The DLO Database server gets "SSPI handshake failed" errors in the Application Event Log

book

Article ID: 100006549

calendar_today

Updated On:

Cause

The above errors are rooted in Active Directory / OS authentication issues when the DLO Agent attempts to establish a connection to the DLO Database with the associated users credentials.

Resolution

To track down the real reasons behind the SSPI handshake failures, it is necessary to enable logging for the Net Logon service on the host running the DLO database and getting the SSPI handshake failure messages in the Application Event Log.

 

This Microsoft article describes how to enable Net Logon service logging: support.microsoft.com/kb/109626

 

Once enabled as per Microsoft's instructions, wait for additional SSPI handshake failures to occur, then in the Netlogon.log file, locate the exact time at which the SSPI failures occur to observe the true errors.  It will be possible to identify the Domain and User who generated the errors as well as the name of the Machine they were logged onto at the time.

 

Example 1:
9/16/2011 8:07:36 AM MSSQLSERVER Error (4) 17806 N/A DLOServer SSPI handshake failed with error code 0x8009030c while establishing a connection with integrated security; the connection has been closed. [CLIENT: ]

09/16 08:07:36 [LOGON] SamLogon: Network logon of BigDomain\UserA from XP-Desktop Entered
09/16 08:07:36 [CRITICAL] NlPrintRpcDebug: Couldn't get EEInfo for I_NetLogonSamLogonEx: 1761 (may be legitimate for 0xc000006a)
09/16 08:07:36 [LOGON] SamLogon: Network logon of BigDomain\UserA from XP-Desktop Returns 0xC000006A
Example 2:
9/15/2011 12:24:05 AM MSSQLSERVER Error (4) 17806 N/A DLOServer SSPI handshake failed with error code 0x8009030c while establishing a connection with integrated security; the connection has been closed. [CLIENT: ]
09/15 00:24:05 [LOGON] SamLogon: Network logon of BigDomain\UserB from Win7Desktop Entered
09/15 00:24:05 [CRITICAL] NlPrintRpcDebug: Couldn't get EEInfo for I_NetLogonSamLogonEx: 1761 (may be legitimate for 0xc0000234)
09/15 00:24:05 [LOGON] SamLogon: Network logon of BigDomain\UserB from Win7Desktop Returns 0xC0000234
The hex codes contained in the Netlogon.log file will describe the true root-cause of the error.  
The hex codes are documented in this Microsoft article: msdn.microsoft.com/en-us/library/cc704588(v=prot.10).aspx
The above examples translate accordingly:
0xC000006A - When trying to update a password, this return status indicates that the value provided as the current password is not correct.
0xC0000234 - The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested.
There are a variety of possible errors and associated solutions.  Some errors, like incorrectly typed usernames or passwords are easily dismissed.  If more serious errors repeatedly occur you may have to work with the appropriate system administrator and or Microsoft Support to identify and correct the issue.

Issue/Introduction

On the Windows server housing the DLO database, errors like these are observed in the Application Event Log: 9/16/2011 8:07:36 AM MSSQLSERVER Error (4) 17806 N/A DLOServer SSPI handshake failed with error code 0x8009030c while establishing a connection with integrated security; the connection has been closed. [CLIENT: <named pipe>] 9/15/2011 12:24:05 AM MSSQLSERVER Error (4) 17806 N/A DLOServer SSPI handshake failed with error code 0x8009030c while establishing a connection with integrated security; the connection has been closed. [CLIENT: <named pipe>]
Powered by Wolken Software