I am trying to create a job that runs a SSIS package. I am getting the following error:
Message
Unable to start execution of step 1 (reason: Error authenticating proxy domainsckeels, system error: Logon failure: unknown user name or bad password.). The step failed.
Our DBA ran the following to create the credentials and proxy account.
USE MSDB
CREATE CREDENTIAL [sckeels] WITH IDENTITY = 'domainsckeels', secret = 'sckeels_credentials'
GO
Sp_add_proxy @proxy_name='ssis_users', @credential_name='sckeels'
GO
Sp_grant_login_to_proxy @login_name='domainsckeels', @proxy_name='ssis_users'
GO
Sp_grant_proxy_to_subsystem @proxy_name='ssis_users', @subsystem_name='SSIS'
I have been attempting to create a snapshot of a database. Just install a SQL2005 cluster. The snapshot appears to create ok, but when I view snapshot agent status I get the following error which I have not been able to figure out:
Unable to start execution of step 2 (reason: Error authenticating proxy ohaevservices, system error: Logon failure: unknown user name or bad password.). The step failed.
I'm trying to set a proxy account for the SQL agent. The user is Local administrator on the SQL Server when I try to set the account I get a message back that says "The system cannot find the path specified." I get the same error with TSQL too.
Basically a dts package has been setup that pulls in data from another companies server, this data requires to be on-demand i.e individual users can pull in updates of the data when they require it.
I am using xp_cmdshell and dtsrun to pull in the data. This obviouly works fine for me as i am a member of sysadmin.
Books online quotes " SQL Server Agent proxy accounts allow SQL Server users who do not belong to the sysadmin fixed server role to execute xp_cmdshell"
So i went to the SQL Server Agent Properties 'Job System' tab and unchecked 'Non-sysadmin job step proxy account' and entered a proxy account.
The proxy account has been setup as a Windows user with local administrator privilages and even a member of the sysadmin server role - just in case.
Now when i log onto the db with my test account - a non-sysadmin - and attempt to run the stored proc to import the data i recieved the message 'EXECUTE permission denied on object 'xp_cmdshell', database 'master', owner 'dbo' '
hmm... so basically i have either misunderstood BoL or there is something not quite right in my setup.
I have search the net for a few days now and yet i can find no solution.
Is it possible to connect to SQL Server just using the SQL server agent's proxy account and access data ( without SQL management studio or SQL / Window authentication ). The proxy account is active only for SSIS package execution subsystem.
I have a frustrating problem where I am using the Ola Hallengren jobs to backup to a network share. (This isn't something specific to his scripts).
For various reasons the SQL Server account can not be granted access to the share so I thought I would use a proxy account which does have access (this has been fully tested). I am using a CmdExec proxy.
The problem comes now that when I run the job it still thinks access is denied when running the xp_create_subdir command.
When I recreated this problem locally on my machine, as soon as I add the SQL Server account access to the share the backups work, so why isn't the job using the proxy account?
I am trying to run SSIS packages under SQL Server Agent 2005 and I keep getting a package failed error in the event viewer.
I've heard that I need to set up a proxy account. I have found the following code and need a little explanation on what all the parts mean since I am very new to this: Use master CREATE CREDENTIAL [MyCredential] WITH IDENTITY = 'yourdomainmyWindowAccount', secret = 'WindowLoginPassword' Use msdb Sp_add_proxy @proxy_name='MyProxy', @credential_name='MyCredential' Sp_grant_login_to_proxy @login_name=' devlogin', @proxy_name='MyProxy' Sp_grant_proxy_to_subsystem @proxy_name='MyProxy', @subsystem_name='SSIS'
Let's say for the sake of argument my domain is called CompanyInc and I log into windows with my name Philip_Jaques and my password is badpassw0rd. Would I modify the above code this way to create my proxy?
Use master CREATE CREDENTIAL [MyCredential] WITH IDENTITY = 'CompanyIncPhilip_Jaques', secret = 'badpassw0rd' Use msdb Sp_add_proxy @proxy_name='MyProxy', @credential_name='MyCredential' Sp_grant_login_to_proxy @login_name='Philip_Jaques', @proxy_name='MyProxy' Sp_grant_proxy_to_subsystem @proxy_name='MyProxy', @subsystem_name='SSIS'
Also, when I create this proxy account where in SQL Server 2005 can I go to view it and its properties? And assuming I get the proxy account set up correctly, how do I get my current jobs to start using it so they will successfully run?
There is one thing that€™s confusing me in creating a proxy account.
I am trying to get an SSIS package configured as a SQL Server job and execute it from a non-sysadmin login. But when I execute it gives the error message:
Non-SysAdmins have been denied permission to run DTS Execution job steps without a proxy account. The step failed.
I know that we have to create a proxy account for this to happen and creating of proxy account prompts me to choose a credential, and that is where I do not understand the logic. From MS website I can find the following, but it is confusing to me
This proxy account must use a credential that lets SQL Server Agent run the job as the account that created the package or as an account that has the required permissions.
I tried reading all the related articles, but still the process of creating the credential is confusing to me, can someone throw some light on the logic of proxy/credential here?
because my package does not run with SQL-Server-Agent, but without problems if started by "hand", I created a new credential which contains the information needed for the package. I did this as described on: http://msdn2.microsoft.com/en-us/library/ms190703.aspx .
After that i tried to create an proxy account, but when I chose the created credential, Management Studio says "Der Proxy "[name_of_credential] ist kein gültiger Windows-Benutzer(Microsoft SQL Server, Fehler: 14529)". This means something like: "This Proxy is not a valid windows-user. Error: 14529".
Any hints how to use a credential that is not a windows-user?
I have an SSISS package running in a job step, the job is owned and has to be run by a non-sysdamin SQL login. I have created a new credential (windows autrhentication, sysadmin priviledges) , mapped it to proxies 'SSISS' and 'Operating systems (CmdExec)' and have assigned the job step to run as that credential. Yet I'm getting the following error message:
Unable to start execution of step 1 (reason: Error authenticating proxy DomainUserName, system error: Logon failure: unknown user name or bad password.). The step failed.
Hello, I'm having trouble setting up PROXY account. I follow the documentation, and Under Credentials, I can only select Operator. Is there a way to select any account under Security?
I have read all the posts regarding this error, but non-solve my problem as I had already addressed them.
I am setting up Merge Replication via the Web and I get this error when i try to sync. Let me give you some background.
I wrote a small windows test app to test merge replication, in which i am using RMO to accomplish the replication. This works. It syncs every time. I then copied the "sync" code from the winform application and created a Windows Service in which i placed "sync" code. The sync code did not change other than adding the additional following four lines:
_mergeAgent.InternetUrl = _internetURL;
_mergeAgent.InternetLogin = _internetLogin;
_mergeAgent.InternetPassword = _internetPassword;
_mergeAgent.InternetTimeout = _internetTimout;
where the internet url is https://ipaddress/virtualdirectory/replisapi.dll
I have been working with this for a while now trying to figure out why this works (on the same machine) in a winforms app but not through the web (via a windows service).
I am trying to create a Proxy account to use for Job Scheduling, but when ever I add Logins to the Principals in the Proxy Properties and click OK, when I check again, they are not saved. Is there a reason why this happens? Is there an alternate way to add principals? Thanks.
Hi all, I have a problem while i create a proxy account.The situation is like this...There is a user who has an login in to the server.He has a stored procedure which calls some on the SSIS packages and XP_cmdshell...so this stored procedure basically load some data in to the tables .So for the login in order to execute the stored procedure as he is not a Sys admin I have created a proxy account in my account as Iam an SA and then in the proxies and in principals I selected his login name and this way I have created a credential and a proxy account.
Now the problem is if he logins with his id and password and try to execute the stored procedure it gives an error message
Server: Msg 15153, Level 16, State 1, Procedure xp_cmdshell, Line 1 The xp_cmdshell proxy account information cannot be retrieved or is invalid. Verify that the '##xp_cmdshell_proxy_account##' credential exists and contains valid information.
....so this mean the login is not able to see the proxy account.So what I did is I created a job and then in the job owner tab I have selected his login and then created a step with the type operating system (CmdExec) as I need to just execute the stored procedure and used the proxy account that I have created.
so I gave the command -- exec <stored procedure> --. But this job fails and gives the error message as [298] SQLServer Error: 536, Invalid length parameter passed to the SUBSTRING function. [SQLSTATE 42000]....
So now ....first My question is am I doing in a right way....if its right then why Iam not able to execute the stored procedure.
If there is any other way through which I can execute the stored procedure using a proxy account for the logins who are not sys admins....please do let me know.....
"Error executing extended stored procedure: Specified user can not login"
I have tried this through Enterprise Manager and get identical results, of course.
I have also tried all of the following: - different OS user accounts, including local system accounts with local admin rights; - assigning the OS account to a SQL login with System Admin role/rights; - specifically assigning the above SQL login with EXEC rights on the master.dbo.xp_CmdShell procedure; - verifying local security policy settings, as per the following link: http://support.microsoft.com/?id=283811; - pulling out my hair and banging my head against the wall.
Hi all, I have a problem while i create a proxy account in SQL Sever 2005.The situation is like this...There is a user who has an login in to the server.He has a stored procedure which calls some on the SSIS packages and XP_cmdshell...so this stored procedure basically load some data in to the tables .So for the login in order to execute the stored procedure as he is not a Sys admin I have created a proxy account in my account as Iam an SA and then in the proxies and in principals I selected his login name and this way I have created a credential and a proxy account.
Now the problem is if he logins with his id and password and try to execute the stored procedure it gives an error message
Server: Msg 15153, Level 16, State 1, Procedure xp_cmdshell, Line 1 The xp_cmdshell proxy account information cannot be retrieved or is invalid. Verify that the '##xp_cmdshell_proxy_account##' credential exists and contains valid information.
....so this mean the login is not able to see the proxy account.So what I did is I created a job and then in the job owner tab I have selected his login and then created a step with the type operating system (CmdExec) as I need to just execute the stored procedure and used the proxy account that I have created.
so I gave the command -- exec <stored procedure> --. But this job fails and gives the error message as [298] SQLServer Error: 536, Invalid length parameter passed to the SUBSTRING function. [SQLSTATE 42000]....
So now ....first My question is am I doing in a right way....if its right then why Iam not able to execute the stored procedure.
If there is any other way through which I can execute the stored procedure using a proxy account for the logins who are not sys admins....please do let me know.....
I running SSIS package job without sql agent , it is working fine.when i am running through sql agent not running.
created Proxy account job failed and give above error. Server is cluster and taking data from desktop. server is in one domain and desktop in another domain.
Hi all, I have a problem while i create a proxy account.The situation is like this...There is a user who has an login in to the server.He has a stored procedure which calls some on the SSIS packages and XP_cmdshell...so this stored procedure basically load some data in to the tables .So for the login in order to execute the stored procedure as he is not a Sys admin I have created a proxy account in my account as Iam an SA and then in the proxies and in principals I selected his login name and this way I have created a credential and a proxy account.
Now the problem is if he logins with his id and password and try to execute the stored procedure it gives an error message
Server: Msg 15153, Level 16, State 1, Procedure xp_cmdshell, Line 1 The xp_cmdshell proxy account information cannot be retrieved or is invalid. Verify that the '##xp_cmdshell_proxy_account##' credential exists and contains valid information.
....so this mean the login is not able to see the proxy account.So what I did is I created a job and then in the job owner tab I have selected his login and then created a step with the type operating system (CmdExec) as I need to just execute the stored procedure and used the proxy account that I have created.
so I gave the command -- exec <stored procedure> --. But this job fails and gives the error message as [298] SQLServer Error: 536, Invalid length parameter passed to the SUBSTRING function. [SQLSTATE 42000]....
So now ....first My question is am I doing in a right way....if its right then why Iam not able to execute the stored procedure.
If there is any other way through which I can execute the stored procedure using a proxy account for the logins who are not sys admins....please do let me know.....
(Posting this again since my original post has disappeared from the forum sometime during the day.)
I have about a dozen jobs that are being started at the same time (1:30am). Each time they start up, I end up with a random number of those jobs failing to run and logging the follow error:
Unable to start execution of step 1 (reason: Error authenticating proxy LSPJobUser, system error: Logon failure: unknown user name or bad password.). The step failed.
Each night it is a different collection of failed jobs (some work and some do not). If I manually run the job they ALL work EVERY time.
As anybody experienced this before? Is it possible that SQL Agent cannot handle a dozen jobs at once? (Or at a minimum cannot authenticate a dozen jobs at once.) (I do not believe it but cannot think of any other possibility.)
(For a quick fix I am going to stagger the dozen jobs to start over a ten minute period instead of starting at the same time.)
I'm attempting to run a ssis package via sql server agent.
The package and the DB are on a cluster.
The package runs fine when 'Sql Server Agent' is the run-as.
When I try and use a proxy to run the package, it fails with this error:
Date 5/28/2008 6:21:54 PM Log SQL Agent (Current - 5/28/2008 6:21:00 PM) Message [136] Job CorpFoo New reported: The process could not be created for step 1 of job 0xDAE2A53F27943D4CA412A0D177CAA546 (reason: A required privilege is not held by the client)
I've: Create Credential to be used by proxy Create Proxy Give Permissions to Proxy in SQL Server Give Permissions to Proxy at the Server for SQL Agent Batch Run Give Permissions to Proxy at the Server to Connect to SSIS
During install of SQL Server 2005, we can of course use a domain account or the built-in system account for running the services. I lean toward domain for obvious reaons but would like to know a +/- to each option and why I'd choose one over the other and what consequences or limitations one may encounter if I choose one over the other.
I have a Report Server when i try to deploy my report on the same server and if i use the Fully Qualified Domain Name in my report path i get the below Error
I have tried to search on the topic, but there's a variety of answers that has left me a bit confused, so let me try asking a-new...
I have RS 2005 installed (Report Server on one server with IIS and everything else, Integrated Security set; the Report Catalog on a separate server with SQL Server 2005, etc.). So far so good.
I can easily access a few of my test reports using URL Access, and I can also access Report Mgr just fine; all that to indicate I'm pretty sure I have RS installed and setup and working correctly.
Now I have a custom ASP.NET 2.0 based web app that, of course, uses Forms based authentication, not Windows. I can create a hyperlink on one my web pages that uses URL Access to get to some of my test reports. But, of course, it's prompts me for (and seems to remember) domain credentials.
That's the piece I want to avoid. I have created a specific Windows domain account that would be used for this purpose. Now, I just need to figure out code to put in my ASP.NET page to pass that along. I am not using the ReportViewer control.
So, I am trying to find a decent reference/example code on how to set the credentials. I have seen much example code that is like:
//assumes a web reference has been setup... ReportingService rs = new ReportingService();
But I don't think I want "DefaultCredentials"... I want to use my custom domain account. Any help?
My other wild idea was creating this custom page in a directory where I could drop in a custom web.config that set the <authentication> element to "Windows" then set the <identity> element to my custom account... any thoughts on that would be appreciated.
we have SSRS and I've worked on my local PC and developed a report which connects to a database e.g. on server 3 with the credentials set as a particular SQL user. All works fine locally but as soon as I deploy the report to the report server (server 2), I receive the following error: Cannot create a connection to data source"
The database server records the following SQL error:"Login failed for user 'NT AUTHORITYANONYMOUS LOGON'. Reason: Could not find a login matching the name provided."what I need to do to successfully run this from server 2? The fact it works locally fine means that the login is working ok I guess so I'm not sure what happens when it is transferred to the database server.The user is a SQL user rather than domain one and the user exists on SQL databases on both servers.
I am trying to deploy reports to my secure report server. When I attempt to deploy it's not authenticating me and I get an error:
TITLE: Microsoft Report Designer ------------------------------ A connection could not be made to the report server https://reports.******.com/ReportServer. ------------------------------ ADDITIONAL INFORMATION: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. (System.Web.Services) ------------------------------ The remote certificate is invalid according to the validation procedure. (System) ------------------------------ BUTTONS: OK ------------------------------
We have a custom application that connects remotely to a SQL Server 2000 (SP2) database. We would like our application to validate a user's login against Active Directory.
So far I have been able to get a lookup working, but I can not find documentation on how to validate the password from within SQL Server. I found a lot of notes on using ASP.NET objects, or VB, C#, etc, but for this solution it must be done entirely in SQL. It would also be nice if this were SQL Server 2005; we could just embed the C# code and call it as a SQL stored proc, but unfortunately we are left with the constraint that we cannot upgrade this DB at this time.
Linked server 'ADSI' is set up with the sp_addlinkedserver command:
Two table functions in our test DB (trying to test both ways I've found in docs):
ALTER FUNCTION [dbo].[GetAuthenticatedUserViaLDAP] ( -- Add the parameters for the function here @userId nvarchar(50), @password nvarchar(50) ) RETURNS TABLE AS RETURN ( -- Add the SELECT statement with parameter references here SELECT [SAMAccountName], CN [Name], SN [Last Name], ST State FROM OPENQUERY( ADSI, '<LDAP://DC=company,DC=com>;((objectClass=user));SAMAccountName,cn,sn,st') WHERE [SAMAccountName] = @userId )
ALTER FUNCTION [dbo].[GetAuthenticatedUser] ( -- Add the parameters for the function here @userId nvarchar(50), @password nvarchar(50) ) RETURNS TABLE AS RETURN ( -- Add the SELECT statement with parameter references here SELECT [SAMAccountName], [Name], SN [Last Name], ST State FROM OPENQUERY( ADSI, 'SELECT SAMAccountName, Name, SN, ST FROM ''LDAP://bdsserver1/ CN=users,DC=company,DC=com'' WHERE objectCategory = ''Person'' AND objectClass = ''user'' ') WHERE [SAMAccountName] = @userId )
So calling either of these table functions from our custom application gives the same result:
select * from dbo.GetAuthenticatedUser('astonaker','abc') OR select * from dbo.GetAuthenticatedUserViaLDAP('astonaker','abc')
ResultSet:
'astonaker', 'Anthony', 'Stonaker' 'NULL'
So I can at least tell if a given user exists or not, but I have no visibility into whether the password they entered into our application is valid in LDAP.
I don't want to pass unencrypted passwords through the network, but then I don't know how to encrypt/compare these passwords without using the .NET Connection or DirectoryEntry, etc objects.
I have been running a script in SQL Server 2000 as sa also as a Active Directory user who has administrator rights (I tested both approaches SQL Server then Windows Authentication) in Query Analyser which grants execute rights to the stored procedures within the database instance and Query Analyser does not give any errors when I run the script. I have made sure that each transaction has a go after it. I then return to Enterprise Manager, check the rights (I apply them to roles so that when we create another SQL Server user we just grant him/her rights to the role) and discover that the role has not been granted the rights. I seems to be occurring only with 2 of the procedures. Is there a known bug that might be causing this?
I have several DTS jobs that runs well as a job with my nt login account for the SQL agent service startup account, but if I use the System account they fail with this error. " Error opening datafile: Access is denied. Error source: Microsoft Data Transformation Services Flat File Rowset Provider"
The data has change access to the System account under the NT security.
I just inherited a SQL Server that was set up by a non-DBA. It`s running NT 4.0 and SQL Server 6.50 - 6.50.201 (the vendor hasn`t certified the product on SP4). I am trying to change the SQL Executive Service to use a non-system logon account. The account that I want to use is running SQL Executive on 9 other servers.
I went into Usrmgr and added the account to the administrators group. Made sure that it has rights to: log on as a service, log on as a batch job, increase quotas, act as part of the operating system, replace a process level token.
When I try to change to that id in services, I get the following error:
"cannot set the startup parameters for SQL Executive service. Error 1057 occurred. The account name is invalid or does not exist."
Looking in Technet, I found that if "log on as a service" isn`t set you could get this message but I`ve check/re-checked, had someone else check and it`s set.
TITLE: Connect to Server Cannot connect to MyPCName. ADDITIONAL INFORMATION: Login failed for user 'MyPCNameMyLogin'. Reason: The account is disabled. (MS Server, Error: 18470)
------------------------------ Server Name: MyPCName Error Number: 18470 Severity: 14 State: 1 Line Number: 65536
------------------------------ Program Location:
at System.Data.SqlClient.SqlInternalConnection.OnErro r(SqlException exception, Boolean breakConnection) at System.Data.SqlClient.TdsParser.ThrowExceptionAndW arning(TdsParserStateObject stateObj) at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj) at System.Data.SqlClient.SqlInternalConnectionTds.Com pleteLogin(Boolean enlistOK) at System.Data.SqlClient.SqlInternalConnectionTds.Ope nLoginEnlist(SqlConnection owningObject, SqlConnectionString connectionOptions, String newPassword, Boolean redirectedUserInstance) at System.Data.SqlClient.SqlInternalConnectionTds..ct or(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, Object providerInfo, String newPassword, SqlConnection owningObject, Boolean redirectedUserInstance) at System.Data.SqlClient.SqlConnectionFactory.CreateC onnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection) at System.Data.ProviderBase.DbConnectionFactory.Creat eNonPooledConnection(DbConnection owningConnection, DbConnectionPoolGroup poolGroup) at System.Data.ProviderBase.DbConnectionFactory.GetCo nnection(DbConnection owningConnection) at System.Data.ProviderBase.DbConnectionClosed.OpenCo nnection(DbConnection outerConnection, DbConnectionFactory connectionFactory) at System.Data.SqlClient.SqlConnection.Open() at Microsoft.SqlServer.Management.UI.VSIntegration.Ob jectExplorer.ObjectExplorer.ValidateConnection(UIC onnectionInfo ci, IServerType server) at Microsoft.SqlServer.Management.UI.ConnectionDlg.Co nnector.ConnectionThreadUser() ================================================== ====
