DPA will not register when the user does not exist on this server or the password that was entered does not match the user

10/23/2018 6:32 AM

10/23/2018 6:32 AM

This article provides information about the following error that can occur when you are registering a SQL Server database instance in DPA and the Create monitoring user option is set to No:

The user [User name] does not exist on this server or the password that was entered does not match the user.

Database Performance Analyzer

When checking if a Windows authentication user exists, DPA runs a stored procedure sys.xp_logininfo. This SQL server procedure has been known to display an error in select conditions environmental to the server. 

In an environment where you have user accounts existing in a parent domain (e.g. DOMAIN01) and Computer and Service accounts existing in a Child Domain (e.g. DOMAIN02), you may find that the SQL Server running on a computer in the Child Domain will report the error when you perform specific operations from a SQL Server running either SQL Server 2005 or SQL Server 2008 on a Windows 2008 Operating System.

This error occurs due to changes in the security of Windows 2008 and specifically changes to the Microsoft Windows API calls used to retrieve information about the Windows domains and the Windows user accounts.

The issue will only occur when the SQL Server is attempting to retrieve information regarding Windows Domains and User accounts from the Parent Domain (e.g. DOMAIN01). Queries to AD objects within the same domain (e.g. DOMAIN02) will be successful.

1. Check if the server is case sensitive and verify that the case of the user is correct. 
2. Run the following query outside of DPA on the monitored instance such as SQL Server Management Studio:

   xp_logininfo 'DOMAIN\yourUser','all'

   You may get an error such as. 

Msg 15404, Level 16, State 19, Procedure xp_logininfo, Line 62
Could not obtain information about Windows NT group/user 'DOMAIN\youUser', error code0x5.

 

If this is returned you can try several items to correct the issue:

• If the SQL service is running under a local account so such that it is unable to poll AD,  change it to to a network account. 
  or 
• Add the service account which the SQL Server service is running on to the "BUILTIN\Windows Authorization Access Group" group within the parent domain. This membership could be inherited through another domain group being added to that Built In group.

 

Reference Material:

• hxp_logininfo (Transact-SQL) (© 2016 Microsoft, available at https://msdn.microsoft.com/en-us/, obtained on June 20, 2016)
• Some applications and APIs require access to authorization information on account objects (© 2016 Microsoft, available at https://support.microsoft.com/en-us, obtained on June 20, 2016)
• xp_logininfo fails for agent account (© 2016 SQLServerCentral.com, available at http://www.sqlservercentral.com/, obtained on June 20, 2016)
• Windows 2008 and xp_logininfo (Content provided by Matt Lavery, available at http://blog.matticus.net/, obtained on June 20, 2016

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.  You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.