SQL Server 2008 Windows Auth Login Error: The login is from an untrusted domain

Question

When attempting to connect to a SQL Server 2008 Instance using Management Studio, I get the following error:

Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. (Microsoft SQL Server, Error: 18452)

I can login using SQL Authentication without problem. I've been getting this error all of a sudden. I have Mixed Mode Authentication turned on.

Does anyone have any experience with this?

Additional Info: 64-bit version of SQL Enterprise Edition On Windows 2003 Server

what is the windows login account used for connecting to the sql server? — Gulzar Nazim, Feb 13 '09 at 17:10
any change recently like a password change? sometimes the credentials gets cached.. — Gulzar Nazim, Feb 13 '09 at 17:15
no changes recently.. the only thing happened was just a reboot of our servers.. — jinsungy, Feb 13 '09 at 17:23

score 50 · Answer 1 · answered Sep 12 '09 at 15:34

50

Another reason this might happen (just happened to me) ... is the user's password expires. I didn't realize this until I tried to remote into the actual server and was prompted to change my password.

answered Sep 12 '09 at 15:34

mattruma

16,589
32
107
171

Just had this issue. Surprisingly I was still able to connect to Analysis Server :O – GôTô Jul 21 '15 at 11:20
Can confirm..this was causing the same problem for me as well. Updating the password instantly solved the connection issue! – wjhguitarman Oct 16 '15 at 18:26
1

Just happened for me (Win 10), whilst it wasn't that my password had expired, I had just changed it via 'Ctrl-Alt-Del'. I restarted and it was fine again. Extremely annoying, changing the password also affected Outlook and OneDrive's ability to function. – aSystemOverload Jun 29 '16 at 15:04
Thanks, Saved my life – user3201809 Jul 21 '17 at 07:34
Changed my password with Ctrl-Alt-Del, (Win10) and started getting this error. Restarting didn't solve it. – Ymagine First Jan 18 '18 at 07:14
Crazy!! Thank you! – Houari Jun 30 '19 at 12:27

score 39 · Answer 2 · edited Mar 06 '16 at 07:16

39

For me, this happened when I edited a blank drivers/etc/hosts file, and added an entry for a local website, but neglected to add 127.0.0.1 localhost

edited Mar 06 '16 at 07:16

Ghasem

14,455
21
138
171

answered Jul 01 '11 at 21:23

memnoch_proxy

1,944
15
20

1

Worked for me as well. Somehow I have had some entry in hosts file which should not be there (I did not put it there myself and do not remember installing any software that could do it). Removing it resolved the issue – LazyOne Aug 14 '12 at 22:40
2

For Windows you can uupdate this file doing this http://www.rackspace.com/knowledge_center/article/how-do-i-modify-my-hosts-file – oaamados May 30 '15 at 00:27
1

You saved my day! Thank – Houari Nov 29 '15 at 12:00

score 29 · Accepted Answer · answered Feb 17 '09 at 16:21

29

The issue was caused by a down Active Directory Server, which of course could not authenticate the Windows account. Thank you for your assistance.

answered Feb 17 '09 at 16:21

jinsungy

10,717
24
71
79

score 19 · Answer 4 · answered Feb 02 '16 at 20:44

19

For anyone else who runs into this, I had this in my hosts file:

127.0.0.1   localhost
127.0.0.1   customname

and I needed it to be this:

127.0.0.1   localhost
127.0.0.1   localhost   customname

answered Feb 02 '16 at 20:44

tster

17,883
5
53
72

Gennady Vanin Геннадий Ванин · Answer 5 · 2010-10-10T12:55:12.907

16

"The issue was caused by a down Active Directory Server, which of course could not authenticate the Windows account"

It is not "of course - because if AD is not available then Kerberos authentication falls back to NTLM (domain account credentials are cached locally, one can login with it even if AD/Kerberos is not available). I guess that you have possibly 2 simultaneous conditions for this failure to happen:

SQL Server is not local (on another machine)
The trust is configured "Kerberos only"

or other specific security network/server/AD/machine configurations

edited Oct 10 '10 at 12:55

answered Oct 10 '10 at 12:35

Gennady Vanin Геннадий Ванин

10,136
11
75
106

2

I've also seen this issue with AD named servers on a local machine FWTW – Keith Hoffman Apr 11 '12 at 06:36
1

So, what should I do if SQL server is not local ? – Bheid Feb 20 '16 at 10:22
Where and how to change "trust" configuration, which is currently "Kerberos only" ? – TPAKTOPA May 16 '19 at 06:48

score 11 · Answer 6 · answered Apr 22 '14 at 18:27

11

Make sure you aren't connected to a VPN on another domain\user. Or, conversely, make sure you are connected, if that is what is required.

answered Apr 22 '14 at 18:27

David Murdoch

87,823
39
148
191

Wow, would never have thought!! Thanks! (I was connected to company VPN on MBP, using SSMS on VMWare) – jenjenut233 Dec 24 '14 at 20:07
This helped in my case. I had to use the domain name in the VPN connection. – arni Feb 08 '19 at 16:18
This was my problem. I was about to leave it as an answer but found your's first. It made perfect sense once I saw it. thanks – billpennock Feb 19 '19 at 21:28

score 10 · Answer 7 · answered Feb 27 '12 at 19:50

I had this issue for a server instance on my local machine and found that it was because I was pointing to 127.0.0.1 with something other than "localhost" in my hosts file. There are two ways to fix this issue in my case:

Clear the offending entry pointing to 127.0.0.1 in the hosts file
use "localhost" instead of the other name that in the hosts file that points to 127.0.0.1

*This only worked for me when I was running the sql server instance on my local box and attempting to access it from the same machine.

score 5 · Answer 8 · answered Dec 18 '15 at 14:05

5

There is a setting on the jTDS driver called USENTLMV2 that is set to false by default. Setting this to 'true' in my db software (DBVisualizer) solved it.

answered Dec 18 '15 at 14:05

fossa83

51
1
3

score 4 · Answer 9 · answered Jul 26 '17 at 17:15

4

I fixed this issue on machine disabling the loopback check setting:

Edit the Windows registry: Start –> Run > Regedit
Navigate to: HKLM\System\CurrentControlSet\Control\LSA
Add a DWORD value called “DisableLoopbackCheck”
Set this value to 1

answered Jul 26 '17 at 17:15

Diogo

616
6
10

Matthew R · Answer 10 · 2013-06-03T13:34:05.497

Okay, completely out there answer from me. I was getting this error from a development environment hosted on VM VirtualBox. Three servers; SharePoint, SQL DB and Domain Controller. The SharePoint server couldn't connect to the configuration database. I could still connect via ODBC for Sql authentication using SA account but not Windows authentication. But that user would happily log into SSMS on the sql server itself. I got a better error message from ODBC too and also by checking the failed login messages on sql server:

select text from sys.messages where message_id = '18452' and language_id = 1033

Can't take credit for this because I asked one of our Enterprise Systems Administrators for help and he diagnosed it in about 5 minutes of looking at a few screen shots I sent him. Problem was that the Domain Controller’s clock was set incorrectly! Couldn't believe it. The servers are setup for Host Only networking so don't have internet to sync the clock with. That also explains why rolling back to an earlier snapshot when I know the system was working didn't solve the problem.

Edit: Installing the Guest Additions on the server syncs the guest clock with the host.

I have also had AD authentication issues this year that were eventually traced back to bad clock setting on one of our Domain Controllers. I had to use Wireshark to prove to our IT dept it was a network issue, but once I got them to look... they fixed the clock and all was well. — Ty H., Jul 29 '16 at 19:43

score 3 · Answer 11 · answered Aug 20 '10 at 20:05

3

For me, it was because i did not add the account to have roles I wanted to use to the SQL Database itself. And also due to a bad password attempts via copy paste problem locking account.

answered Aug 20 '10 at 20:05

Mike

31
1

score 3 · Answer 12 · answered Aug 04 '16 at 16:38

Another scenario where you might see this is when you are attempting to connect to another SQL server from an SSMS session that was already logged-in while you changed your password. Sequence of events might go something like:

RDP to Server-A (your SQL Server), open SSMS and login
RDP to Server-B in the same domain and change your password
Return to RDP session on Server-A and via SSMS attempt to add another DB into an existing AlwaysOn availability group. When connecting to replicas you get "untrusted domain"-login-error

To resolve, simply logoff and log back in

score 3 · Answer 13 · answered Aug 28 '17 at 08:51

You may be misleaded about the username you use locally. That was my case in Windows 10 Home. When I look at users in control panel, I see the name usrpc01. However when I type net config workstation, it appears that the user's name is spc01. Seems like someone renamed the user, but the internal name remained unchanged.

Not knowing how to fix windows user name (and the folder name under C:\Users, which also refers to the original internal name), I added a new user accout on my db server.

score 3 · Answer 14 · answered Feb 13 '09 at 17:04

3

try using a different valid login using RUNAS command

runas /user:domain\user “C:\Program Files\Microsoft SQL Server\90\Tools\Binn\VSShell\Common7\IDE\ssmsee.exe” 

runas /user:domain\user “C:\WINDOWS\system32\mmc.exe /s \”C:\Program Files\Microsoft SQL Server\80\Tools\BINN\SQL Server Enterprise Manager.MSC\”" 

runas /user:domain\user isqlw

answered Feb 13 '09 at 17:04

Gulzar Nazim

51,744
26
128
170

I tried this with another windows account on the same domain, and got the same error. – jinsungy Feb 13 '09 at 17:56
try to get the server and client event logs. i guess we need more details. – Gulzar Nazim Feb 13 '09 at 17:58

score 1 · Answer 15 · answered Jul 22 '14 at 04:04

1

I had to use netonly to get this to work on modern Windows:

runas /netonly /user:domain\user "C:\Program Files (x86)\Microsoft SQL Server\110\Tools\Binn\ManagementStudio\ssms.exe"

answered Jul 22 '14 at 04:04

Fil

1,766
1
15
15

score 1 · Answer 16 · answered Aug 19 '15 at 13:14

1

Another reason> someone changed the password for the default SQL user

this happened to me a couple of minutes ago by switching to a new domain controller ...

answered Aug 19 '15 at 13:14

Stefan Michev

4,795
3
35
30

Just happened to me. I changed my password a while back and forgot (credentials were saved) – sofly Oct 11 '16 at 19:33

score 1 · Answer 17 · edited Jun 12 '17 at 07:27

1

I had wrong entry in hosts file under C:\Windows\System32\drivers\etc

[Microsoft][SQL Server Native Client 11.0][SQL Server]Login failed. The login is from an untrusted domain and cannot be used with Windows authentication.

Make sure to have entry like below

127.0.0.1   localhost
127.0.0.1   localhost   servername

edited Jun 12 '17 at 07:27

Martin Evans

45,791
17
81
97

answered Jun 12 '17 at 06:54

user3808727

71
1
1

score 1 · Answer 18 · answered Jul 27 '17 at 07:33

1

I was using an alias for an SQL Server instance that pointed to "127.0.0.1". Changing it to "localhost" instead did the trick.

answered Jul 27 '17 at 07:33

lauxjpn

4,749
1
20
40

score 1 · Answer 19 · answered Aug 08 '18 at 11:52

If your Sql Server is running on a server that's is not part of a domain and in the connection string you use a fully qualifed domain name (e.g. xyz.mypc.com) with Integrated Security=True, you might have to switch to using either the IP address, MachineName (SERVER01), or the dot (.) in case it's locally hosted.

This worked for me, using the fqdn resulted in the above error.

score 1 · Answer 20 · answered Jun 14 '11 at 23:16

I have been trying to log into a SQL Server 2008 from a domain account. The SQL Server 2008 is hosted on a different workgroup computer that is not part of the domain. As strange as it sounds, on the workgroup server where SQL Server 2008 is running, I had to go to System Properties | Computer Name (tab) | Change (button) | Computer Name Change | More... (button) and enter the "Primary DNS suffix of this computer" (it was blank, so enter the desired suffix for your network) and check the "Change primary DNS suffix when domain membership changes" box. This allowed the Windows Authentication process to complete when logging into the SQL Server 2008.

score 0 · Answer 21 · answered Jul 13 '12 at 11:07

0

And another possible reason: The new created local Account on DB Server had the: "User must change Password at next Login" Flag set.

answered Jul 13 '12 at 11:07

icnivad

2,231
8
29
35

score 0 · Answer 22 · answered Dec 23 '13 at 06:56

0

Here's what fixed it for me: Properties of network connection Click on: "Internet Protocol Version 4 (TCT/IPv4)". Click "Properties" button. Click "Advanced" button. Select "DNS" tab. Delete text in "DNS suffix for this connection".

answered Dec 23 '13 at 06:56

Dennis Gorelik

1,234
1
11
15

score 0 · Answer 23 · answered May 14 '14 at 08:51

I wasn't able to remotely connect to the SQL server either. Both SQL server and remote server where in the same domain. And I had been requested a password change some days before. Restarting both the SQL server and the remote server I was trying to access SQL server from did the trick for me.

score 0 · Answer 24 · answered Nov 07 '14 at 09:00

0

In our case it was the fact that the developer was running the application pool under his own account, and had reset his password but forgot to change it on the application pool. Duh...

answered Nov 07 '14 at 09:00

Ronald Kunenborg

171
4

score 0 · Answer 25 · answered Nov 12 '14 at 21:42

0

In my case, the server had been disabled in the domain controller. I went into the COMPUTERS OU in Active directory, right-clicked on the server,enabled it, then did a gpupdate /force from the SQL server. It took a moment, but it finally worked.

answered Nov 12 '14 at 21:42

Doug Gallardo Jr

1

score 0 · Answer 26 · answered Dec 03 '14 at 10:10

In my case, in the host file, the machine name is hard coded with older IP. I replace the older IP with the new one, the issue is resolved.

Host file location

WindowsDrive:\Windows\System32\drivers\etc\hosts

Modifications done 159.xx.xx.xxx MachineName

score 0 · Answer 27 · edited Dec 27 '15 at 21:11

0

None of the above worked for me. What I had to do was: In SQL Server Management Studio on the login screen, select Options >> In the Network section change the Network protocol to Named Pipes.

Also, what I had to do to make it work with the <default> setting was to disable the wireless network (the machine was also connected to the wired lan).

edited Dec 27 '15 at 21:11

Mr Lister

45,515
15
108
150

answered Dec 21 '15 at 08:53

DeclanMcD

1,518
4
22
41

score 0 · Answer 28 · answered Jan 14 '16 at 19:37

0

My fix was to change the web.config file to correlate with my new server name for SQL Connection (IT Security had just done a netdom rename on my development box.

answered Jan 14 '16 at 19:37

Devin Prejean

626
6
12

score 0 · Answer 29 · answered Oct 09 '10 at 17:09

0

For me, I have to disconnect (change workgroup/domain) from the Domain and reconnect.

answered Oct 09 '10 at 17:09

f01

1,738
1
18
21

Do you mean to connect using local account to remote SQL Server in workgroup? This will work only if Guest (or some other common) accounts with the same password are enabled both in SQL Server machine, connecting machine and in SQL Server itself as login. – Gennady Vanin Геннадий Ванин Oct 10 '10 at 13:09
I mean disengage then re-engage with the domain group. Then retry logging in using Windows auth (Domain credentials) on remote MSSQL. – f01 Oct 10 '10 at 15:14

score 0 · Answer 30 · answered Feb 13 '09 at 17:41

0

in order to enable windows authentication both computers need to be in the same domain. in order to allow managment studios to pass the current credentials and authenticate in the sql box

answered Feb 13 '09 at 17:41

Oscar Cabrero

4,168
8
29
49

3

This is inaccurate. They don't need to be in the same domain. They can be in different domains if an account with the same name and password is setup in both domains. – Cody Schouten Jun 26 '15 at 18:09

score -1 · Answer 31 · edited Nov 07 '12 at 18:49

You need to enable the sa account first and log in to your SQL management studio with the sa account (please chose SQl Server authentication).

After you logged in with the sa account, go to security, right-click on logins, select new login, select SQL Server authentication, create a user name (no / or any other special characters, just a name), then give it a password, confirm the password and at the bottom of that page select your default Database.

Go to logins, right-click on the user you created and click on properties.

Go to Server Roles and select the roles you want to give to the user you created.

Click OK and go back to login properties, click on User Mapping, double-click on the database you want to map this user to and select the database role membership for that database in the bottom window.

The OP already stated he can login with SQL authentication, so your solution would not help. He also updated the initial post and stated the issue was caused by a AD server that was down. — SchmitzIT, Nov 07 '12 at 18:46

score -1 · Answer 32 · answered Jan 07 '16 at 19:34

-1

Make sure you are are not using "Trusty_Connection=yes" somewhere. I had this same problem and I fix by simply setting this to "no".

answered Jan 07 '16 at 19:34

Ângelo Maciel

1

score -1 · Answer 33 · answered Feb 28 '16 at 08:59

I had the same problem when I wanted to run my project on another PC. Changing connection string from

Data Source=JOHN-PC\JJ;Initial Catalog=MyDatabase;Integrated Security=True;Pooling=False

to

Data Source=JOHN-PC\JJ;Initial Catalog=MyDatabase;Persist Security Info=True;User ID=MyUserName;Password=MyUserPassword

helped me.

This is the link where original answer is: Login failed.The login is from an untrusted domain...

Hope this would help.

score -1 · Answer 34 · edited Aug 04 '11 at 11:10

-1

I replaced the connecting string and it started working

from

main_sqlconnection = New SqlConnection("Data Source=Server1\SQLEXPRESS;Initial Catalog=Master;Trusted_Connection=True")

to

main_sqlconnection = New SqlConnection("Data Source=Server1\SQLEXPRESS;Initial Catalog=Master;User ID=ARM;Password=1;")

I created the account User ID=User;Password=1; in Microsoft SQL Server Management Studio: click on Security and add a new user.

edited Aug 04 '11 at 11:10

dandan78

13,328
13
64
78

answered Aug 03 '11 at 12:45

Sergey

15
1

1

This definitely works. Unfortunately, it is against policy where I work. – JosephDoggie Jan 07 '15 at 21:59
10

It is also NOT using integrated authentication. – John Dec 01 '15 at 18:51

score -2 · Answer 35 · edited Jan 07 '12 at 08:20

-2

Just remove Trusted_Connection=True property from the connection string.

edited Jan 07 '12 at 08:20

Cosmin

21,216
5
45
60

answered Jan 07 '12 at 06:18

Shrikant

9

The OP clearly states the login was from an untrusted domain. Turning off "Trusted_Connection" would not do anything. Other than that, when one uses SQL Server Management Studio, you typically just enter the credentials, rather than building up a connection string. – SchmitzIT Oct 26 '12 at 07:58

SQL Server 2008 Windows Auth Login Error: The login is from an untrusted domain

35 Answers35

Linked

Related