The SSPI context error definitely indicates authentication is being attempted using Kerberos.
Since Kerberos authentication SQL Server’s Windows Authentication relies on Active Directory, which requires a trusted relationship between your computer and your network domain controller, you should start by validating that relationship.
You can quickly check that relationship, thru the following Powershell command Test-ComputerSecureChannel.
Test-ComputerSecureChannel -Verbose

If it returns False, you must repair your computer Active Directory secure channel, since without it no domain credencials validation is possible outside your computer.
You can repair your Computer Secure Channel, thru the following Powershell command:
Test-ComputerSecureChannel -Repair -Verbose
If the above doesn’t work (because your domain credentials don’t work because the machine isn’t trusted) you can use NETDOM RESET instead from an elevated cmd.exe (not PowerShell) prompt:
NETDOM RESET %COMPUTERNAME% /UserO:domainAdminUserName /Password0:* /SecurePasswordPrompt
(Yes, the command-line arguments really do have an O (Capital-«Oh», not zero 0). The /Password0:* /SecurePasswordPrompt option will use a credential popup instead of having you put your password directly in the command-line, which you must never do).
Check the security event logs, if you are using kerberos you should see logon attempts with authentication package: Kerberos.
The NTLM authentication may be failing and so a kerberos authentication attempt is being made. You might also see an NTLM logon attempt failure in your security event log?
You can turn on kerberos event logging in dev to try to debug why the kerberos is failing, although it is very verbose.
Microsoft’s Kerberos Configuration Manager for SQL Server may help you quickly diagnose and fix this issue.
Here is a good story to read: http://houseofbrick.com/microsoft-made-an-easy-button-for-spn-and-double-hop-issues/
The SSPI context error definitely indicates authentication is being attempted using Kerberos.
Since Kerberos authentication SQL Server’s Windows Authentication relies on Active Directory, which requires a trusted relationship between your computer and your network domain controller, you should start by validating that relationship.
You can quickly check that relationship, thru the following Powershell command Test-ComputerSecureChannel.
Test-ComputerSecureChannel -Verbose

If it returns False, you must repair your computer Active Directory secure channel, since without it no domain credencials validation is possible outside your computer.
You can repair your Computer Secure Channel, thru the following Powershell command:
Test-ComputerSecureChannel -Repair -Verbose
If the above doesn’t work (because your domain credentials don’t work because the machine isn’t trusted) you can use NETDOM RESET instead from an elevated cmd.exe (not PowerShell) prompt:
NETDOM RESET %COMPUTERNAME% /UserO:domainAdminUserName /Password0:* /SecurePasswordPrompt
(Yes, the command-line arguments really do have an O (Capital-«Oh», not zero 0). The /Password0:* /SecurePasswordPrompt option will use a credential popup instead of having you put your password directly in the command-line, which you must never do).
Check the security event logs, if you are using kerberos you should see logon attempts with authentication package: Kerberos.
The NTLM authentication may be failing and so a kerberos authentication attempt is being made. You might also see an NTLM logon attempt failure in your security event log?
You can turn on kerberos event logging in dev to try to debug why the kerberos is failing, although it is very verbose.
Microsoft’s Kerberos Configuration Manager for SQL Server may help you quickly diagnose and fix this issue.
Here is a good story to read: http://houseofbrick.com/microsoft-made-an-easy-button-for-spn-and-double-hop-issues/
I am working on a .NET application where I am trying to build the database scripts. While building the project, I am getting an error «Cannot create SSPI context.». This error is shown in the output window (inside VS2008 screen) and the building process failed. Please help on this. SQL Server is configured to work on Windows authentication & running as network service (these two things are must for my project).
Please help on this. This error is not seems to be consistent. It was fixed in the past by restarting the machine, changing the system time to match the domain time and some suggestions in the net. Please help on this.
![]()
Brian Webster
29.6k48 gold badges150 silver badges224 bronze badges
asked Nov 28, 2009 at 13:41
2
It sounds like your PC hasn’t contacted an authenticating domain controller for a little while. (I used to have this happen on my laptop a few times.)
It can also happen if your password expires.
![]()
Tony L.
16.8k8 gold badges68 silver badges65 bronze badges
answered Nov 28, 2009 at 13:48
![]()
Jeremy McGeeJeremy McGee
24.6k10 gold badges62 silver badges95 bronze badges
7
It’s quite a common error with a variety of causes: start here with KB 811889
- What version of SQL Server?
- And Windows on client and server?
- Local or network SQL instance?
- Domain or workgroup? Provider?
- Changing password
- Local windows log errors?
- Any other apps affected?
answered Nov 28, 2009 at 13:48
gbngbn
417k81 gold badges581 silver badges670 bronze badges
3
This error usually comes when the Windows user account is expired and he is already logged in with old password.
Just ask the user to restart his machine and check if the password is expired or he has changed the password.
Hope this helps!!!!!
answered Sep 13, 2016 at 10:17
![]()
I had the same issue after changing the user which was running the MSSQLSERVER-Service
To solve incorrect SPNs with SQL Server I used this tool
http://www.microsoft.com/en-us/download/details.aspx?id=39046 — Microsoft® Kerberos Configuration Manager for SQL Server
In my case it worked pretty well.
answered Dec 24, 2014 at 22:24
Erik MandkeErik Mandke
1,5773 gold badges23 silver badges30 bronze badges
First thing you should do is go into the logs (ManagementSQL Server Logs) and see if SQL Server successfully registered the Service Principal Name (SPN). If you see some sort of error (The SQL Server Network Interface library could not register the Service Principal Name (SPN) for the SQL Server service) then you know where to start.
We saw this happen when we changed the account SQL Server was running under. Resetting it to Local System Account solved the problem. Microsoft also has a guide on manually configuring the SPN.
answered Mar 19, 2014 at 12:23
AndrewAndrew
8,9328 gold badges45 silver badges58 bronze badges
1
If you are hosting on IIS, make sure the password for the AppPool account has not changed.
If it has, then follow these steps:
- Go to IIS
- Click on Application Pools
- Select the AppPool of your application
- Right Click on your AppPool
- Advanced settings
- Identity
- Update Password
- Restart AppPool
![]()
caesay
16.7k14 gold badges96 silver badges158 bronze badges
answered Oct 16, 2015 at 19:09
![]()
MaheshMahesh
3,5471 gold badge39 silver badges48 bronze badges
0
I resolved my Cannot Generate SSPI Context error by using the SQL Server Configuration Manager. Since I have SQL Server native client 10.0 on my machine, the connection to the server is trying to use named pipes (or shared memory?). Other machines could run my app with no problem. When I looked at the configuration manager, named pipes and shared memory were both enabled (good). However, under alias, the name of the computer was there with TCP forced. Since I didn’t know what effect changing this would have, I changed the connection string in my program to use <servername>.<domainname> instead. Fixed.
![]()
Adi Inbar
11.8k13 gold badges54 silver badges69 bronze badges
answered Dec 7, 2012 at 21:29
1
The «Cannot Generate SSPI Context» error is very generic and can happen for a multitude of reasons. Is just a cover error for any underlying Kerberos/NTLM error. Gbn’s KB article link is a very good starting point and usualy solves the issues. If you still have problems I recommend following the troubleshooting steps in Troubleshooting Kerberos Errors.
answered Nov 28, 2009 at 17:34
Remus RusanuRemus Rusanu
285k40 gold badges429 silver badges564 bronze badges
I also issued this problem, and the server admins solved it by following the same solution as indu_teja proposed in http://www.sqlservercentral.com/Forums/Topic546566-146-1.aspx
The solution proposed by indu_teja says :
If you get this «SSPI Context Error». The issues we face are:
- We will not be able to connect to SQL Server remotely.
- However we will be able to connect to server with local account.
CAUSE: The issue might be becasue of no proper sync happenign fro the
SPNs in Active directory.RESOLUTION:
- You need to reset SPN. Use the synytax «SET SPN». You can check the syntax in net once.
- Change your sql server service account from domain account to Local account, recycle sql, and then reset again with your domain account and recycle sql server.
answered Sep 19, 2013 at 19:05
![]()
I just had the same problem and all I did was delete the user log in credentials in sql server using another user id and adding them back.
answered Oct 14, 2013 at 11:19
Here is my case. I had a remote machine that hosted SQL Server. From my local machine, I was trying to access the SQL instance via some C# code and I was getting this error. My password for the user account on my machine/domain had expired. I fixed it with the following:
- Opened the remote machine, which prompted me for a password change
- I changed my password within this prompt and logged into the remote machine
- I «locked» my local machine (using
windows+Lkey so I didn’t have to completely sign off) so that I could get back to the sign-on page - I signed back onto my local machine with the new password
Everything then worked fine.
answered Aug 10, 2016 at 19:53
![]()
AlbatrossCafeAlbatrossCafe
1,6826 gold badges25 silver badges49 bronze badges
In my case it was a missing SPN, had to run these two commands:
setspn -a MSSQLSvc:SERVERNAME SERVERNAME
setspn -a MSSQLSvc:SERVERNAME:1433 SERVERNAME
In other words in my case I had the FQDN in there already correctly but not just the NETBIOS name, after adding these it worked fine. Well initially it didn’t but after waiting 2 minutes it did.
answered Aug 31, 2016 at 13:21
![]()
ebooyensebooyens
6083 gold badges9 silver badges21 bronze badges
I had this error- it happened because my password expired and I had to change it. I didn’t notice it, because in some programs I could still log in and everything would work normally (including windows), but I couldn’t log to any sql servers.
answered May 8, 2017 at 7:39
XyzkXyzk
1,3222 gold badges21 silver badges35 bronze badges
Perhaps you have used Integrated Security = SSPI in connection string. SSPI is used for Trusted connections using Windows Authentication.hence, to work properly in windows authentication, either your system and database server should be in same domain and using same DNS server address, or should be in trusted domain.
if your system and database server is in same domain, Check DNS server address of IPV4 properties in your system’s network connection and provide same DNS server being used by database server.
answered Jun 29, 2018 at 13:13
![]()
In vb.net, if you are using a linked server than check your connection string. Integrated Security=true; doesn’t work in all SQL providers, it throws an exception when used with the OleDb provider. So basically Integrated Security=SSPI; is preferred since works with both SQLClient & OleDB provide. If you still hit with error, remove the syntax completely.
answered Apr 4, 2019 at 14:49
I can able to get this resolved by resetting the domain (server machine, which is the domain server, but not related to SQL Server except domain managing) followed by the client machines.
Thank you all for your immediate support!
answered Nov 29, 2009 at 9:26
PrasannaPrasanna
7602 gold badges6 silver badges16 bronze badges
Had a really weird instance of this; All the web products that had connection strings containing the windows computer name of the SQL server worked fine, but the products that had a FQDN with the internal domain attached gave an SSPI error.
i.e.
COMPUTERNAME
vs
COMPUTERNAME.DOMAIN
(ping always worked as expected)
This ONLY gave problems when a new SQL server was being used and hosts files pointed both the computer name and the computername as a FQDN for the connection strings.
Solution in this case was to set all the connection strings to the computer name only, removing the domain references.
SQL : 2008R2 SQL2012
IIS : 2008R2
answered Jan 21, 2014 at 11:12
robrob
7,9608 gold badges58 silver badges68 bronze badges
We had this issue on instances in which we changed the service user from Domain1ServiceUser to Domain2ServiceUser. The SPNs remained registered under Domain1ServiceUser, and never registered under Domain2ServiceUser. We registered the SPNs under Domain2ServiceUser, but the issue persisted. We then removed the SPNs under Domain1ServiceUser, and the issue was resolved.
answered Jul 3, 2019 at 14:31
1
In case you are running a code not written in your computer, that runs in a computer used by your work peer, but not in yours, check the web.config.
Maybe there is your colleague’s name as userPrincipalName at some place that should be in blank. That happens automatically when we create a service reference to the project in VS.
answered Jul 10, 2019 at 12:11
I am able to solve it by running the following commands.
Run CMD in admin mode
klist.exe -li 0x3e7 => if you see no output or error then continue and from last command try these commands once again.
klist.exe -li 0x3e7 purge
gpupdate /force
gpresult /r /scope computer
klist purge
runas /user:[your domain here][your user name here] cmd.exe
klist.exe sessions | findstr /i [your hostname here in the new opened cmd window]
Try again these commands depending upon the condition specified, and then restart your PC.
answered Feb 9, 2022 at 13:26
- Remove From My Forums
-
Question
-
Hi,
I just installed SQL one my box but I am unable to access SQL remotely while accessing remotely getting below error and services are running on domain account. As the services are running under domain account we have registered SPN (Service
principal name ). Is there any other way to get it resolve this issue.Registered SPN :
MSSQSLSvc/myserver:1433
MSSQSLSvc/myserver.domain1.com:1433ADDITIONAL INFORMATION:
The target principal name is incorrect. Cannot generate SSPI context. (Microsoft SQL Server, Error: 0)
Answers
-
-
Marked as answer by
Sunday, September 22, 2013 8:08 AM
-
Marked as answer by
-
-
Edited by
Candy_Zhou
Monday, September 16, 2013 9:12 AM
edit -
Marked as answer by
Allen Li — MSFT
Sunday, September 22, 2013 8:08 AM
-
Edited by
- Remove From My Forums
-
Question
-
Hi,
I just installed SQL one my box but I am unable to access SQL remotely while accessing remotely getting below error and services are running on domain account. As the services are running under domain account we have registered SPN (Service
principal name ). Is there any other way to get it resolve this issue.Registered SPN :
MSSQSLSvc/myserver:1433
MSSQSLSvc/myserver.domain1.com:1433ADDITIONAL INFORMATION:
The target principal name is incorrect. Cannot generate SSPI context. (Microsoft SQL Server, Error: 0)
Answers
-
-
Marked as answer by
Sunday, September 22, 2013 8:08 AM
-
Marked as answer by
-
-
Edited by
Candy_Zhou
Monday, September 16, 2013 9:12 AM
edit -
Marked as answer by
Allen Li — MSFT
Sunday, September 22, 2013 8:08 AM
-
Edited by
- Remove From My Forums
-
Question
-
Hi,
I just installed SQL one my box but I am unable to access SQL remotely while accessing remotely getting below error and services are running on domain account. As the services are running under domain account we have registered SPN (Service
principal name ). Is there any other way to get it resolve this issue.Registered SPN :
MSSQSLSvc/myserver:1433
MSSQSLSvc/myserver.domain1.com:1433ADDITIONAL INFORMATION:
The target principal name is incorrect. Cannot generate SSPI context. (Microsoft SQL Server, Error: 0)
Answers
-
-
Marked as answer by
Sunday, September 22, 2013 8:08 AM
-
Marked as answer by
-
-
Edited by
Candy_Zhou
Monday, September 16, 2013 9:12 AM
edit -
Marked as answer by
Allen Li — MSFT
Sunday, September 22, 2013 8:08 AM
-
Edited by