Microsoft SQL Server Error 15433, Level 16, State 1: Supplied parameter sid is in use

I have an AOAG configuration having two replicas in my environment which is set for Automatic failover. Last week, we had High Availability testing for all applications. Issue occurred when application team tried to connect to database server after failover. They were failed to connect to the secondary replica using Listener after failover whereas applications were working fine from primary replica. Issue came because SQL login which was used by application has different sid on secondary replica than the primary replica.

During fixing above issue, we came across an error about which we will be discussing in this post. One of the engineer has accidently created a wrong login with the same SID that we were about to use to create the application login to fix above issue. When we have tried to create application login we get below error.

Here i will explain step by step method to fix this SQL Server Error 15433.

Solution

Here i will reproduce this issue and then fix it in a step by step manner. So, final objective is to create a login with same name, password & sid on secondary replica to sync the login details of associated application. Let us first check the login sid of identified login on primary replica. Run below code to get it.

SELECT name, SID, createdate from syslogins
WHERE name='xyz'

Copy the SID of this login from above screen for further uses. Now connect to secondary replica and run below command to create same login with same password & sid. You can remove Check_Policy option if your login has password policy applied.

CREATE Login xyz WITH password = 'techy@z@123', Check_Policy=off, SID = 0x03981anjkhdvehh73964jbdbj783

Here we got the issue because someone has already created another login with same SID. Now our next step is to check that login which was created with this SID. Run below command on secondary replica to get this done.

SELECT name, SID, createdate from sysloginswhere SID = 0x0398manjkhdvehh73964jbdbj783

We can see the login name which was created under given SID. We have to created application login with same SID to establish application connectivity to database after failover so we will drop this Login and recreate application login with this SID. Later we can create deleted login which will have different SID. If not needed you should not create unwanted logins on SQL Server. Run below command to drop this login.

--Change login name with login.
DROP Login login

SSMS way to drop a login is given in below steps:

• Connect to target SQL Server Instance.
• Expand the security folder.
• Expand the Logins folder.
• Right click and choose delete on the identified login which needs to be deleted.
• Click on Ok button of the login deletion window.

You might get multiple dependency errors during dropping this login because there is possibility this login might own few objects, agent jobs or databases on this instance if it was created long before. You can read below articles to fix such kind of issues if you will face any.

• How to fix Error 15174: Login owns one or more databases.
• How to fix  Error 15173: Revoke the permissions before dropping the login.
• Fixing error 15138 & Error 3729: DROP login failed
• Error 15141: The server principal owns one or more endpoint(s) and cannot be dropped
• How to fix error 15170: Login owns one or more SQL Agent Jobs.

Now once this login will be dropped, you will be able to create your application login with required SID. You can see that in below screen.

CREATE Login xyz WITH password = 'techy@z@123', Check_Policy=off, SID = 0x03981anjkhdvehh73964jbdbj783

We can see command executed successfully. Now issue is fixed here.

I hope you like this article. Please follow us on our facebook page and on Twitter handle to get latest updates.

The post Fix SQL Server Error 15433, Level 16, State 1: Supplied parameter sid is in use appeared first on Techyaz.com.

If you are facing different kind of DROP login failed errors, you can read below articles where i have demonstrated step by step method to fix the various kind of DROP login failed errors:

• How to fix Error 15174: Login owns one or more databases.
• How to fix Error 15173: Revoke the permissions before dropping the login.
• How to fix error 15138 & Error 3729: DROP login failed
• How to fix error 15141: The server principal owns one or more endpoint(s) and cannot be dropped
• How to fix error 15434: Could not drop login as the user is currently logged in

Microsoft SQL Server Error 15170

I had to remove a SQL login on one of SQL Server instance where AlwaysOn Availability Group is configured and running. We need to remove this login and recreate it with the same SID which are present on primary replica to fix an AOAG Automatic failover issue. Login was failed to drop because of SQL Server error 15170 which suggests that this login owns one or more SQL Server Agent jobs. Error details are given below.

As error clearly says, that one or more Agent jobs are owned by this login so let us check the details about it. Expand SQL Server Agent followed by Jobs folder of your SQL Server Instance connected in SSMS. You can see below jobs were there on SQL Server Instance.

Solution

Now check the properties of these agent jobs to check the job owner. Double click on identified agent job. You will get below image. Here you can see job owner is showing as same account which we are trying to drop. Change it to sa and click on ok button to apply the change. Repeat the same to the all three agent jobs.

Now owner of agent jobs is changed to sa. Next step is to go ahead and drop the login again. you can do it by either SSMS or T-SQL. SSMS way is given below:

• Connect to target SQL Server Instance.
• Expand the security folder.
• Expand the Logins folder.
• Right click and choose delete on the identified login which needs to be deleted.
• Click on Ok button of the login deletion window.

If you want to drop this login using T-SQL command then open a query window and execute below command.

--change the name of Login_name with your login name which you want to delete.
DROP Login 'LOGIN_NAME'

This time your login will be dropped successfully. If you are still facing some another issue during dropping this login, you can read below articles where i have demonstrated step by step method to fix the DROP login failed errors:

• How to fix Error 15174: Login owns one or more databases.
• How to fix Error 15173: Revoke the permissions before dropping the login.
• How to fix error 15138 & Error 3729: DROP login failed
• How to fix error 15141: The server principal owns one or more endpoint(s) and cannot be dropped

Here, we have fixed Microsoft SQL Server error 15170. I hope you like this article. Please follow us on our facebook page and on Twitter handle to get latest updates.

The post Fix SQL Server Error 15170: Login owns one or more Agent Jobs appeared first on Techyaz.com.

If you are facing different kind of DROP login failed errors, you can read below articles where i have demonstrated step by step method to fix the various kind of DROP login failed errors:

• How to fix Error 15174: Login owns one or more databases.
• How to fix Error 15173: Revoke the permissions before dropping the login.
• How to fix error 15138 & Error 3729: DROP login failed
• How to fix Error 15141: Server principal owns one or more endpoints.

Microsoft SQL Server Error 15434

This error generates when a login has made a connection to the SQL Server Instance and you are trying to drop the same login. Solution to fix this issue is to close all sessions which are opened by this login and then drop it. You can get the details about the sessions which are open using this login id either by sp_who2 or by DMV sys.dm_exec_sessions.

I had to remove a domain login on one of SQL Server instance but login was failed to drop because of SQL Server error 15434 which suggests that the login is currently logged in. Error details are given below.

Drop failed for Login “domain\abc”
Could not drop login ‘domain\abc’ as the user is currently logged in. (Microsoft SQL Server, Error: 15434)

As error clearly says that above login is currently logged in. Run below T-SQL code to get the details about the sessions or connections this login has made to the SQL Server Instance.

SELECT login_name, * FROM sys.dm_exec_sessions
WHERE login_name = 'xyz\abc'
Go

You will see the details for this login along with the session id in below screenshot.

Solution

Now we have identified the session id which are running using this login id which we want to drop. Now next step is to kill this session. Make sure to check the SQL code running behind this session id. If it is not critical go ahead and drop the login or if any DML or other operations are running about which you are not aware of, please contact application owners to get the details about this session id. Don’t kill any session id that you are not aware of. Now go ahead and kill above session which is running using our login id. I am going ahead to kill this session because i know what is running under this session which is not critical.

--Replace the session id 53 with your session id.
Kill 53
GO

We can see command executed successfully. You can recheck whether this session is still open or not by executing same command which we have executed in first section.

We can see, session id 53 is no more active and disappeared from the SQL Server transactions. Next step is go ahead and drop the login again. This time your login will be dropped successfully.

If you are still facing same issue during dropping the login and get this error again then you can check SQL Server services log on accounts. Sometimes if you run SQL Server services using the account which you want to drop throws same error. If this is the case then your next step is to change the logon account to some other domain account to release this login. You can see this in below image. Change the log on account of all SQL Server services if they are running using this account. Once you made the changes to the services, restart SQL Server service to bring new account in use by SQL Server.

Now go ahead and drop the account again. This time it will work and your login will be removed. You will not face Microsoft SQL Server Error 15434 anymore. You can do it by either SSMS or T-SQL. SSMS way is given below:

• Connect to target SQL Server Instance.
• Expand the security folder.
• Expand the Logins folder.
• Right click and choose delete on the identified login which needs to be deleted.
• Click on Ok button of the login deletion window.

If you want to drop this login using T-SQL command then open a query window and execute below command.

--change the name of Login_name with your login name which you want to delete.
DROP Login 'LOGIN_NAME'

If you are getting some another issue during dropping this login, you can read below articles where i have demonstrated step by step method to fix the DROP login failed errors:

• How to fix Error 15174: Login owns one or more databases.
• How to fix Error 15173: Revoke the permissions before dropping the login.
• How to fix error 15138 & Error 3729: DROP login failed
• How to fix Error 15141: Server principal owns one or more endpoints.

I hope you like this article. Please follow us on our facebook page and on Twitter handle to get latest updates.

The post Fix SQL Server Error 15434: Could not drop login ‘Domain\abc’ as the user is currently logged in appeared first on Techyaz.com.

If you are facing different kind of DROP login failed errors, you can read below articles where i have demonstrated step by step method to fix the various kind of DROP login failed errors:

• How to fix Error 15174: Login owns one or more databases.
• How to fix Error 15173: Revoke the permissions before dropping the login.
• How to fix error 15138 & Error 3729: DROP login failed

Microsoft SQL Server Error 15141

I had to remove a domain login on one of SQL Server instance where AlwaysOn is configured and running. Login was failed to drop because of Microsoft SQL Server error 15141 which suggests that this login owns one or more endpoints. Error details are given below:

Drop failed for Login “Login Name”
The server principal owns one or more endpoint(s) and cannot be dropped. (Microsoft SQL Server, Error:15141)

As error clearly says that one or more endpoints are owned by this login so let us check the details about endpoints. Run below T-SQL code to get the details of endpoint.

SELECT n.name, a.*  FROM sys.endpoints a
inner join sys.server_principals n on a.principal_id=n.principal_id
Go

You will see the endpoint details in below screenshot along with the login id who owns the endpoint. I have blured it because of privacy.

Solution

As we can see that endpoint is owned by this login so now we will change the owner of this endpoint to break the dependency which are the main reason behind this SQl Server error 15141. Now next step is to change the owner to some another login. You can also transfer the ownership to system account sa.

We will use ALTER Authorization statement to transfer ownership of this endpoint from existing server level login to some another server level login. We can not set the ownership to database level users. ALTER AUTHORIZATION can be used to change the ownership of any entity that has an owner. Run below command to change the owner of above endpoint to a login Domain\abc5.

--Replace the login id [Domain\abc5] with your login.
ALTER Authorization on endpoint::Hadr_endpoint to [Domain\abc5]
GO

We can see command executed successfully. You can recheck the ownership by executing same command which we have executed in first section. Once change is done. next step is to drop the login.

We can see, now ownership of this endpoint is set to another login. Next step is go ahead and drop the login again. you can do it by either SSMS or T-SQL. SSMS way is given below:

• Connect to target SQL Server Instance.
• Expand the security folder.
• Expand the Logins folder.
• Right click and choose delete on the identified login which needs to be deleted.
• Click on Ok button of the login deletion window.

If you want to drop this login using T-SQL command then open a query window and execute below command.

--change the name of Login_name with your login name which you want to delete.
DROP Login 'LOGIN_NAME'

This time your login will be dropped successfully. If you are still facing some another issue during dropping this login, you can read below articles where i have demonstrated step by step method to fix the DROP login failed errors:

• How to fix Error 15174: Login owns one or more databases.
• How to fix Error 15173: Revoke the permissions before dropping the login.
• How to fix error 15138 & Error 3729: DROP login failed

I hope you like this article. Please follow us on our facebook page and on Twitter handle to get latest updates.

The post Fix SQL Server Error 15141: The server principal owns one or more endpoint(s) and cannot be dropped appeared first on Techyaz.com.

Microsoft SQL Server Error 15138

I have discussed similar type of issue in my last tip, where a server level login was owner of some databases which causes to fail the login removal and throws error 15174. We changed the ownership and then tried to drop that login and it was successful.

Microsoft SQL Server Error 15138 which i am discussing in this tip is also similar kind of error. Here, user has owned some schemas at database level. We will do the same thing, we will change the owner of identified schema and drop the user.

The details of SQL Server error 15138 is given below.

As error clearly says that a schema is owned by this user in the database so let us check the schema that is owned by this user. Please follow the below process to check the owned schema for an user in the database.

• Connect to SQL Server Instance in SSMS.
• Expand the database folder followed by the actual database name in which your user exists or created.
• Expand Security folder inside your target database followed by the Users folder and double click on the target user which you want to drop.
• You can see a section named “Owned Schemas. Here you can see the schemas that are owned by this user.

If you find any schema that is owned by this user in above steps, you need to change the owner from this user to some other user or you can change it to dbo as well. See the below screenshot of the owned schema for a user.

Solution

Now we have identified the schema which is owned by this user. Our Next step is to change is owner of the identified schema and then drop the login.

 --Change DBName with your database name and Schema_Name with your schema name which is owned by this user.
USE [DBName] 
G0 
Alter Authorization ON Schema::[SCHEMA_NAME] TO [dbo] 
Go

Once above command will execute, next step is to drop the user again. Run below command to drop the user.

--Change DBName with your database name where user exists and USERNAME with user name which you want to drop.
USE [DBName] 
Go 
DROP USER USERNAME 
Go

This time it will work and user will drop from the database. You can also delete this user from SSMS by right click on the user and choose the delete option. SSMS way is given below:

• Connect to target SQL Server Instance.
• Expand Database folder in which user exists.
• Expand the Security folder and then Users folder to get the target user name.
• Right click and choose delete on the identified user which needs to be deleted.
• Click on Ok button of the user deletion window.

There are many reasons which causes to fail the user or login deletion. You can find many errors and their solutions in given links. Learn to fix:

• Error Code 15174: Login Owns one or more databases(s). Change the owner of database(s) before dropping the login.
• Error Code 15173: Revoke the permission(s) before dropping the login.

Microsoft SQL Server Error 3729

We have seen how to drop an user who was owner of a schema in above section. Now we will understand how to drop a schema that is referenced by an object. If you try to run DROP Schema statement and that particular schema is referenced to some object you will get below error. The details of SQL Server error 3729 is given below.

In order to fix this issue, we will change the schema of table “Locations” to remove the reference. We will use sp_changeobjectowner system stored procedure to change schema from abc to dbo. Run below command to change the schema of the table “Locations” from abc to dbo.

--Change DBName with your database name where user/schema/table exists
--Change the abc to your schema name.
USE DBName
GO
sp_changeobjectowner 'abc.Locations','dbo'

Now go ahead and drop the schema post executing above command. This time it will drop without an error.

--Change DBName with your database name where user/schema/table exists
--Change the abc to your schema name which you want to delete.
USE [DBName]
GO
DROP SCHEMA [abc]
GO

You can also drop the same using SSMS as well. Go to schema folder inside the security folder of your database. Right click on identified schema and choose delete option.  it will delete your schema.

Learn to fix below errors as well:

• Error Code 15174: Login Owns one or more databases(s). Change the owner of database(s) before dropping the login.
• Error Code 15173: Revoke the permission(s) before dropping the login.

I hope you like this article. Please follow us on our facebook page and on Twitter handle to get latest updates.

The post Fix SQL Server Error 15138: Dropping User that owned Schema & Error 3729: Schema that referenced to the object appeared first on Techyaz.com.

Microsoft SQL Server Error 15173

Login was failed to drop because of SQL Server error 15173. This error comes when a login having server level rights has granted permission to any server principal. The details of Microsoft SQL Server error 15173 is given below.

You can check the details about the grantee by running below command. You will see the grantee_principal_id and grantor_principal_id column along with other details. Grantor_principal_id will be the id of that login which you want to delete. You can see class_desc and permission_name column to see the permission type and permission category.

SELECT * FROM sys.server_permissions
Where grantor_principal_id= (Select principal_id from sys.server_principals where name = 'xyz')

You might get such issues if you have configured AlwaysOn availability group or database mirroring because there might be possibility that your login has granted some permission to endpoint so you need to revoke that permission to fix this issue.

Solution

The solution to fix this issue is to revoke the access which you have granted. Run below command to revoke the access for endpoints. This solution is valid only in case if you have granted access on endpoint. If you have granted access on login then you should keep reading this article.

--Here xyz was grantor.
--Make sure to revoke the access level which you get in the output of above script. 
--You can get this by focusing on permission_name and state_desc column. In my case, it was view definition and state_desc was GRANT.
USE Master
Go
REVOKE CONNECT ON ENDPOINT:: [hadr_endpoint] TO [xyz]

Once command will be executed successfully, you are able to drop that login. Do let me know in comment section if you are still facing the issue. You can try below T-SQL to revoke the access from login if you get an output for logins not endpoint.

If this access is assigned to login and not endpoint then you should run below command to revoke the access. Here we are trying to drop login xyz but it was failed because xyz login has granted access to login abc. So, we will revoke the access to drop the user.

USE master
REVOKE VIEW DEFINITION ON LOGIN:: xyz FROM [abc]

Go ahead and drop the login which you wanted to drop.

--change the name of Login_name with your login name.
DROP Login 'LOGIN_NAME'

You can also revoke this access level using SSMS/GUI as well. Connect to SQL Server Instance in SSMS, Expand security folder followed by logins folder. Double click on the login and go to securables from left side pane. You can uncheck the permissions allocated to this login and click on ok to apply the changes.

You can click on attached link if you want to learn about another Error 15174 which comes during drop Login statement.

I hope you like this article. Please follow us on our facebook page and on Twitter handle to get latest updates.

The post Fix SQL Server Error 15173: Revoke the permission(s) before dropping the login. appeared first on Techyaz.com.