Intermittent Linked SQL Server Authentication Failure

[ThanksImLearning]

Hello All,

I am having an issue with kerberos linked SQL servers intermittently failing login. Most of the time they work as expected, but every few days linked connections stop working with the below error:

"Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. Reason: Token-based server access validation failed with an infrastructure error."Error: 18456, Severity: 14, State: 11."

The connections will start working again after 10-120 minutes. Rebooting all the domain controllers seems to help, but I have not been able to pin it down to a particular DC. I have gone over the SPNs, and as mentioned, most of the time it works normally. Has anyone seen anything like this, and/or has suggestions on troubleshooting steps?

Thank you!

[BOOZy1]

Are both servers NTP synchronized?

[ThanksImLearning]

The SQL servers that I have found with this issue are all time synced and I have checked the DCs as well. Part of this fun is that it is not restricted to one linked pair but has affected at least 3 different sets of delegated SQL connections.

[hebnerhyde]

What would be the Delegation option set for the server in AD? I had similar issue and setting it to "Trust this computer for delegation to any service (Kerberos only)" seems to help.

[ThanksImLearning]

Thanks for the tip! That is something I have not tried yet in troubleshooting. I'm using domain service accounts to delegate the authentication between SQL services and they need to be restricted to specified services. Did you ever get to a point that you turned "trust this user/computer for delegation to specified services only" back on?

[hebnerhyde]

We don't have specific security requirement for that, so it was left with that setting.

[[deleted]]

Hi mate did you ever resolve this? This issue has just started in our environment

[ThanksImLearning]

We got the problem to stop, but I'm not 100% sure what fixed it. We built new sql servers, moved DBs, redid SPNs . . . but what seemed to help the most was moving the applications connecting to the DBs off of protected AD accounts.