We have the following setup:

  • One Domain Controller (DC, Server 2003 R2 Standard x64)
  • One SQL Server (SQL, Server 2008 R2 Standard x64)
  • some clients.

All machines are in the same domain. All user accounts in use are domain accounts. SQL runs one instance of each SQL Server 2005, 2008, 2008R2, 2012 and 2014.

Since tonight (DC rebooted to install automatic Windows security updates), accessing the SQL 2005, 2008 and 2008R2 instances through Windows authentication does not work properly anymore:

When accessing one of these instances

  • from one of the clients
  • using Windows authentication

the following error occurs (it's the 2008R2 message, the 2005/2008 messages are similar):

Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. (Microsoft SQL Server, Error: 18452)

Obviously, the message text does not apply, since there is only one domain.

Now the surprising thing is: As soon as user is logged in on SQL (starting an RDP sesson or even simply running runas /user:MYDOMAIN\someuser cmd and keeping the window open), this user can access all SQL Server instances from all clients without any problems until the process running with that user's credentials is closed.

This means that I can just workaround this problem by executing the above runas command for all users on SQL once (and keeping the windows open), but, obviously, something is severely broken. I suspect tonight's security updates on DC have something to do with it (since that's the only thing that changed), but I'd rather avoid uninstalling and rebooting each one of them (12 updates were installed and DC is really old and slow).

Has anyone encountered this issue before and knows how to fix it permanently? Any other ideas (other than spending the next few days becoming a Kerberos expert)?

  • Have you checked your DC's clock? While I can't explain the instance discrepancy, a DC's clock being wrong does cause the behavior your explaining when limiting yourself to looking at one instance. Also you might want to look at upgrading your DC OS as end of life is nearing. – Reaces Mar 12 '15 at 12:01
  • @Reaces: Thanks for the hint, but the clocks are perfectly synchronous. Yes, the DC is the next machine scheduled for replacement. – Heinzi Mar 12 '15 at 12:56
up vote 6 down vote accepted

check if your DC installed the update KB3002657 tonight. see http://support2.microsoft.com/?kbid=3002657 I had the same issue. Deinstalling this update solved the problem for me.

  • Well spotted, I just discovered that myself and wanted to write exactly the same thing. :-) Apparently KB3002657 causes a lot of trouble today. – Heinzi Mar 12 '15 at 13:40
  • Some Clients will show the Error Message "The login is from an untrusted domain". e.g. if you connect via RDP or at an MSSQL-Server. Just remove the Host you want connect to from your domain an add it again. – simson Mar 13 '15 at 13:44

The following fix via Group Policy worked for me:

  1. Open Group Policy Administrator
  2. Navigate to Computer Configuration >> Windows Settings >> Local Polices >> Security Options
  3. Double Click "Network Security: LAN Manager authentication level"
  4. Change option from "Send NTLM Responses" to "Send LM & NTLM responses"
  5. Run gpupdate /force on affected computers and servers.

I don't have the exact details, but we were having the same symptoms and workaround with the RDP session. I alerted the IT group to this solution from simson, and they said they would uninstall the security update, which had been applied over the weekend. This seems to have fixed the problem.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.