Error 18456: Login failed for user 'DOMAIN\user'

Hi,
I've just installed SQL Server 2005 Beta 2 and added Active Directory
account to our SQL Server (under Database/Security/Logins). However, when I
try to login using the Windows Authentication, I get this error message:
Login failed for user 'DOMAIN\user'. (Microsoft SQL Server, Error: 18456)
where DOMAIN\user is really my domain-account, which I rather not publish.
When I try to login using 'sa' and SQL Server Authentication there is no
problem.
I've tried to find out what error 18456 is but no luck. Could anyone help me
please?
Cheers,
ChrisI take it that either no one has ever heard of this error or that is so
common that its in every FAQ. In the latter case, could someone please point
me to a FAQ with a solution...
Cheers,
Chris
"Christoffer" <christoffer@.nospam.com> wrote in message
news:%23alyI3zjEHA.536@.TK2MSFTNGP11.phx.gbl...
> Hi,
> I've just installed SQL Server 2005 Beta 2 and added Active Directory
> account to our SQL Server (under Database/Security/Logins). However, when
> I try to login using the Windows Authentication, I get this error message:
> Login failed for user 'DOMAIN\user'. (Microsoft SQL Server, Error: 18456)
> where DOMAIN\user is really my domain-account, which I rather not publish.
> When I try to login using 'sa' and SQL Server Authentication there is no
> problem.
> I've tried to find out what error 18456 is but no luck. Could anyone help
> me please?
> Cheers,
> Chris
>|||Error 18456 is "login failed for user xxx"...the error you
are getting. You have something incorrect with adding the
windows account to the logins or the permissions you have
set for the login. Try deleting the login and then try
adding it again. Make sure the login has access to whatever
database you have set up as the default database.
-Sue
On Tue, 31 Aug 2004 11:34:56 +0200, "Christoffer"
<christoffer@.nospam.com> wrote:

>Hi,
>I've just installed SQL Server 2005 Beta 2 and added Active Directory
>account to our SQL Server (under Database/Security/Logins). However, when I
>try to login using the Windows Authentication, I get this error message:
>Login failed for user 'DOMAIN\user'. (Microsoft SQL Server, Error: 18456)
>where DOMAIN\user is really my domain-account, which I rather not publish.
>When I try to login using 'sa' and SQL Server Authentication there is no
>problem.
>I've tried to find out what error 18456 is but no luck. Could anyone help m
e
>please?
>Cheers,
>Chris
>|||Hello
I deleted and re-added the account and I also gave it access to every
database with db_owner on every database. I also made the account a member
of the sysadmin role. Still no luck
The account is in a Active Directory, could this be the problem?
Cheers,
Chris
"Sue Hoegemeier" <Sue_H@.nomail.please> wrote in message
news:9rlpj0982j03evgpta2vla52c2jrtlg9md@.
4ax.com...
> Error 18456 is "login failed for user xxx"...the error you
> are getting. You have something incorrect with adding the
> windows account to the logins or the permissions you have
> set for the login. Try deleting the login and then try
> adding it again. Make sure the login has access to whatever
> database you have set up as the default database.
> -Sue
> On Tue, 31 Aug 2004 11:34:56 +0200, "Christoffer"
> <christoffer@.nospam.com> wrote:
>
>|||Are you a member of a group that has been denied access to
the server? Did you try another Windows account and test
with that?
-Sue
On Tue, 7 Sep 2004 14:53:32 +0200, "Christoffer"
<christoffer@.nospam.com> wrote:

>Hello
>I deleted and re-added the account and I also gave it access to every
>database with db_owner on every database. I also made the account a member
>of the sysadmin role. Still no luck
>The account is in a Active Directory, could this be the problem?
>Cheers,
>Chris
>"Sue Hoegemeier" <Sue_H@.nomail.please> wrote in message
> news:9rlpj0982j03evgpta2vla52c2jrtlg9md@.
4ax.com...
>|||Hello,
I think I have found the problem. When I add my login (DOMAIN\USER) using
the Microsoft SQL Server Management Studio (2005 Beta 2), the property
"Server Access" is set to "Via Group Membership". If I change this to
"Permit" I can login!
My question is: What is "Via Group Membership" and is this the best practice
when adding Windows logins?
Thanks,
Chris
"Sue Hoegemeier" <Sue_H@.nomail.please> wrote in message
news:90psj0p1dethn063mh6sd61u9fi93c1ec9@.
4ax.com...
> Are you a member of a group that has been denied access to
> the server? Did you try another Windows account and test
> with that?
> -Sue
> On Tue, 7 Sep 2004 14:53:32 +0200, "Christoffer"
> <christoffer@.nospam.com> wrote:
>
>|||Via group membership means the login was has access to SQL
Server through their membership in a windows group.
Managing logins through windows group can definitely make
the management of logins much easier.
-Sue
On Wed, 8 Sep 2004 10:31:06 +0200, "Christoffer"
<christoffer@.nospam.com> wrote:

>Hello,
>I think I have found the problem. When I add my login (DOMAIN\USER) using
>the Microsoft SQL Server Management Studio (2005 Beta 2), the property
>"Server Access" is set to "Via Group Membership". If I change this to
>"Permit" I can login!
>My question is: What is "Via Group Membership" and is this the best practic
e
>when adding Windows logins?
>Thanks,
>Chris
>
>"Sue Hoegemeier" <Sue_H@.nomail.please> wrote in message
> news:90psj0p1dethn063mh6sd61u9fi93c1ec9@.
4ax.com...
>|||I see, the thing is, there is no added Windows groups login in the SQL
Server. I tried adding DOMAIN\Administrators but I got the errore message:
"The login 'DOMAIN\Administrators' does not exist. (Microsoft SQL Server,
Error: 15007)"
But I'm sure it exists since I browsed to it using the Active Directory. Is
there some limitation to adding the DOMAIN\Administrators group? Should I
try to set up yet another group for database access?
Thanks for your help!
/Chris
"Sue Hoegemeier" <Sue_H@.nomail.please> wrote in message
news:8pttj05a5jihmdoqe1ekg4iufo7er08j5f@.
4ax.com...
> Via group membership means the login was has access to SQL
> Server through their membership in a windows group.
> Managing logins through windows group can definitely make
> the management of logins much easier.
> -Sue
> On Wed, 8 Sep 2004 10:31:06 +0200, "Christoffer"
> <christoffer@.nospam.com> wrote:
>
>|||Chris,
I'm not real clear on when you are receiving this error. It doesn't
look like something you would get when you actually try to add the
login. Try add the account using Query Analyzer instead and executing
sp_grantlogin. The help file has more information on sp_grantlogin.
Whether you set up another group or not depends upon how you are going
to design your security model. Using Windows groups certainly can be
easier but whether that works for you or not depends on how your
windows groups are set up, how well they reflect the access, security
needs of the applications that will use the databases on the server,
etc.
-Sue
On Wed, 8 Sep 2004 14:21:49 +0200, "Christoffer"
<christoffer@.nospam.com> wrote:

>I see, the thing is, there is no added Windows groups login in the SQL
>Server. I tried adding DOMAIN\Administrators but I got the errore message:
>"The login 'DOMAIN\Administrators' does not exist. (Microsoft SQL Server,
>Error: 15007)"
>But I'm sure it exists since I browsed to it using the Active Directory. Is
>there some limitation to adding the DOMAIN\Administrators group? Should I
>try to set up yet another group for database access?
>Thanks for your help!
>/Chris
>
>"Sue Hoegemeier" <Sue_H@.nomail.please> wrote in message
> news:8pttj05a5jihmdoqe1ekg4iufo7er08j5f@.
4ax.com...
>|||Hi,
When I use the Microsoft SQL Server Management Studio, which is in SQL
Server 2005 and is equivalent to Enterprise Manager for SQL Server 2000, to
add a Windows login, the login's Server access property is set to "Via group
membership".
If I use the stored procedures sp_grantlogin on SQL Server 2005, the login's
Server access property is set to "Permit".
If I use the old Enterprise Manager for SQL Server 2000, the login's Server
access property is set to "Permit".
Why does the SQL Server Management Studio (2005) set the Server access
property to "Via group membership" instead of "Permit". I know this is a
beta and an answer might not be possible to give...
Thanks for helping me out, I no longer experience the 18456 error, this is
just out of curiousity
/Chris
"Sue Hoegemeier" <Sue_H@.nomail.please> wrote in message
news:iq7uj0tv8g78vlco9b6dr4m36uq1b3n1tc@.
4ax.com...
> Chris,
> I'm not real clear on when you are receiving this error. It doesn't
> look like something you would get when you actually try to add the
> login. Try add the account using Query Analyzer instead and executing
> sp_grantlogin. The help file has more information on sp_grantlogin.
> Whether you set up another group or not depends upon how you are going
> to design your security model. Using Windows groups certainly can be
> easier but whether that works for you or not depends on how your
> windows groups are set up, how well they reflect the access, security
> needs of the applications that will use the databases on the server,
> etc.
> -Sue
> On Wed, 8 Sep 2004 14:21:49 +0200, "Christoffer"
> <christoffer@.nospam.com> wrote:
>
>

Error 15401

Hi folks,
When using the "Enterprise Manager" to add logins to a SQL Server
instance, I'm running into an error 15401. Before I get too far, let me
describe the environment I'm doing this in:
We have two domains:
Domain A is an old NT 4 style domain.
Domain B is a new Active Directory domain powered by Windows Server 2003
running in the "Windows Server 2003" domain functional level.
We're in the process of transitioning from Domain A (with the hopes of
retiring the domain soon), to Domain B. As such, currently, there is a
two trusts between Domain A and Domain B (going in each direction).
On Windows Server 2003 machine on Domain B, I've installed SQL Server
2000, and have it patched to SP4. I've set up a new database on this
SQL server (running as a standard domain B user), and was in the process
of adding logins for it when I encountered the error 15401. Precisely
what I was doing was using the Enterprise Manager on the server directly
to add logins, specifically I was trying to add a few groups from Domain
A to the databse. This is where the error crops up.
(I should note, adding users of Domain B is not a problem, that
functions correctly.)
So, I started troubleshooting, and in doing so, looked over this document:
http://support.microsoft.com/default...b;en-us;324321
None of the situations described in that document apply. There is no
possability of duplicate logins, as this is a new install of SQL Server,
and a freshly created database (just to be sure tho, I manually examined
the syslogin tables in the master db).
There is no problem with the Domain Trust, as the Enterprise Manager on
the same machine as SQL Server is on, can display a list of groups and
accounts from both Domain A and Domain B, not to mention people can from
Domain A can connect to shares offered on the Window Server without trouble.
I've also read that its possible that SQL Server internally caches SIDs,
so I rebooted both the server, and the PDC for Domain A, as well as the
domain controllers for Domain B, with no success.
One additional symptom (not knowing how else to describe it). When an
ASP page, running as a user from Domain A, attempts to connect to the
database in Domain B, it gets a "Login failed for user 'derek'.", even
though the page is running as "A\scott". So where it gets "derek" from,
I haven't even a slightest clue.
If anyone has any ideas or help, it would be greatly appreciated.
Thanks
Scott
It looks to me like you have covered all of the likely problems... Perhaps
a call to PSS is your next step.
Wayne Snyder, MCDBA, SQL Server MVP
Mariner, Charlotte, NC
www.mariner-usa.com
(Please respond only to the newsgroups.)
I support the Professional Association of SQL Server (PASS) and it's
community of SQL Server professionals.
www.sqlpass.org
"Scott Peron" <scott@.infolytica.com> wrote in message
news:%23VTQ%23HuYFHA.3488@.tk2msftngp13.phx.gbl...
> Hi folks,
> When using the "Enterprise Manager" to add logins to a SQL Server
> instance, I'm running into an error 15401. Before I get too far, let me
> describe the environment I'm doing this in:
> We have two domains:
> Domain A is an old NT 4 style domain.
> Domain B is a new Active Directory domain powered by Windows Server 2003
> running in the "Windows Server 2003" domain functional level.
> We're in the process of transitioning from Domain A (with the hopes of
> retiring the domain soon), to Domain B. As such, currently, there is a
> two trusts between Domain A and Domain B (going in each direction).
> On Windows Server 2003 machine on Domain B, I've installed SQL Server
> 2000, and have it patched to SP4. I've set up a new database on this SQL
> server (running as a standard domain B user), and was in the process of
> adding logins for it when I encountered the error 15401. Precisely what I
> was doing was using the Enterprise Manager on the server directly to add
> logins, specifically I was trying to add a few groups from Domain A to the
> databse. This is where the error crops up.
> (I should note, adding users of Domain B is not a problem, that functions
> correctly.)
> So, I started troubleshooting, and in doing so, looked over this document:
> http://support.microsoft.com/default...b;en-us;324321
> None of the situations described in that document apply. There is no
> possability of duplicate logins, as this is a new install of SQL Server,
> and a freshly created database (just to be sure tho, I manually examined
> the syslogin tables in the master db).
> There is no problem with the Domain Trust, as the Enterprise Manager on
> the same machine as SQL Server is on, can display a list of groups and
> accounts from both Domain A and Domain B, not to mention people can from
> Domain A can connect to shares offered on the Window Server without
> trouble.
> I've also read that its possible that SQL Server internally caches SIDs,
> so I rebooted both the server, and the PDC for Domain A, as well as the
> domain controllers for Domain B, with no success.
> One additional symptom (not knowing how else to describe it). When an ASP
> page, running as a user from Domain A, attempts to connect to the database
> in Domain B, it gets a "Login failed for user 'derek'.", even though the
> page is running as "A\scott". So where it gets "derek" from, I haven't
> even a slightest clue.
> If anyone has any ideas or help, it would be greatly appreciated.
> Thanks
> Scott

Error 15401

Hi folks,
When using the "Enterprise Manager" to add logins to a SQL Server
instance, I'm running into an error 15401. Before I get too far, let me
describe the environment I'm doing this in:
We have two domains:
Domain A is an old NT 4 style domain.
Domain B is a new Active Directory domain powered by Windows Server 2003
running in the "Windows Server 2003" domain functional level.
We're in the process of transitioning from Domain A (with the hopes of
retiring the domain soon), to Domain B. As such, currently, there is a
two trusts between Domain A and Domain B (going in each direction).
On Windows Server 2003 machine on Domain B, I've installed SQL Server
2000, and have it patched to SP4. I've set up a new database on this
SQL server (running as a standard domain B user), and was in the process
of adding logins for it when I encountered the error 15401. Precisely
what I was doing was using the Enterprise Manager on the server directly
to add logins, specifically I was trying to add a few groups from Domain
A to the databse. This is where the error crops up.
(I should note, adding users of Domain B is not a problem, that
functions correctly.)
So, I started troubleshooting, and in doing so, looked over this document:
http://support.microsoft.com/default.aspx?scid=kb;en-us;324321
None of the situations described in that document apply. There is no
possability of duplicate logins, as this is a new install of SQL Server,
and a freshly created database (just to be sure tho, I manually examined
the syslogin tables in the master db).
There is no problem with the Domain Trust, as the Enterprise Manager on
the same machine as SQL Server is on, can display a list of groups and
accounts from both Domain A and Domain B, not to mention people can from
Domain A can connect to shares offered on the Window Server without trouble.
I've also read that its possible that SQL Server internally caches SIDs,
so I rebooted both the server, and the PDC for Domain A, as well as the
domain controllers for Domain B, with no success.
One additional symptom (not knowing how else to describe it). When an
ASP page, running as a user from Domain A, attempts to connect to the
database in Domain B, it gets a "Login failed for user 'derek'.", even
though the page is running as "A\scott". So where it gets "derek" from,
I haven't even a slightest clue.
If anyone has any ideas or help, it would be greatly appreciated.
Thanks
ScottIt looks to me like you have covered all of the likely problems... Perhaps
a call to PSS is your next step.
--
Wayne Snyder, MCDBA, SQL Server MVP
Mariner, Charlotte, NC
www.mariner-usa.com
(Please respond only to the newsgroups.)
I support the Professional Association of SQL Server (PASS) and it's
community of SQL Server professionals.
www.sqlpass.org
"Scott Peron" <scott@.infolytica.com> wrote in message
news:%23VTQ%23HuYFHA.3488@.tk2msftngp13.phx.gbl...
> Hi folks,
> When using the "Enterprise Manager" to add logins to a SQL Server
> instance, I'm running into an error 15401. Before I get too far, let me
> describe the environment I'm doing this in:
> We have two domains:
> Domain A is an old NT 4 style domain.
> Domain B is a new Active Directory domain powered by Windows Server 2003
> running in the "Windows Server 2003" domain functional level.
> We're in the process of transitioning from Domain A (with the hopes of
> retiring the domain soon), to Domain B. As such, currently, there is a
> two trusts between Domain A and Domain B (going in each direction).
> On Windows Server 2003 machine on Domain B, I've installed SQL Server
> 2000, and have it patched to SP4. I've set up a new database on this SQL
> server (running as a standard domain B user), and was in the process of
> adding logins for it when I encountered the error 15401. Precisely what I
> was doing was using the Enterprise Manager on the server directly to add
> logins, specifically I was trying to add a few groups from Domain A to the
> databse. This is where the error crops up.
> (I should note, adding users of Domain B is not a problem, that functions
> correctly.)
> So, I started troubleshooting, and in doing so, looked over this document:
> http://support.microsoft.com/default.aspx?scid=kb;en-us;324321
> None of the situations described in that document apply. There is no
> possability of duplicate logins, as this is a new install of SQL Server,
> and a freshly created database (just to be sure tho, I manually examined
> the syslogin tables in the master db).
> There is no problem with the Domain Trust, as the Enterprise Manager on
> the same machine as SQL Server is on, can display a list of groups and
> accounts from both Domain A and Domain B, not to mention people can from
> Domain A can connect to shares offered on the Window Server without
> trouble.
> I've also read that its possible that SQL Server internally caches SIDs,
> so I rebooted both the server, and the PDC for Domain A, as well as the
> domain controllers for Domain B, with no success.
> One additional symptom (not knowing how else to describe it). When an ASP
> page, running as a user from Domain A, attempts to connect to the database
> in Domain B, it gets a "Login failed for user 'derek'.", even though the
> page is running as "A\scott". So where it gets "derek" from, I haven't
> even a slightest clue.
> If anyone has any ideas or help, it would be greatly appreciated.
> Thanks
> Scott

Error 15401

Hi folks,
When using the "Enterprise Manager" to add logins to a SQL Server
instance, I'm running into an error 15401. Before I get too far, let me
describe the environment I'm doing this in:
We have two domains:
Domain A is an old NT 4 style domain.
Domain B is a new Active Directory domain powered by Windows Server 2003
running in the "Windows Server 2003" domain functional level.
We're in the process of transitioning from Domain A (with the hopes of
retiring the domain soon), to Domain B. As such, currently, there is a
two trusts between Domain A and Domain B (going in each direction).
On Windows Server 2003 machine on Domain B, I've installed SQL Server
2000, and have it patched to SP4. I've set up a new database on this
SQL server (running as a standard domain B user), and was in the process
of adding logins for it when I encountered the error 15401. Precisely
what I was doing was using the Enterprise Manager on the server directly
to add logins, specifically I was trying to add a few groups from Domain
A to the databse. This is where the error crops up.
(I should note, adding users of Domain B is not a problem, that
functions correctly.)
So, I started troubleshooting, and in doing so, looked over this document:
http://support.microsoft.com/defaul...kb;en-us;324321
None of the situations described in that document apply. There is no
possability of duplicate logins, as this is a new install of SQL Server,
and a freshly created database (just to be sure tho, I manually examined
the syslogin tables in the master db).
There is no problem with the Domain Trust, as the Enterprise Manager on
the same machine as SQL Server is on, can display a list of groups and
accounts from both Domain A and Domain B, not to mention people can from
Domain A can connect to shares offered on the Window Server without trouble.
I've also read that its possible that SQL Server internally caches SIDs,
so I rebooted both the server, and the PDC for Domain A, as well as the
domain controllers for Domain B, with no success.
One additional symptom (not knowing how else to describe it). When an
ASP page, running as a user from Domain A, attempts to connect to the
database in Domain B, it gets a "Login failed for user 'derek'.", even
though the page is running as "A\scott". So where it gets "derek" from,
I haven't even a slightest clue.
If anyone has any ideas or help, it would be greatly appreciated.
Thanks
ScottIt looks to me like you have covered all of the likely problems... Perhaps
a call to PSS is your next step.
Wayne Snyder, MCDBA, SQL Server MVP
Mariner, Charlotte, NC
www.mariner-usa.com
(Please respond only to the newsgroups.)
I support the Professional Association of SQL Server (PASS) and it's
community of SQL Server professionals.
www.sqlpass.org
"Scott Peron" <scott@.infolytica.com> wrote in message
news:%23VTQ%23HuYFHA.3488@.tk2msftngp13.phx.gbl...
> Hi folks,
> When using the "Enterprise Manager" to add logins to a SQL Server
> instance, I'm running into an error 15401. Before I get too far, let me
> describe the environment I'm doing this in:
> We have two domains:
> Domain A is an old NT 4 style domain.
> Domain B is a new Active Directory domain powered by Windows Server 2003
> running in the "Windows Server 2003" domain functional level.
> We're in the process of transitioning from Domain A (with the hopes of
> retiring the domain soon), to Domain B. As such, currently, there is a
> two trusts between Domain A and Domain B (going in each direction).
> On Windows Server 2003 machine on Domain B, I've installed SQL Server
> 2000, and have it patched to SP4. I've set up a new database on this SQL
> server (running as a standard domain B user), and was in the process of
> adding logins for it when I encountered the error 15401. Precisely what I
> was doing was using the Enterprise Manager on the server directly to add
> logins, specifically I was trying to add a few groups from Domain A to the
> databse. This is where the error crops up.
> (I should note, adding users of Domain B is not a problem, that functions
> correctly.)
> So, I started troubleshooting, and in doing so, looked over this document:
> http://support.microsoft.com/defaul...kb;en-us;324321
> None of the situations described in that document apply. There is no
> possability of duplicate logins, as this is a new install of SQL Server,
> and a freshly created database (just to be sure tho, I manually examined
> the syslogin tables in the master db).
> There is no problem with the Domain Trust, as the Enterprise Manager on
> the same machine as SQL Server is on, can display a list of groups and
> accounts from both Domain A and Domain B, not to mention people can from
> Domain A can connect to shares offered on the Window Server without
> trouble.
> I've also read that its possible that SQL Server internally caches SIDs,
> so I rebooted both the server, and the PDC for Domain A, as well as the
> domain controllers for Domain B, with no success.
> One additional symptom (not knowing how else to describe it). When an ASP
> page, running as a user from Domain A, attempts to connect to the database
> in Domain B, it gets a "Login failed for user 'derek'.", even though the
> page is running as "A\scott". So where it gets "derek" from, I haven't
> even a slightest clue.
> If anyone has any ideas or help, it would be greatly appreciated.
> Thanks
> Scott