Post reply

Error - A call to 'LogonUserW' failed with error code: '1909'

  • March 25, 2022 at 12:06 pm

    #4005901

    I've recently started intermittently getting this error message after changing the password on the account the runs the SQL service. That particular account is also a sysadmin in SQL and the place it is occurring is when a stored procedure is executed using WITH EXECUTE AS (the service ID) to call xp_cmdshell. A credential is configured to make that happen and the password appears to be valid because it does work most of the time. The research I've done says that error code 1909 means the account is locked but it is in good standing in AD and, because it is intermittent, it makes it hard to troubleshoot. Terrible security practices aside (the application is in dev), has anyone experienced this before?

  • March 25, 2022 at 2:02 pm

    #4005939

    It sounds like you have to rebuild the "proxy" account to make it work.

    And using xp_CmdShell isn't a "terrible security practice".  Giving non-DBA users the privs to run it directly is.  Having it work only in immutable procs that low prived users have isn't an issue unless you fall into the trap similar to SQL-Injection.

     

    --Jeff Moden

    RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
    First step towards the paradigm shift of writing Set Based code:
    ________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.
    "Change is inevitable... change for the better is not".
    Helpful Links:
    How to post code problems
    How to Post Performance Problems
    Create a Tally Function (fnTally)
    Intro to Tally Tables and Functions

  • March 25, 2022 at 3:23 pm

    #4005979

    I'll delete the proxy and add it back to see if that fixes the issue. It's strange that it's intermittent though

  • March 25, 2022 at 6:05 pm

    #4006041

    RonMexico wrote:

    I've recently started intermittently getting this error message after changing the password on the account the runs the SQL service. That particular account is also a sysadmin in SQL and the place it is occurring is when a stored procedure is executed using WITH EXECUTE AS (the service ID) to call xp_cmdshell. A credential is configured to make that happen and the password appears to be valid because it does work most of the time. The research I've done says that error code 1909 means the account is locked but it is in good standing in AD and, because it is intermittent, it makes it hard to troubleshoot. Terrible security practices aside (the application is in dev), has anyone experienced this before?

    Unrelated to your issue, but important, why is the service account a sysadmin in SQL Server?  xp_cmdshell is not a terrible security practice, but having the service account be sysadmin certainly is.

    Michael L John
    If you assassinate a DBA, would you pull a trigger?
    To properly post on a forum:
    http://www.sqlservercentral.com/articles/61537/

Viewing 4 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic. Login to reply