SQL Windows Authentication with Login of AD Group 'Domain Admins'

Having a bit of a difficulty with Microsoft SQL Server 2012 windows authentication integration...
The server is setup to have Windows authentication used as its means of login authentication. No issues with this other than a strange error that occurs on multiple SQL servers in our domain:
When a login is created for domain group "[domain]\Domain Admins", users within this AD group cannot connect to the SQL server through the Management Studio. The error that SQL server gives is Error 18456, Sate 11, i.e. "Valid login but server
access failure"
However when a different AD group is added as a login (like [domain]\[group]), users from this group can successfully log into SQL server. It seems that adding any other group, even groups from a different domain, grants successful authentication as I would
expect EXCEPT the AD group 'Domain Admins".
Is there some restriction/security feature at play here on this AD group that makes using the 'Domain Admins' group as a login not possible?
Andrew

Yes, this group was removed and readded just yesterday to try to fix the issue.
Here is the output of the command:
class
class_desc
major_id
minor_id
grantee_principal_id
grantor_principal_id
type
permission_name
state
state_desc
105
ENDPOINT
2
0
2
1
CO
CONNECT
G
GRANT
105
ENDPOINT
3
0
2
1
CO
CONNECT
G
GRANT
105
ENDPOINT
4
0
2
1
CO
CONNECT
G
GRANT
105
ENDPOINT
5
0
2
1
CO
CONNECT
G
GRANT

Similar Messages

Windows authentication with oracle9i

Hi,i am working on windows authentication with oracle9i.my client server is connecting and client can access the database.now can you please guide me the steps for windows authentication in brief.i will appreciate that.

can u plz help me how to ser OS_roles value to true.

Permission issues in sql window authentication

Is it possible to grant a Windows group access to SQL Server rather than individual Windows logins which has only read/write permission on table data in sqlserver.I am getting error while logged in by using window authentication.

But am getting some schema level issues.
See CREATE USER (Transact-SQL) => Remarks, regarding "Windows Group" in third paragraph.
Olaf Helper
[ Blog] [ Xing] [ MVP]

Can I use Windows authentication with Firefox?

My company has a website that I need to login to on a daily basis. With IE I can set up Windows Authentication to have a "single sign-on" for this website and it automatically logs me in when I open the site. I do not see any options for authentication under the Tools menu. Using Firefox's password memory does not give the same functionality.

You can do it by adding the server host name to a list of trusted host names. Obviously you need to be very careful about not adding untrustworthy servers to the list. See this article for how: [http://support.mozilla.com/en-US/kb/Firefox%20asks%20for%20user%20name%20and%20password%20on%20internal%20sites Firefox asks for user name and password on internal sites | Troubleshooting | Firefox Help].

Windows authentication with WCF-NetTcp adapter

I have a WCF-NetTcp receive location and I like to set it up with Windows Authentication. (transport security)
IIS or WAS is not used so the receive port is self-hosted.
I would like to configure a certain user or group that has permission to send messages to this receive location. All other users/groups must be denied acces. How do I achieve this? I know how to configure windows authentication in the binding but I cannot
find a way to configure a specific user or group.
I am using BizTalk Server 2010.

Hi,
You should implement a custom behavior extension to achieve this.
See
here for an example.
Regards,
René
Thanks, I was already looking in this direction but was hoping this could have been done easier.

Integrated Windows Authentication with a WebSphere Cliente

Hi all,
I need to write a web service client that connects to a .NET Web Service that is configured to use Integrated Windows Authentication (NTLM).
I'm using the IBM WebSphere Runtime environment for the client and using the web service client wizard in the RSD 6.0.1.
When I try to call a method in the .NET web service, I get the error shown below. If I configure the .NET web service to permit Anonymous Access, my client works fine.
Does anybody know if the WebSphere web services engine supports Integrated Windows Authentication? If so, how can I configure my cliente to pass my credentials? Do people use this type of authentication if the web service will be called by non Windows clientes or is it better to use Basic Authentication with HTTPS or digital certificates?
I've read that Apache Axis can be configured to use integrated windows authentication (http://people.etango.com/~markm/archives/2005/11/21/using_apache_axis_with_integrated_windows_security.html) by using a different HTTP transport class (CommonsHTTPSender).
Thanks in advance!
Craig
[14/06/06 10:06:56:805 GMT-03:00] 00000031 enterprise I WSWS3243I: Info: Mapping Exception to WebServicesFault.
[14/06/06 10:06:56:821 GMT-03:00] 00000031 enterprise I TRAS0014I: The following exception was logged WebServicesFault
faultCode: {http://schemas.xmlsoap.org/soap/envelope/}Server.generalException
faultString: java.lang.StringIndexOutOfBoundsException
faultActor: null
faultDetail:
java.lang.StringIndexOutOfBoundsException
     at com.ibm.ws.webservices.engine.WebServicesFault.makeFault(WebServicesFault.java:179)
     at com.ibm.ws.webservices.engine.transport.http.HTTPSender.invoke(HTTPSender.java:490)
     at com.ibm.ws.webservices.engine.PivotHandlerWrapper.invoke(PivotHandlerWrapper.java:218)
     at com.ibm.ws.webservices.engine.PivotHandlerWrapper.invoke(PivotHandlerWrapper.java:218)
     at com.ibm.ws.webservices.engine.WebServicesEngine.invoke(WebServicesEngine.java:274)
     at com.ibm.ws.webservices.engine.client.Connection.invokeEngine

Here's a project ( [http://spnego.sourceforge.net/protected_soap_service.html|http://spnego.sourceforge.net/protected_soap_service.html] ) that shows how to write a soap client that can connect to a soap web service with integrated windows authentication turned on.

Windows authentication with Kerberos

Hi All,
We have configured Kerberos for Windows Authentication for EP 7.0.
The authentication works fine when we use the server name alone, but it fails when we use the FQDN.
Any clues would be really helpful.
Regards,
Noufal

Hi Noufal,
When you register the Service Principal Name on the LDAP, Please make sure that you register it with your FQDN.
Please refer the Excellent Blog series by Holger Sir here..
http://www.sdn.sap.com/irj/scn/weblogs?blog=/pub/wlg/8235. [original link is broken]
These blog series cover almost all the errors caused during SPNEGO configuration.
Regards
Hussain.

Windows Authentication with jCIFS

Hello,
I am new to jCIFS and willing to know as to how I can use windows authentication using jCIFS or any other tool/framework.
I ran through the link - [http://jcifs.samba.org/src/docs/ntlmhttpauth.html] and developed a small web application (deployed on tomcat 5.x) which would fetch user details for me from my organization's active directory. It works fine on my machine; however when I try running the application from any other machine, it prompts me for the credentials. I want this application to authenticate the user (without user having to key in the credentials) that is logged on to the machine and fetch his/her user details. Can anyone please advise?
Thanking you in anticipation.
Here's my web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="2.4"
xmlns="http://java.sun.com/xml/ns/j2ee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
<display-name>AD Authentication</display-name>
<filter>
<filter-name>NtlmHttpFilter</filter-name>
<filter-class>jcifs.http.NtlmHttpFilter</filter-class>
<init-param>
   <param-name>jcifs.http.domainController</param-name>
   <param-value>xx.xx.xx.xx</param-value>
   </init-param>
<init-param>
   <param-name>jcifs.smb.client.domain</param-name>
   <param-value>MYDOMAIN</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>NtlmHttpFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<welcome-file-list>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
</web-app>
{code}

Here's a useful link - [http://roneiv.wordpress.com/2007/12/11/hello-world/]. This worked for me.
Can any one let me know as to how can I retrieve user's e-mail (associated with his account) once he's authenticated? For example, if user xyz has logged in to domain mydomain then I need to fetch [[email protected]|mailto:[email protected]]
Thanks!

Windows Authenticated User Login

Hi All,
Does anybody know if there are plans to incorporate Windows Authenticated Login to SAP Business One in the future?
We have many customers who ask this question - why should people have to remember a windows login AND one to B1?
If this is not yet planned for release, could you please consider it?
Many thanks
Mark

Hi Vikas
As Patrick mentioned, there is no native support built into the ABAP AS for LDAP authentication via SAPGUI.
As an option and If you have SAP Identity Management you could look at deploying the password hook, this provides an enterprise password of same password approach. Hence end users can enter their MSAD password to gain access to SAP via SAPGUI - it works well.
SAP Identity Management : Password Hook Configuration Guide
http://scn.sap.com/docs/DOC-17112
The SAP NetWeaver Identity Management Password Hook is a password hook DLL that can be installed on the Microsoft domain controller(s) in the password verification chain. The hook intercepts password changes in the Microsoft domain and distributes it to other applications using the SAP NetWeaver Identity Management Identity Center.
Hope it helps.
Rgrds
Craig

Integrated windows authentication with Oracle access manager 10g

Hi SSo guys,
Our project requirement is as follows:
We have two applications Ebiz 11.5.10.2 and OBIEE10g and we are supposed to integrate IWA for both the applications
so as per the below note OAM integration with IWA only works for the applications using IIS.
So can we protect both the applications in OAM 10g and point those applications to two html pages say http://IIS hostname/ebiz and http://IIS hostname/OBIEE and protect those two resorces in OAM suing IIS webserver?
As per the note :
Doc ID 1072204.1 specify
Excerpt from this doc:
#-begin-
OAM accomplishes IWA by using an OAM Webgate on the IIS Web Server that uses a hidden feature of external authentication to get the REMOTE_USER header variable value and map it to a DN for the ObSSOCookie generation and authorization. Behind the scenes, the IIS WebGate utilizes the UseIISBuiltinAuthentication parameter, by default, this value is false. IWA can only be achieved when this attribute is set to true on an IIS WebGate. This is not a valid parameter for any other OAM WebGate.
#-end-

It should be this way:
Ebiz:
1. Integrate OAM with OASSO
2. Register OASSO and OID with Ebiz11.5.10.2
3. Protect the resource in OAM
4. Verify if authentication is successful for this resource.
Obiee:
1. Integrate OBIEE with OAM
2. Verify if authentication is successful for this resource.
IWA:
1. Install IIS webser and webgate
2. Create authentication scheme which protects / of IIS web server.
Create a Form Authentication Scheme(this scheme should protect OBIEE and EBiz resource) which will have challenge redirect to IIS web server where IWA is configured and / is protected.
Login Flow:
1. User tries to access ebiz or obiee resource.
2. Form Authentication Scheme will challenge redirect to IIS web server where IWA is configured.
3. As IWA is configured. User will be automatically get ObSSOCookie.
4. User gets redirected back to the requested resource.
There is a My oracle support doc which talks in details about this setup.

Integrating windows authentication with Sun ACCESS MANAGER

Hi,
I have implemented sun access manager and successfully protected an application (ABC). At present iam using the SDS as the authentication and authorization directory. I login in to the machine using the network username and password which is on AD.
I want to integrate my authentication/authorization mechanism from SDS to AD. so that when i login into the machine and open application ABC it should not ask me for the credentials; instead allow me to the homepage directly.
How to do this.
Thanks in advance
Maruthi

Hi!
Maybe this helps you, it describes how to setup AM and policy agent to handle basic authentication protected sites. While the article is about sharepoint it should work for any application.
http://developers.sun.com/identity/reference/techart/sharepoint.html
Christoph

Windows 7 with Login Script from 2008 R2 server Duplicates Drives

I have a single user that when they login to the domain and their login script runs, it ends up giving them duplicate drives. I can copy the script to another account and not have the issue. I have not tried logging in as the user on another machine yet,
to see if the error follows the account. Anyone have any thoughts on what might be causing this? I have removed all of the drives from both the command line using
net use /del *
An example of the login script is
net use z: /delete
net use z: \\servername\sharename
Its random which drives it will duplicate to.

Hi Mgibson-TC,
Can we run this script locally to check what’s the result?
You can try Ed (DareDevil57)’s suggest first, if this issue persists, we can do some tests to narrow down this root cause.
Alex Zhao
TechNet Community Support

Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.

Hello,
I have gone through couple of posts regarding this issue but couldn't get the right solution. Could you please help what exactly we are missing here.
Details:
1) we have two SQL instances on one standalone machine (Default Instance (2008 SP3) + Named Instance (SQL 2012 SP1))
2) Both instances are configured to accept SQL+ Windows authentication.
3) when we give access to our users they are getting following exception if they connect with 'windows authentication'. (For both instances)
Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.
Note: (Being a sys + windows admin I'm able to connect both the instances from same client machine without
any issues)
4) Also, we observed following error in windows application event log,
SSPI handshake failed with error code 0x8009030c, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure.
The logon attempt failed [CLIENT: 192.168.xxx.xyx]
5) If we create SQL login it is working fine without any issues.
Could someone guide/help me identifying and fixing this issue.
Thank you

Hello,
Are those Windows Logins associated to domain Windows accounts? Windows Logins work for domain accounts and local Windows account created on the server where the SQL Server instance is installed (and used to login locally to the server).
Could you try to delete one of the Windows logins that fail to login , and try to recreate them?
The following resources may help:
http://blogs.msdn.com/b/dataaccesstechnologies/archive/2012/12/19/error-message-quot-login-failed-the-login-is-from-an-untrusted-domain-and-cannot-be-used-with-windows-authentication-quot.aspx
http://support.microsoft.com/kb/555332
Hope this helps.
Regards,
Alberto Morillo
SQLCoffee.com

Cannot connect to SERVER. Login failed for user 'DOMAIN\user'. (Microsoft SQL Server, Error 18456) - SQL Server 2012 on Windows Server 2008 R2

I've seen multiple blogs and forums with similar problems and SQL 2012 or 2008. But no solutions that work for me.
I have installed SQL Server in mixed mode (SQL and Windows authentication). I can create new Login accounts in either mode. However, I cannot get an AD security group Login account to work. I am trying to add group 'DOMAIN\Domain Admins' or 'SERVER\Administrators'
as a Login so that any of the domain's administrator accounts can open SQL Server Management Studio and act as an 'sa' account on this server.
I have deleted the SQL account 'DOMAIN\Domain Admins'.
I have restarted SQL.
I have restarted the Win2K8r2 server.
I have launched SSMS as Administrator from the desktop of SERVER.
I have launched SSMS as another user (and used 'DOMAIN\user' to lauch it) from the desktop of SERVER.
I can create a login account named 'DOMAIN\user' (who happens to be a member of the 'DOMAIN\Domain Admins' group) and give this account 'sa' security, and when I do that, this account works as expected...
How do I add a security group as a Login account and give all members of that group the ability to be an 'sa' account?

Hi geoperkins,
Are you getting the following error message?
Error: 18456, Severity: 14, State: 11
Login failed for user <Domain\user>. Reason: Token-based server access validation failed with an infrastructure error.
If that is the case, the issue could be due to that the Windows login has no profile or that permissions could not be checked due to UAC. Please disable UAC firstly and check if it is successful to log in SQL Server.
Another reason could be that the domain controller could not be reached. You may need to resort to re-creating the login. Create a new group in AD, add users to the new group, then add the group to the local admin group and create login for the group in SQL
Server.
There is a connect item describing similar issue for your reference.
https://connect.microsoft.com/SQLServer/feedback/details/680705/cant-login-to-sql-using-windows-authentication-when-user-is-in-a-domain-security-group
For more details about above error, please review the following blog.
http://sqlblogcasts.com/blogs/simons/archive/2011/02/01/solution-login-failed-for-user-x-reason-token-based-server-access-validation-failed-and-error-18456.aspx
Thanks,
Lydia Zhang
Lydia Zhang
TechNet Community Support

SQL Server Window Authentication Slow

Hi
We are using SQL Server 2012. When we run our applications with window authentication it runs really slow. But if we use same application with database user authentication then it runs really fast.
Any Suggestion?
thanks
Drew

Hi Drew,
When you use Windows Authentication I assume your are using domain accounts (no local account). Your database server has probably some issue connecting to Active Directory. You might have similar delay logging on to the server using a domain account and
or rebooting the server might also be slow. Most likely your DNS server settings on that server or on your client are incorrect or out of date.
You can check this from the Command Prompt with the IPCONFIG.EXE /ALL command. Make a note of configured DNS servers. The configured DNS servers should ONLY be the DNS servers from the Active Directory domain (typically those are the same servers as the
domain controllers). You should remove any DNS servers from the Internet.
Why does this matter? You may ask. SQL Server needs to connect to the domain controller to verify your credentials. to that it first needs to know the IP address of the domain controller. This information is stored on a DNS server in your Active Directory
domain, not on public DNS servers on the Internet. If your server is configured with public DNS servers from the Internet, requesting this information will fail and cause an delay until either a correct DNS server is contacted or the domain controller is contacted
using legacy (NTLM) methods.
You may have a more complicated situation if more Active Directory domains are involved (e.g. domain trusts, forest trusts, complex nested group memberships.), or if the configured Domain Controller is located at another site and is only connected by a slow
link, or there is actually a performance issue with your domain controllers. In that case your Active Directory Administrator may supply with more information.
In short: check your DNS server settings.
Hope this helps.

SQL Windows Authentication with Login of AD Group 'Domain Admins'

Similar Messages

Maybe you are looking for