Error: "Login failed for user 'domain\computer$'. Reason: Token-based server access validation failed with an infrastructure error..." occurs in SQL logs

Products

• IT Management Suite
• IT Analytics

Issue/Introduction

The following error occurs frequently in the SQL logs, where "domain\computer" is the domain and computer of the Symantec Management Platform (SMP) server:

Login failed for user domain\computer$'. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors.

Environment

ITMS 8.x 

ITA 8.x

Cause

This is an unavoidable "error" if the SQL Server and SMP server are on different servers. The SMP install does not configure IIS to enable the computer account being used to access the SQL server without limitation for security purposes. This results in the "error". This will actually occur for any application that does not specifically do this, not just SMP, and therefore this is not a a situation that is solely caused by Altiris.

Note: If IT Analytics is installed, this is not caused by this product in any way, as described here.

Resolution

This "error" does not affect anything in Altiris nor the SQL Server, other than adding an entry when it occurs into the SQL Server logs.

Workarounds include:

• Add the SMP server computer name to the Administrators group on the SQL Server. As this then introduces security concerns, it is most mostly not a good tradeoff for the sole purpose of just to remove the "errors" in the SQL logs.
• In SQL, turn off Login Auditing. As this also disables seeing other login issues, this too is most likely not a good tradeoff.

Information on this can readily be found on Microsoft's web site. It is recommended to search Google or Microsoft's web page for the error to list many articles and discussions for this. For example:

Troubleshooting Login failed Error 18456

For additional information or assistance, please contact your local administrator or Microsoft.

Additional Troubleshooting

This may also occur if the SQL Server Analysis Server (SSAS) and SQL Server Reporting Server (SSRS) are not on the same SQL Server. Microsoft Kerberos will need to be installed if so, to enable the extra hop it takes to connect to the additional server. Information on configuring Microsoft Kerberos can be found here:

Does IT Analytics work with Microsoft Kerberos?