Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

SQL SPN issue - Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

moonb0w

hello guys need help on this issue

Background:

User experience error while browsing the web

Troubleshooting:

there is log on event viewer as well for netflow service (NTA)

check DB log showing same error is for all polling engines (main and additional)

I browsed the web that this might be due to SPN issue

2025-05-19 22:19:10.430 Server SQL Server is attempting to register a Service Principal Name (SPN) for the SQL Server service. Kerberos authentication will not be possible until a SPN is registered for the SQL Server service. This is an informational message. No user action is required.
2025-05-19 22:19:10.440 Server The SQL Server Network Interface library could not register the Service Principal Name (SPN) [ MSSQLSvc/CBTCNBSLWDB01 ] for the SQL Server service. Windows return code: 0xffffffff, state: 63. Failure to register a SPN might cause integrated authentication to use NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies and if the SPN has not been manually registered.
2025-05-19 22:19:10.440 Server The SQL Server Network Interface library could not register the Service Principal Name (SPN) [ MSSQLSvc/CBTCNBSLWDB01:1433 ] for the SQL Server service. Windows return code: 0xffffffff, state: 63. Failure to register a SPN might cause integrated authentication to use NTLM instead of Kerberos. This is an informational message. Further action is only required if Kerberos authentication is required by authentication policies and if the SPN has not been manually registered.

Issue:

To resolve SPN issue need to register the SPN either manually or automatically using setspn command, but since our servers is not joined to AD the setspn command is not working
Any ideas on how to get around this issue? or is there any other workaround?

Find more posts tagged with

anonymous

sql

nt authority

npm

Accepted answers

All comments

vinay.by

Does this always happen for that user ? or n number of users ?

I am not sure about the SPN but if you have pinned it down to that - maybe continue your investigation.

This is also caused because of max pool size on the DB, you can increase that post discussion with SolarWinds customer support (as well check on connect timeout and load balance timeout).

You can as well set a session timeout for the users - under Web console settings - update the session timeout so that user inactivity after that many minutes will logout the session. It often is the practise that most users donot click on logout button once they are done with their activity and try to use the same console once they back.

You should as well have a maintenance window on your solarwinds servers to reboot them once in a while - if there are any issues with SolarWinds services those would be back to normal.

Lastly check how many concurrent users do you have accessing the console - if there are too many you might want to think about AWS (Additional Web Servers to take off the load)

Hope this helps, I might not be on target in providing a solution but these are the generic checks that needs to be performed.

moonb0w

hi,
thanks for replying

- if due to DB connection timeout issue why there is this user 'NT AUTHORITY\ANONYMOUS' try to logon? i don't see the relation

- web session timeout already reduced to 8min long time ago, again I don't see the relation with that particular user tries to logon plus the NTA service on windows event manager also showing the same error log so not related with web service only

- we have monthly patching so these servers are also rebooted

- for the additional web server yes I see high usage for the IIS for a while, this is different case is not related with the issue user NT authority\anonymous tries to logon

these are the references why I suspect SPN issue

NT AUTHORITY \ ANONYMOUS LOGON Error :: SQLAdm.in — PowerShell and SQLServer
Resolved: Login failed for user NT AUTHORITY\ANONYMOUS LOGON - Delegation Step-by-Step - Eitan Blumin's blog

any help is really appreciated

maciej.sandecki

Since you mentioned your servers are not joined to the AD then I don't see how you could use Integrated Security (with Kerberos Delegation) at all. Same is mentioned in the first link you sent - all servers need to be in the same domain. I guess you should use SQL Authentication instead.

moonb0w

I thought the same too but for NTA it's already using SQL auth yet showing the same log on the windows event viewer
NPM still using windows authentication

there is no requirements mentioned that windows need to be joined to AD

maciej.sandecki

For Kerberos Delegation all elements (client - server - DB) need to be in the same domain or forest.

Maybe a small detail, but in the Netflow error messages I see 'Initial Catalog = SolarwindsOrion' which may suggest that Netflow is trying to access the main Solarwinds database, not the Netflow database and then it's using the Integrated Security configured for Orion (Solarwinds Platform)?

Lofstrand

I strongly suggest that you use SQL authentication here instead of windows/integrated authentication. As the servers are not domain joined. And as @maciej.sandecki says, without domain you can't use Kerberos and thus SPN is of no interest.

Run the config wizard again, make sure that you use SQL authentication and that the correct databases are used for each part.

ronan.tonilon

Disclaimer:
The content posted herein are provided as a suggestion or recommendation to you for your internal use. The information set forth herein may come from third party website or customers. SolarWinds is not liable for any downtime or any issue that may occur if you perform the following suggestions on the link provided. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment.
Please try this first in a lab environment, before implementing to your production.

You can open a support ticket to get insights, but please take note of our Working with Support Policy, customizations are not supported especially if this would involved custom scripts or queries, support can assist in a best effort practice since our support team is intended as a break fix support.

Common causes:

Kerberos delegation issue (most common).
SolarWinds Orion services or IIS app pools configured incorrectly (running as Local System).
SQL Server authentication mode incorrectly configured.
SPNs (Service Principal Names) misconfiguration.
DNS resolution issues causing Kerberos fallback to NTLM and then to anonymous.

Immediate Workaround that can be tried:

NOTE: If you have High Availability, please make sure to disable it globally. before following any steps
Use SQL Authentication rather than Windows Authentication for Orion’s database connection—this bypasses Kerberos altogether and usually resolves the immediate problem.

Can follow the troubleshooting steps below:

Verify Orion Database Connection Configuration
- Open SolarWinds Database Manager or Configuration Wizard.
- Check your database connection settings:
  - Recommended: Use SQL Authentication (with dedicated SQL account).
  - If using Windows Authentication, ensure the Orion services and IIS app pools run under an appropriate domain service account.
Ensure Correct Service Account Usage
Recommended Practice:
Use a dedicated domain account (e.g., DOMAIN\SolarWindsSvc) to run Orion services and IIS Application pools.
- Go to Windows Services (services.msc).
- Locate Orion services (e.g., SolarWinds Orion Module Engine, SolarWinds Information Service, etc.).
- Set the Log On identity to your domain service account, then restart all services.
- Also, verify IIS:
  - Open IIS Manager (inetmgr)
  - Expand Application Pools
  - Find "SolarWinds Orion Application Pool", right-click and select Advanced Settings
  - Under Identity, specify the same domain account.
Validate SQL Server Authentication Mode
- Launch SQL Server Management Studio (SSMS).
- Right-click on your SQL server → Properties → Security tab.
- Ensure the server is set to "SQL Server and Windows Authentication mode".
Verify SPN (Kerberos) Configuration (If using Windows Authentication)
This is critical if using Windows Authentication:
- Run the following from an admin CMD prompt to check SPNs:
```
setspn -L DOMAIN\SolarWindsSvc
```
- You should see entries like:
```
MSSQLSvc/:1433 MSSQLSvc/:1433
```
- If not listed, register them using:
```
setspn -S MSSQLSvc/sqlserver.domain.com DOMAIN\SolarWindsSvc setspn -S MSSQLSvc/sqlserver DOMAIN\SolarWindsSvc
```
- Restart Orion services afterward.
Verify DNS Resolution and Server Time
- Verify forward/reverse DNS resolution for your Orion and SQL Server hosts:
```
nslookup sqlserver.domain.com
nslookup orionserver.domain.com
```
- Ensure Orion and SQL servers have synchronized clocks (within 5 minutes).

After the above troubleshooting, check Orion Web Console if operation is normal now. If not, do either:

Restart SolarWinds services via SolarWinds Platform Service Manager.
Or Restart the SolarWinds application server.

You can open a support ticket if issue persist, Provide screenshots of issue/error, date and time this was first encountered and SolarWinds diagnostics to expedite resolution.

Please take note of our Working with Support Policy, customizations are not supported especially if this would involved custom scripts or queries, support can assist in a best effort practice since our support team is intended as a break fix support.

Hope this helps.

moonb0w

you are correct that log it's not trying to access to NTA DB but instead NPM DB for some other kind of process
later I will switch to SQL auth and see

moonb0w

thanks for the info, but our servers is not joining any domain
for the IIS part which identity should I used? curretly is ApplicationPoolIdentity

for the service it's running under Local System account, I shouldn't change this right?

god, this much easier if it's running on linux