nt service account logon failure

_{Friday, August 26, 2016 2:04 AM}

I've installed SQL Server 2016 on Win 10 laptop for testing and development use.  After restarting the pc the sql services do not restart.  They have a login failure, and if if delete the password for each service, the password is repopulated automatically and then I can start the service. 

The user name of the SQL Server service is "NT Service\MSSQLSERVER"

Any thoughts on how to make these passwords stay?

_{Friday, August 26, 2016 5:07 AM ✅Answered}

Hi There,

NT Service\MSSQLSERVER is a built in system account. you can not set or reset the password for it.

create a user account with admin permissions on your laptop then you can use this account to start your service.

Hope this will fix your issue.

Good luck

Kumar

_{Friday, August 26, 2016 2:21 AM}

understand the sql database server local logins-they comes by default when the setup runs and there is no password that we can get it,this is by design & that account plays some functionalities-

The following table lists examples of virtual account names.

if you needed you can use the local system-try it.

start->services.msc->select your sql instance(default(or) named instance ->the perform as above.

you can also do from sql server configuration manager-

Regards, S_NO "_"

_{Friday, August 26, 2016 2:25 AM}

Also can you do one thing- 

They have a login failure, and if if delete the password for each service, the password is repopulated automatically and then I can start the service. 

>>Just remove the password and leave it to blank then click OK & see -is that works for you?.

Regards, S_NO "_"

_{Friday, August 26, 2016 6:16 AM}

The issue is not with the passwords as these accounts are "virtual accounts" and do not have user settable passwords.

Have you checked whether the services are set to automatically start or are they manual start?  If they are manual then they will not start automatically on a restart.

If the virtual accounts are having a login failure then you have something odd in your configuration. Where are you seeing the login failure?  Can you post more information around this to identify which account and what reason for the login failure (you may also need to check the Windows Security and Application logs for more info).

There may be some issues with Security Rights assignments but without the specifics it is hard to tell

Martin Cairney SQL Server MVP

_{Monday, August 29, 2016 10:45 AM}

I've now set this to run under some domain accounts that some other sql servers are using, as it seems too hard to stick with these "virtual accounts"

this was the error when using "virtual accounts"

Log Name:      System
Source:        Service Control Manager
Date:          29/08/2016 5:18:34 PM
Event ID:      7041
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      Computer.domain.local
Description:
The MSSQLSERVER service was unable to log on as NT Service\MSSQLSERVER with the currently configured password due to the following error:
Logon failure: the user has not been granted the requested logon type at this computer.
 
Service: MSSQLSERVER
Domain and account: NT Service\MSSQLSERVER
 
This service account does not have the required user right "Log on as a service."
 
User Action
 
Assign "Log on as a service" to the service account on this computer. You can use Local Security Settings (Secpol.msc) to do this. If this computer is a node in a cluster, check that this user right is assigned to the Cluster service account on all nodes in the cluster.
 
If you have already assigned this user right to the service account, and the user right appears to be removed, check with your domain administrator to find out if a Group Policy object associated with this node might be removing the right.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
    <EventID Qualifiers="49152">7041</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2016-08-29T09:18:34.833204800Z" />
    <EventRecordID>9532</EventRecordID>
    <Correlation />
    <Execution ProcessID="924" ThreadID="1272" />
    <Channel>System</Channel>
    <Computer>Computer.domain.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">MSSQLSERVER</Data>
    <Data Name="param2">NT Service\MSSQLSERVER</Data>
  </EventData>
</Event>

_{Monday, August 29, 2016 12:46 PM}

Hello,

NT Service\MSSQLSERVER -This is not the domain account(domain account would be like <your domain Nam(if your within the domain then contact  domain controller)>\xyz) & its an local virtual account "NT Service\MSSQLSERVER" 

see-

Configure Windows Service Accounts and Permissions
https://msdn.microsoft.com/en-us/library/ms143504%28v=sql.110%29.aspx?f=255&MSPPError=-2147217396#Serv_Perm

Incase if your server with thin the domain then you have to configure the new service account(at domain and add this account to sql with sysadmin) then  you need to contact the " policy for domain controllers team who manages the group policy,if you have accesses you can set it up".

so if you still you are going to use either local (or) domain then ensure-

follow this -Event ID 7041 — Service Start Operations
https://technet.microsoft.com/en-us/library/cc756354%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396

once they have added then please  change the service account using the SQL server configuration manager->

Using SQL Server Configuration Manager
https://msdn.microsoft.com/en-IN/library/ms345578.aspx

If you have already assigned this user right to the service account, and the user right appears to be removed, check with your domain administrator to find out if a Group Policy object associated with this node might be removing the right.

>>looks like the account has been removed from logon as a service by your domain controller (or) some one and grant the permission to logon as a service(you can also speak to windows admin- they will help with domain team(if they exists).

Incase if you still use the  NT Service\MSSQLSERVER this will be like local account & in 

start->services.msc->select the service->right click->under log on -just give the name & leave the blank password for the same.

Regards, S_NO "_"