Token-based server access validation failed with an infrastructure error

Question

I would appreciate help with the following issue:

I have created a local group in our SQL 2008 server and added two Windows user accounts "DOMAIN\UserName" I then added the local group to the database and granted read only access.

The users are trying to link tables using MS Access using and ODBC connection and getting the following error. Users are not system administrators.

Date                      6/30/2010 1:01:54 PM Log                         SQL Server (Current - 6/30/2010 1:10:00 PM) Source                  Logon Message Login failed for user 'DOMAIN\UserName'. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors. [CLIENT: 999.99.9.99]   Date 6/30/2010 1:01:54 PM Log SQL Server (Current - 7/1/2010 8:12:00 AM)

Source Logon

Message Error: 18456, Severity: 14, State: 11.

Database Server: windows Server 2008 R2 Enterprise System type: 64-bit Operating System SQL Server 2008

Answer 1

Thank you for your response.

I fount the cause of the problem. I just whished the MS error message in the logs could be more clear. The remote user with logging access problems was also part of a group that was denied access to our database. I completely overlooked this configuration. I then created a different group and granted access to the user. I also granted access explicitly and in both instances the users was denied access. Once I remove the group that denied access it all worked fine.

p.reinoso

Answer 2

It's possible there may be an SPN missing for the service account you're using to connect to the SQL server. If for example you're trying to connect to sqlsrv1 from websrv1 using account svcacct1 you could (using a domain admin account) add an SPN to ensure that AD allows authentication from that machine using that account.

setspn -A MSSQLSvc/websrv1.domain.local:1433 svcacct1

Now when you try to connect to sqlsrv1 (to authenticate with MS SQL) using the svcacct1 from websrv1, the credentials should pass through and allow authentication on the server without generating this error.