Forum Discussion
SharePoint SE – Unknown SQL Exception 18452 occurred. Login failed.
This month we applied OS updates to the DB Server. Site was up. Then we applied OS Updates to App server, site went down and we reverted it. Then we applied OS updates on WFE server. The site is up. However, in WFE when running Get-SPFarm or running PSConfig on the WFE, it throws the following errors:
PowerShell / PSConfig: “Cannot access the local farm. Verify that the local farm is properly configured…”
Configuration Wizard: “Failed to detect if this server is joined to a server farm.”
The Error Logs:
Checking the Windows Event Viewer on the WFE during a database connection attempt shows:
Unknown SQL Exception 18452 occurred.
Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication.
Network connectivity is fully operational.
AD Domain trust is healthy.
Local machine groups are clean: NT AUTHORITY\SYSTEM is not present inside the local WSS_WPG or IIS_IUSRS groups.
DisableLoopbackCheck is already set to 1 in the registry.
Any help on how to get the error is greatly appreciated.
2 Replies
We run the mentioned tests and didn't find any issues.TestNetConnection returns True. TestComputerSecureChannel returns True. The error in SQL Server was SSPI handshake failed , state 14 while establishing a connection with integrated security. the connection has been closed. WFE Error was The login is from an untrusted domain and cannot be used with Integrated authentication. Our authentication method is NTLM.
Error 18452 means SQL Server could not validate the Windows principal presented by the WFE, so investigate Windows/SQL authentication before PSConfig. On the WFE, run Test-ComputerSecureChannel -Verbose and verify time, DNS, and domain-controller reachability. Test the same account running Get-SPFarm against SQL with Windows authentication; note whether every domain account fails or only that account. On SQL Server, correlate the failure in the SQL error log and Windows Security/System logs, including SSPI or Netlogon errors. Query MSSQLSvc SPNs for the SQL FQDN and port with setspn -Q, list the SQL service account’s SPNs with setspn -L, and correct duplicates or wrong ownership before retrying. Do not rerun PSConfig or modify the farm while authentication is broken. If the secure channel fails, repair it with approved domain credentials and restart the WFE. If it passes, collect SQLCHECK or Kerberos Configuration Manager output, ULS logs, and update history for Microsoft support.
