SQL Server Service Account - Domain Account - WMI Provider Error - 0x80092004

Hi,
if I try to use an domain account for SQL service start using SQL configuration Manager I receive the error
WMI Provider Error - 0x80092004
in Popup Window and in Eventlog 5 Error Events from Source MSSQLSERVER:
26014:
Unable to load user-specified certificate [Cert Hash(sha1) "BA78B5DBF93CCD7EFA1860C99B0D6141D480199A"]. The server will not accept a connection. You should verify that the certificate is correctly installed. See "Configuring Certificate for
Use by SSL" in Books Online.
17182:
TDSSNIClient initialization failed with error 0x80092004, status code 0x80. Reason: Unable to initialize SSL support. Cannot find object or property. "
17182:
TDSSNIClient initialization failed with error 0x80092004, status code 0x1. Reason: Initialization failed with an infrastructure error. Check for previous errors. Cannot find object or property.
17826:
Could not start the network library because of an internal error in the network library. To determine the cause, review the errors immediately preceding this one in the error log.
17120:
SQL Server could not spawn FRunCommunicationsManager thread. Check the SQL Server error log and the Windows event logs for information about possible related problems.
After I put the account in local administrator group the service starts up.
I want to use the lowest privileges. Do I really need the SQL server service account in local administrator group? How to fix the error?
thanks

Hi baschuel,
It is recommended to run SQL Server service by using the lowest possible user rights and it is supported to use a domain account instead of an account from local Administrators group to configure SQL Server service. According to your error messages, the
issue could be due to that the incorrect certificate is used, or the domain account has no access to the Crypto folder(C:\ProgramData\Microsoft\Crypto). To troubleshoot the issue, you could follow the two solutions below.
1.Import the correct certificate following the steps in the article:
http://windows.microsoft.com/en-hk/windows/import-export-certificates-private-keys#1TC=windows-7
2.Grant the domain account full access to the Crypto folder.
Regards,
Michelle Li
If you have any feedback on our support, please click
here.

Similar Messages

Changing sql server service and sql server agent service startup account in SQL Server hosting SharePoint DB

Hi
i have a sharepoint deployment with one SQL Server (running on VM) hosting the config DB and another SQL Server (Physical Host because VM was running out of space) to host the huge Content DBs. I need to schedule automatic backups of the Content DBs to a
network share. For that i need to run the SQL Server Service with an account having permissions to the share as suggested in https://support.microsoft.com/kb/207187?wa=wsignin1.0
I tried changing the logon as a service account to a domain
account which has permissions to the Network Share and is also in local Administrators group of SQL Server and has "public and sysadmin" roles in SQL Server but that caused an issue. the SharePoint Web Application started showing a White Screen so
I had to revert back to the default accounts i.e. NT Service\SQLSERVERAGENT and NT Service\MSSQLSERVER. I viewed the event logs . These are the types of error i got after changing the logon as a service account to a domain account
1) Information Rights Management (IRM): Retried too many times to initialize IRM client. Cannot retry more. Retried times is:0x5.
System
Provider
[ Name]
Microsoft-SharePoint Products-SharePoint Foundation
[ Guid]
{6FB7E0CD-52E7-47DD-997A-241563931FC2}
EventID
5148
Version
15
Level
2
Task
9
Opcode
0
Keywords
0x4000000000000000
TimeCreated
[ SystemTime]
2015-02-02T04:46:04.750899500Z
EventRecordID
176477
Correlation
[ ActivityID]
{8FACE59C-1E17-50D0-7135-25FDB824CDBE}
Execution
[ ProcessID]
6912
[ ThreadID]
8872
Channel
Application
Computer
Security
[ UserID]
S-1-5-21-876248814-3204482948-604612597-111753
EventData
hex0
0x5
2)
Unknown SQL Exception 0 occurred. Additional error information from SQL Server is included below.
The target principal name is incorrect. Cannot generate SSPI context.
System
Provider
[ Name]
Microsoft-SharePoint Products-SharePoint Foundation
[ Guid]
{6FB7E0CD-52E7-47DD-997A-241563931FC2}
EventID
5586
Version
15
Level
2
Task
3
Opcode
0
Keywords
0x4000000000000000
TimeCreated
[ SystemTime]
2015-02-02T07:01:35.843757700Z
EventRecordID
176490
Correlation
[ ActivityID]
{50B4E59C-5E3A-50D0-7135-22AD91909F02}
Execution
[ ProcessID]
6912
[ ThreadID]
5452
Channel
Application
Computer
Security
[ UserID]
S-1-5-17
EventData
int0
0
string1
The target principal name is incorrect. Cannot generate SSPI context.

Hi Aparna,
According to your description, you get the above two errors when scheduling backups of Content DB. Right?
Based on those two error messages, they are related to the service principal name(SPN) for SQL Server service. Please verify the if the SPN is registered successfully. You can view it in ADSI Edit or use command line. Please see:
http://blogs.msdn.com/b/psssql/archive/2010/03/09/what-spn-do-i-use-and-how-does-it-get-there.aspx
When installing SQL Server, those two services below should be registered:
MSSQLSvc/servername:1433
MSSQLSvc/servername
Please check if those SPNs or duplicated SPNs exist. You can use command to reset SPN or remove duplicated SPN and add new one. See:
Setspn.
We have also met this issue when this SPN is registered under Administrator. Please try to register it under Computer. You can add it in ADSI Edit.
If you have any question, please feel free to ask.
Simon Hou
TechNet Community Support

SharePoint 2010 - SQL Server Service Application Server Appears on Server without SSRS Installed

I have SSRS instance installed on Server 2 in integrated mode and reports within SharePoint are working as expected. But, when you go to manage the SQL Server Service Application it throws an 503 error and I believe it is related to the fact that the
service also shows up on another Application Server, Server1, that does not have SSRS installed. The service is disabled and it shows up in the list of Services for the server but I believe SharePoint thinks its the primary service and cannot access
it. Is there any way to remove the Service from Server2? I attempted the below powershell commands to remove but it gives me an error. Any suggestions would be appreciated.
Get-SPRSServiceApplicationServers
Address
Server1
Server2
get-spserviceinstance -all |where {$_.TypeName -like "SQL Server Reporting*"}
TypeName                         Status   Id
SQL Server Reporting Services... Disabled a5179dce-2d6c-476b-a74b-764375d70a94
SQL Server Reporting Services... Online   64a99ed8-d31c-4dd3-b9f7-b6d946e41e16
Remove-SPServiceApplication a5179dce-2d6c-476b-a74b64375d70a94 -RemoveData
Remove-SPServiceApplication : Object not found.
At line:1 char:28
+ Remove-SPServiceApplication <<<< a5179dce-2d6c-476b-a74b-764375d70a94 -Remo
eData
    + CategoryInfo          : ObjectNotFound: (Microsoft.Share...viceApplicati
   on:SPCmdletRemoveServiceApplication) [Remove-SPServiceApplication], Invali
dOperationException
    + FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletRemoveSe
   rviceApplication
Remove-SPServiceApplication : Object reference not set to an instance of an ob
ect. At line:1 char:28
+ Remove-SPServiceApplication <<<< a5179dce-2d6c-476b-a74b-764375d70a94 -Remo
eData    + CategoryInfo          : InvalidData: (Microsoft.Share...viceApplication:
   SPCmdletRemoveServiceApplication) [Remove-SPServiceApplication], NullRefer
enceException + FullyQualifiedErrorId : Microsoft.SharePoint.PowerShell.SPCmdletRemoveSe
   rviceApplication

You're getting a Service Instance object and trying to remove it with a Service Application cmdlet... This won't quite work :) Can you double check to validate that SSRS 2008 R2 or higher bits were not accidentally laid down on the problem host?
Trevor Seward, MCC
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

SCVMM 2008 R2 - "The SQL Server service account does not have permission to access Active Directory Domain Services (AD DS)."

I know this question has been asked before, but never for R2, that I can tell, and the posted fixes aren't working. I have just installed SCVMM 2008 R2 on a Windows Server 2008 R2 server, using a remote SQL 2008 SP1 database. When I attempt to connect to SCVMM, I get the following error:
"The SQL Server service account does not have permission to access Active Directory Domain Services (AD DS).
Ensure that the SQL Server service is running under a domain account or a computer account that has permission to access AD DS. For more information, see "Some applications and APIs require access to authorization information on account objects" in the Microsoft Knowledge Base at http://go.microsoft.com/fwlink/?LinkId=121054.
ID: 2607"
What I've seen online is that this is usually becuase the domain account SCVMM is running as does not have the proper permissions on the SQL database. Here's what I've confirmed:
1) My SCVMM service account is a local admin on the SCVMM server
2) My SCVMM service account is a dbowner on the SCVMM database in SQL
3) My SQL service account is a dbowner on the SCVMM database in SQL
4) My SQL service account is a domain user (even made it a domain admin, just in case, and it still "doesn't have access to AD DS," which is obviously untrue)
5) Neither service account is locked out
Has anyone run in to this? It says in Technet that remote SQL 2008 is supported, as long as the SQL management studio is installed to the SCVMM server, and I installed and patched before I began the SCVMM installation. I just don't know what else to try - I have no errors in event logs, no issues during the installation itself...
Andrew Topp

That answer was very unhelpful fr33m4n. The individual mentions that they've received the error that points to the KB article. I currently receive the same error -- there seems to be no resolution. I've run the Microsoft VBS script to add TAUG to the WAAG
as suggested by 331951, and that made absolutely no difference.
1) My SCVMM service account is a local admin on the SCVMM server
2) My SCVMM service account is a dbowner on the SCVMM database in SQL
3) My SQL service account is a dbowner on the SCVMM database in SQL
4) My SQL service account is a domain user (even made it a domain admin, just in case, and it still
"doesn't have access to AD DS," which is obviously untrue)
The user is also a member of WAAG, the machines have delegated authority to each other. Is there any other solution?

Report service Integration (sql 2012 and SharePoint 2013) error Report Server WMI Provider error: Invalid namespace

Report Server WMI Provider Error: Invalid namespace
Domain Server, Sql2012 server and SP2013 Server (3 vm servers)
the sql server reporting services service application and applications Proxy are installed and started (SP2013 Sever)
the sql server PowerPivot system Service and SQL server Reporting Services Service are Started (in Services on Server)
in sql server 2012 sp1 reporting service configured (web service URL and Report Manager URL are configured and tested, the database report server mode is native) (SQl 2012 Server)
under general Application Settings .. trying to setup the "Reporting Service Integration" give us the above error message (Report Server WMI Provider Error: Invalid namespace)
I was looking for all blogs and TechNet material but without success.

Follow these steps:
1) Uninstall SSRS from the Database Engine server (MSSQLSERVER instance).
2) Install SSRS on the SharePoint server using the "Reporting Services - SharePoint" install option during SQL Feature selection, no other services are required (e.g. you do not need to install Database Engine services).
3) You should then see SSRS as a Service Instance in Central Admin -> Manage Services on Server, at which point you can also create an SSRS Service Application.
While this guide (http://msdn.microsoft.com/en-us/library/jj219068.aspx#bkmk_install_SSRS) walks you through it, this is for a single server install where the Database Engine is also installed on SharePoint, not something you want to do.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Does changing the SQL Server Service Account impact FILESTREAM data?

I have a stand-alone SQL Server 2008 instance that I need to change the SQL Server service account from LocalSystem to a domain account. However, I was wondering if there was any impact on FILESTREAM enabled databases that are hosted on the SQL Server?
Specifically, has anyone ever changed the SQL Server service account when using FILESTREAM ...
Sincerely,
Sean Fitzgerald

I have a stand-alone SQL Server 2008 instance that I need to change the SQL Server service account from LocalSystem to a domain account. However, I was wondering if there was any impact on FILESTREAM enabled databases that are hosted on the SQL Server?
Specifically, has anyone ever changed the SQL Server service account when using FILESTREAM ...
Sincerely,
Sean Fitzgerald
BOL says : Only the account under which the SQL Server service account runs is granted NTFS permissions to the FILESTREAM container.So, if you start SQL Server under different account , that account wil have access to use fliestream data (read / write)
At the database level ,If a user has permission to the FILESTREAM column in a table, the user can open the associated files..
Abhay Chaudhary OCP 9i, MCTS/MCITP (SQL Server 2005, 2008, 2005 BI) ms-abhay.blogspot.com/

Reviewing Windows NT Rights and Privileges Granted for SQL Server Service Accounts

Hi Folks,
I am an experienced .NET apps developer who has been tasked with writing a bunch of technical controls for all the SQL Server instances on a domain.
So for the last month I have been diving in the deep end learning Powershell, dba and infrastructure tasks. This is still a work in progress, so be kind to me.. ;o)
So the task I am stuck on is described in the section on 'Reviewing Windows NT Rights and Privileges Granted for SQL Server Service Accounts' http://technet.microsoft.com/en-us/library/ms143504(v=sql.105).aspx
I have not been able to find cmdlets that gives me this information. I have found some exes which come frustratingly close like NTRights.exe. This lets me specify a computer name which is great, but only seems to let you set or deny permissions, not just
list them!
Any help with this would be very much appreciated as I am firmly stuck. As per comments above also bear in mind that up until around 1.5 months ago I had never used powershell / knew very much at all about SQL server admin etc. Feeling much more comfortable
with them now, but much less so with Active Directory/ windows permission structures etc so please can I ask anyone kind enough to reply to try and keep the acronyms down as much as humanly possible.. ;o)
Cheers
Kieron

Hi Kieron,
Take a look at this module, it makes permissions much easier to work with than what's currently available:
https://gallery.technet.microsoft.com/scriptcenter/PowerShellAccessControl-d3be7b83
Don't retire TechNet! -
(Don't give up yet - 13,085+ strong and growing)

SQL Server services accounts using Managed Service Accounts

Hi guys,
Need your feedback on something, is it wiser to use Managed Service Accounts or normal domain accounts to run SQL Server services? MSA's only work in a single computer, so for every environment I would need to create a new set of sql services accounts.
If I create a single account wouldn't it be simpler? For instance domain\sqlservices and set it on every service and every environment (dev, qa and production)

Hi
It is a good question but the answer is not black or white. The answer is depend like most configuration questions.
I recommend you to use
Google to find blogs about the issue.
You can start from this links, which are great starting point for you question:
Best Practices For Using SQL Server Service Accounts
Book Online
Ronen Ariely
[Personal Site] [Blog] [Facebook]

SQL Server Service account setup

Yes, you would have to create a login for it. See your other post for info about the error you're getting.

I am currently running MS SQL 2008 R2 on a Windows Server 2008 R2 box. The SQL services are currently running under the NetworkService account and I want to change this to a domain account but I am having some trouble. I have created the domain account and have tried to go into SSCM and change the account there but I get various errors depending on the service I try to change. When changing the account on the SQL Server Service I get an error "Access is Denied"
I am assuming I need to assign some rights to this new account BUT I thought changing the account in SSCM would do that automatically but it looks like that assumption is wrong.
What is the best procedure for changing the SQL Server Service account to a domain account on SQL Server 2008?
This topic first appeared in the Spiceworks Community

Query to Find what SQL Server services running, what status and with what service account

I need to check what SQL Server services are running(engine,agent,IS,AS,RS,browser and Full text) and what is the present status and what service accounts are been used by them on several servers in a single shot.
Could any one help me in finding a good script for the same.

I have been looking for the same thing, the issue I am running into is finding the Actual Service Name. I know this question is old, and I personally do not understand the reply.
so Far I have the following:
DECLARE @ServiceAcount NVARCHAR(128);
SET @Service = 'No Return Value'
--MsDtsServer100 (SSIS)
EXEC master.dbo.xp_regread
'HKEY_LOCAL_MACHINE',
'SYSTEM\CurrentControlSet\services\MsDtsServer100',
'ObjectName',
@ServiceAccount OUTPUT;
SELECT @ServiceAccount;
I am still looking for the correct service naming for Analysis Services, Distributed Replaay Client, Distributed Replay Controller

Managed Service Accounts to run SQL Server Service

Has anyone played around with using managed service accounts for running the SQL Server Service? I am on a forest functional level of 2008R2 and was thinking about how cool it would be to use those for SQL Server. Unfortunately, I hear that it's not supported
by Microsoft and yet I've read about people doing that but would like to know if anyone has first hand experience. Otherwise, if not recommended, I'll stick to the old fashioned way of creating typical user accounts. Thanks in advance!

Hi Scott hi Sean
I see that my first answer was badly phrased.
Let me try to make it more clear:
Managed Service Accounts(MSA):
Works with Kerberos including Delegation, but:
NOT working with cluster nodes
NOT working for load balancing using Kerberos
More information:
http://blogs.technet.com/b/askds/archive/2009/09/10/managed-service-accounts-understanding-implementing-best-practices-and-troubleshooting.aspx
Group Managed Service Accounts (GMSA):
Works with Kerberos including Delegation, but:
NOT supported with Failover Clustered Instances
Here is the connect item:
http://connect.microsoft.com/SQLServer/feedback/details/767211/gmsa-for-sql-server-failover-clusters
@all Please feel free to vote(!). I am waiting for this as well.
This is the state of my information today. Feel free to correct me if you know of any changes.
Andreas Wolter (Blog |
Twitter)
MCM - Microsoft Certified Master SQL Server 2008
MCSM - Microsoft Certified Solutions Master Data Platform, SQL Server 2012
www.andreas-wolter.com |
www.SarpedonQualityLab.com

SQL Server 2012 SP2 NTService Accounts Access Denied starting services

We have an SQL Server 2012 SP1 which was running perfectly until we applied the SQL Server 2012 SP2.
After SP2 was installed and the server rebooted all the associated SQL services that uses NTService\xxxxxxx accounts failed to start with Error 5: Access Denied.
We were able to change the services to Local System account but I just want to understand why this occurred and is this ok?
Has anyone had a similar issue or can anyone assist with an explanation?

Hi Giulio,
Based on your description, I tested the scenario as yours. After applying SQL Server 2012 SP2, I reboot the server , then restart all the associated SQL Server services that use NT SERVICE\<SERVICENAME> accounts successfully.
According to the error message, it might be caused by that NT SERVICE\<SERVICENAME> accounts don’t have sufficient permissions to access the SQL Server services installation folders. You can post detailed information in the SQL Server Errorlog file
for analysis.
In addition, Local System is a very high-privileged built-in account. It has extensive privileges on the local system and acts as the computer on the network. And it is not recommend to use local system account for running SQL Server services. For more details
about configuring SQL Server Service accounts, you can review the following links.
Configure Windows Service Accounts and Permissions:
http://msdn.microsoft.com/EN-US/library/ms143504.aspx#Windows
Best Practices For Using SQL Server Service Accounts:
http://blogs.technet.com/b/canitpro/archive/2012/02/08/the-sql-guy-post-15-best-practices-for-using-sql-server-service-accounts.aspx
Thanks,
Lydia Zhang

The specified credentials that were provided for the SQL Server service are not valid

after i enter account name and password for server configuration...the error appear...is it problem with acc name or password?help!!

Hi help933,
According to your description, when you use the Server Configuration page of the SQL Server Installation Wizard to assign login accounts to SQL Server services, you can
assign the same login account to all SQL Server services, or you can configure each service account individually. You can also specify whether services start automatically, are started manually, or are disabled.
For example, on Windows Vista and Windows Server 2008 ,most accounts are set to the default NETWORK SERVICE account.
For more information, see:
http://msdn.microsoft.com/en-us/library/cc281953.aspx
Also there is a similar issue about seivice account, you can review the following post.
http://social.msdn.microsoft.com/Forums/sqlserver/en-US/c7139740-ab93-48c2-b357-31bb7935b83d/rc0-rs-installation-problem-the-credentials-you-provided-for-reporting-services-service-are?forum=sqlsetupandupgrade
Thanks,
Sofiya Li
Sofiya Li
TechNet Community Support

Difference between- LOGGINGin to SQL SERVER AGENT as LOCAL-ACCOUNT and NETWORK-SERIVICE

By defauld SQL-SERVER-AGENT is set to log in as local account... What is the difference between logging in to sql server agent as local account or as network service...??

By defauld SQL-SERVER-AGENT is set to log in as local account... What is the difference between logging in to sql server agent as local account or as network service...??
Hello ,
Read and make out the difference
http://stackoverflow.com/questions/510170/the-difference-between-the-local-system-account-and-the-networ
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684272(v=vs.85).aspxk-service-acco
http://msdn.microsoft.com/en-us/library/windows/desktop/ms684190(v=vs.85).aspx
As a best practice use Account with minimum privileges to run SQL Server agent
Please mark this reply as the answer or vote as helpful, as appropriate, to make it useful for other readers

SQL Server Service can't start.

I was try start SQL Server Service in SQL Server Configuration Manager and it prompt out error 'The request failed or the service did not respond in a timely fashion.Consult the event log or other applicable error logs for details.'
I was try set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control ServicePipeTimeout
value to decimal 180000.
I try also change the service account to local system but it prompt WMI error.
But still failed to start the service.
Could anyone help me? Thanks in advance.

I check from event viewer it showing 30++ error
I post some error here:
Windows cannot copy file \\?\C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary
Internet Files\Sqm\iesqmdata0.sqm to location \\?\C:\Users\MSSQL$SQLEXPRESS.NT Service\AppData\Local\Microsoft\Windows\Temporary Internet Files\Sqm\iesqmdata0.sqm. This error may be caused by network problems or insufficient security rights.
Windows cannot find the local profile and is logging
you on with a temporary profile. Changes you make to this profile will be lost when you log off.
Windows cannot copy file \\?\C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary
Internet Files\Sqm\iesqmdata0.sqm to location \\?\C:\Users\TEMP.NT Service.001\AppData\Local\Microsoft\Windows\Temporary Internet Files\Sqm\iesqmdata0.sqm. This error may be caused by network problems or insufficient security rights.
DETAIL - Access is denied.
Windows cannot log you on because your profile cannot
be loaded. Check that you are connected to the network, and that your network is functioning correctly.
DETAIL - Only part of a ReadProcessMemory or WriteProcessMemory
request was completed.
**I
was using administrator account.

SQL Server Service Account - Domain Account - WMI Provider Error - 0x80092004

Similar Messages

Maybe you are looking for