site Provisioning for Project publish.
Can anyone point us on how auto-publish works and what all permission is required by users or owners?

Hi Goahh,
It might be that your issue has nothing to do with the rules set to auto-publish the project. Try to inactivate the auto-publish for a test project and try if the publication by itself works. Or simply try to publish a project from MS Project Pro and see
if you still get the error message.
Has it been working before?
Check also that the "Manage SharePoint Foundation" permission is enabled for the security groups in question.
Hope this helps,
Guillaume Rouyre, MBA, MVP, P-Seller |

"There was a problem downloading the software for the iphone"iPhone username". you do not have permission to access the requested resource.

Hi there,
If you have have this error
"There was a problem downloading the software for the iphone"iPhone username". you do not have permission to access the requested resource.
when trying to update you iphone then try to switch to airplane mode and retry (after updating windows and itunes as advised on other threads but did not resolve the error)...it worked great for me. (picked up this tip here https://discussions.apple.com/message/19619175#19619175)
cheers

Hi Guys,
I have the sam problem just upgrading to iOs6.0.1. iTunes returns the following error:
Ive tried updating via my device (New iPad) and same problem.
I started downloading the update last week but stopped it for reasons I cannot remember. Now it seems that Ive clogged my system.
My iTunes is up to date. I have however not run any Quicktime or iCloud updates cause i do not use the software. Will it make a difference.
Also my Windows updates might be a bit outdated, say about a month or so.
Please help, very frustrating!
Also sorry but while Im here I have another question. A while ago the brightness level of my iPad adjusted by itself (not Auto Adjust). Its like it dimmed via Auto Adjust and did not "un-dim" and now Im forced to run brightness at 100% and consequently is hard on battery life. Any ideas?

Cannot access my iTunesConnect account, I get: "Apple ID does not have permission to access iTunes Connect"

iTune Connect does let me log in. "Apple ID does not have permission to access iTunes Connect."

I'm going crazy here. I've emailed, called, and banged my head on every apple support door in existence including:
- itunes
- Independent Labels
- Apple Developer
- Apple Marketing
- Apple Support
I filled out an application to sell music on iTunes but messed up one field in the form. I received an email from apple alerting to me about the error and asking me to login to iTunes Connect and finish my application. When I went to the page to fix the form (itunesconnect.apple.com) I received the following error "Your iTunes Connect ID has not been enabled." I tried to start over filling out the application from scratch and received this error "This tax ID is already associated with an iTunes store application."
Seriously, this has been going on in heartless loop since NOVEMBER. It sure doesn't feel like anyone at Apple cares, at least none of the 20 people I've communicated with. Yes, I am about to throw in the towel and sell exclusively on Google Play store.

The account does not have permission to impersonate the requested user

I get a runtime error trying to impresonate a user - code below
Service = New ExchangeService()
Service.Url = New Uri(ApplicationItems.ExchangeURL)
Service.Credentials = New NetworkCredential(username, password)
Service.ImpersonatedUserId = New ImpersonatedUserId(ConnectingIdType.SmtpAddress, emailAddress)

The error is telling you that what ever user you have used in
Service.Credentials = New NetworkCredential(username, password)
Doesn't have Impersonation rights, Impersonation right need to granted to that user see
https://msdn.microsoft.com/en-us/library/office/bb204095%28v=exchg.140%29.aspx
Cheers
Glen

New install of SQL 2014 Std MSDN. Get "The SQL Server product key is not valid. To proceed, re-enter the product key values from the Certificate of Authenticity (COA) or SQL Server packaging."

Trying to install a new version of SQL 2014 Std 64 or x86. Installing on Windows 8.1Pro 64bit machine.
I get:
"TITLE: SQL Server Setup failure.
SQL Server Setup has encountered the following error:
The SQL Server product key is not valid. To proceed, re-enter the product key values from the Certificate of Authenticity (COA) or SQL Server packaging.
Error code 0x858C0017."
I looked at the summary log and that is the only error.
I made sure there were no other instances of SQL on this machine. Uninstalled all VS2013 and sql instances just in case. IF there is somewhere to check if a previous version or license is causing the issue, i would be glad to check.
Any help would be appreciated.

Hi,
Please read this thread with similar issue
http://social.msdn.microsoft.com/Forums/sqlserver/en-US/bdd94577-515c-49fa-be44-008eacece057/installing-sql-server-2012-on-a-new-vm-error-code-0x858c0017?forum=sqlsetupandupgrade
Please mark this reply as answer if it solved your issue or vote as helpful if it helped so that other forum members can benefit from it
My Technet Articles

How to create two domains name in one active directory domain service .server 2012 ??

Hi there
I want to try sharepoint foundation and office web apps server .
I installed server 2012 sharepoint found 2013 sql server 2012 and create a new forest on active directory domain sevice
now I want to install office web apps server 2013 but when I run the setup said me can't install office web apps server on the domain name that installed sharepoint .
how can I create second domain name on this active directory domain service to install office web apps server ?
help me please I'm new and just want to try sharepoint and office web apps server .
mostly I need to create MS access custom web app and I need the web place to run my access custom web app on this server and because I live in iran can't create and sign up for office 365 and sharepoint online so i'm forced to run them on my system .help
me to complete ths server ?
Greate Regards :
Raha
whit the best regard : Raha

Hi,
For how to Use Office Web Apps with SharePoint 2013, the below links should be what you want to refer to:
Configure Office Web Apps for SharePoint 2013
http://technet.microsoft.com/en-us/library/ff431687.aspx
Video: Configure Office Web Apps for SharePoint 2013
http://technet.microsoft.com/en-us/library/dn455088.aspx
How Office Web Apps work on-premises with SharePoint 2013
http://technet.microsoft.com/en-us/library/ff431685.aspx
In addition, for further assistance for Sharepoint, I suggest you post in the SharePoint forum.
Regards,
Yan Li
Regards, Yan Li

You are not allowed to continue because your account does not have the proper privileges

I've been using PS since version 3. I currently run CS2 on Windows XP service pack 2. I've been using CS2 since it was first released. Now, all of a sudden, anytime I install or uninstall a program, whether it is related to Photoshop or not, when I start CS2 I get a window that says "You are not allowed to continue because your account does not have the proper privileges" and the program aborts. The first time this happened and after I had restarted CS2 for the 4th time it started normally. Since then it requires at least one restart (not reboot)after the error and then CS2 starts normally. Anyone have any idea of what is going on here? The first time it happened was right after I had installed a new HP AIO printer and I thought that may have had something to do with it. However, I have installed a couple of other programs and uninstalled another, none of them related in any way to CS2, and I get the error the next time I run CS2. I have found some posts about this but no answers, and most of the posts were related to Vista, not XP. I need help please.

there's a section in adobe.com (not adobeforums.com!) where after you log in (seperate log in from this site) you can go to "my account" and then "my registrations". you can manually add registrations there. that's how i've registered most of my adobe purchases.
ok. just ran through it:
go to http://www.adobe.com/ (make sure you have flash turned on)
click "Your Account" in the upper left corner.
log in with your adobe.com id, create one if you don't have one. this is SEPERATE from the id you log into this forum with!
click on "View Product Registrations"
click on "View Adobe branded products registrations"
if you have any registed packages, they'll be listed. at the bottom of the page click on the button that looks like this:

Suddenly cannot connect to server "you do not have permission to access the server"

I am one of only two Macs in our office.
Up until now I have been able to connect to our shared folders/server just fine. Occasionally and randomly I would seem to get booted off, but would just log back in.
Now suddenly I get "Connection Failed You do not have permission to access this server".
I seem to get it whether its cifs, afp or smb.
After it denies the connection it also boots me from email. As soon as I cancel the attempt to connect the email recognizes my password again.
I have tried rebooting, repairing permissions and having our network admin change my password and nothing seems to work.
If I enter an incorrect pw it recognizes it as such. I only get the above message when I use the correct username and PW.
Additionally if I go to the other mac in our office I am able to connect using the same credentials without any problem.
This is via ethernet.

i also got the same problem on my ipad i have tried every thing i dont knw hw to fix this problme any solution. ???????????????????????????????????????????????????

Your account does not have access to the forums system.

Greetings, My name is Jeff, I'm from Netwrix Corporation, which is a Microsoft partner. I have a problem with accessing Microsoft TechNet forum. After signing-in to my account: [email protected], I go to TechNet
forum, and get a message that: "Your account does not have access to the forums system." And also I've noticed that all my posts were deleted from TechNet forums. Can moderators tell me why did that happen? Why didn't I receive any warning
about my account suspension?
I've already submitted 2 tickets to MSDN Site Feedback Inquiry but didn't receive any answer.
I've called Microsoft TechNet at 800-344-2121 and Professional
Support team at 1-800-936-5800. But everybody send me to the MSDN Site Feedback Inquiry from which I didn't get any answer.
Anybody can help me with my problem?

Hi,
Is this the profile you're referencing?
http://social.technet.microsoft.com/Profile/netwrix
It doesn't appear to be banned, but you're definitely right about there being no activity listed.
I'd suggest contacting the forums team directly by sending an email to fissues (at) microsoft [dot] com. The admins do monitor this forum, so you'll probably get a response here as well.
Don't retire TechNet! -
(Don't give up yet - 13,085+ strong and growing)

SCVMM 2008 R2 - "The SQL Server service account does not have permission to access Active Directory Domain Services (AD DS)."

Similar Messages

Maybe you are looking for