SQL services failing on startup

From: Mateo (Mateo_at_discussions.microsoft.com)
Date: 02/08/05 

Date: Tue, 8 Feb 2005 10:25:04 -0800

I’ve got a mystery on my hands and hope someone out there can help me. I
attempted to include relevant information only.

Environment: SQL 2000 Enterprise SP3a, Win 2003 Enterprise, Active Directory

History: One of our production SQL servers is rebooted once a week on
weekends. The services are set to autostart using a windows account. The
account is now (see recent changes below) part of a global group with local
admin privileges. The account is restricted to logon only to computers
running SQL Server. Log Shipping is running on the server. After running fine
for several months, the last two weekends, SQL Server has failed to startup
after the reboot.

Recent Changes: The domain account was a member of the local admin group.
Per company standards, the account was added to a domain group. The domain
group was granted local admin privileges and the domain account was
explicitly removed from the local admin group. Also, the list of computers
the account can logon to was expanded.

1) The following message is associated with the failed startup: “The account
name is invalid or does not exist, or the password is invalid for the account
name specified.” The first time this happened, the logon account for the
services was changed from domain\account to a UPN logon
(account@mycompany.com). SQL Server started up fine manually. This weekend it
failed again with the same message. Again, SQL Server started up fine
manually, indicating the account and password are set correctly.
2) The domain account used to startup the services has been granted SQL
Server login privileges and is a member of the SA server role. Under the
‘Security Access’ option there is a third option listed in addition to Grant
and Deny access, ‘Through group membership’. The ‘BUILTIN\Administrators’
group also has login privileges. I checked other servers, and this is the
only occurrence of this option on windows logins.
3) Because of the authentication issues, I’m hesitant to change all our SQL
server services to startup using domain accounts. Most of them do not need
access to resources on the network. This particular instance requires it
because of Log Shipping.

Thanks for your help,
Mateo

Relevant Pages