T-SQL Tuesday #105: Brick Walls & Asking For Help

Welcome back to another edition of T-SQL Tuesday! This month’s edition is hosting by Wayne Sheffield (b|t), who asks participants to blog about a time they hit a brick wall.  Funny enough, I feel like I’m up against a brick wall, with everything going on in my life right now!  Was challenging enough to try to find the time to write this blog, but that’s another story for another time.

Flashback

A couple of years ago, when I was in an Operational DBA role, we were faced with a division wide domain change effort due to an acquisition.  We had numerous SQL Servers that had to be flipped from Domain A to Domain B.  Before this, I never even dabbled in Active Directory, so all of this was completely new to me.  We didn’t even have an Active Directory specialist on our Ops team (those folks were remaining behind in the acquisition), so we had to bring in a consultant to help us (who was awesome by the by).  We were doing things in a phased, but very rushed timeframe, so had little time to prepare, much less train up.

Leaving out names to protect the innocent (hah), we cut over our first set of Production servers.  Then I started seeing an error that I’ve since come to dread:

“Cannot generate SSPI context”

What… the… ?!

Kerberos Double Hop

I may have created this meme out of frustration… and may have tweeted it out too

To make a long story short, this had to do with Kerberos and the new domain service account that SQL Server was running under.  But I didn’t know that then, and this became my brick wall.

Much Google-fu and cursing later, I finally started getting somewhere, finding some articles on the topic.  This one in particular had context, though I still didn’t understand the underlying issue.  But what I did notice, at the very end of the article, was what saved my bacon.

“Posted By: Adam Saxton”

Hey, wait a minute.  I’ve met Adam in passing at some event or other.  I think I follow him on Twitter too!  So I took a chance and reached out to him.  That resulted in an e-mail exchange, where he pointed me to other resources about Kerberos & SQL Server, and helped me and my Ops team fully understand the issue.  He answered questions and was a phenomenal resource, that saved by team’s bacon!  I was blown away.  Adam, a guy at Microsoft, was directly answering questions and helping us out for free.  My non-SQL Server Ops colleagues were also equally impressed and grateful for his insight and guidance!

Moral of the Story

If you’ve hit a brick wall, absolutely do your due diligence and try to find the answer, but don’t be afraid to also reach out and ask for help – even from “big guns” at Microsofth.  You can only go it alone for so long, before the time burned searching for the right answer outweighs the consequences of not asking sooner or asking too soon.  #SQLFamily is here to help!

Cannot generate SSPI context – TL;DR

P.S. If you came upon this blog because you were searching on that SSPI error message, do yourself a favor and grab the Kerberos Configuration Manager tool for SQL Server.

Advertisement