SSPI Handshake Failed

This error can occur with AppInsight for SQL is unable to connect to the remote SQL server. One of the retry mechanisms is try different authentication methods when it is unable to connect. These attempts can result in errors like these appearing in the event log.

This was actually related to the monitoring user being disabled several days prior.  Though it did not start immediately, a reboot of Orion fixed the issue.

SSPI handshake failed with error code 0x8009030c, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure. The logon attempt failed   [CLIENT: xx.xx.xx.xx]

and then these:

We are constantly getting this message and solarwinds support has almost given up trying to help us.  Is this message from the Windows attempt or the SQL local attempt?

cfizz34​, can we assume you're seeing these errors in the SQL error log, or are they appearing in AppInsight for SQL? When these errors occur, is AppInsight for SQL collecting data and reporting it accurately, or is polling broken? 

yes, this occurs in the 'SQL Error Log' and causes the DBA's to get alerts which they have about had enough and they asked us to pull the plug on AppInsight for SQL.  Polling usually returns the correct data but we do get a lot of unknowns as well and the constant SSPI alerts..

I've even tried applying this tip and setting the value to 1 but it did not help.

WMI on Windows Server 2012

DESCRIPTION:   SSPI
handshake failed with error code 0x8009030c, state 14 while establishing a connection
with integrated security; the connection has been closed. Reason:
AcceptSecurityContext failed. The Windows error code indicates the cause of
failure. The logon attempt failed  

One thing that is interesting is that from time to time as well certain databases that were polling correctly change to UNKNOWN yet other databases on the same instance are reporting fine.

BTW, we are using AAG's with multiple AAG's on the same instance with multiple listeners, one listener per AAG.

  few minutes later....

These errors should only occur when there is a polling issue collecting data from AppInsight for SQL. A fallback mechanism is used to revert to the secondary authentication mechanism in the event we are unable to connect using the primary authentication method.

We are able to work around the issue by changing the polling service account that we use for everything else to the same service account running the SQL server service.

Can we disable the secondary authentication mechanism?  It looks like we are experiencing a timeout for the Top Indexes for Database with the local SQL account which is then trying the backup authentication triggering this error.

What is odd in our case is that this is happening when we are monitoring the Orion DB itself with SQL AppInsight. The local SQL account we use which is the same one that we use with the config wizard. The password and account has never changed.