I have installed a .net web application on a Windows Server 2003 IIS server, running in an Application Pool as NETWORK SERVICE
and connecting to SQL Server on a different machine using Integrated Security. The SQL Server machine is also running Windows Server 2003. The web app therefore connects as identity DOMAIN\COMPUTER$
and that account has a login & user in SQL Server so everything works well.
I also have installed a .net windows service on the same IIS server that connects to that same SQL Server machine. The windows service runs as LOCAL SYSTEM
and should therefore also connect as identity DOMAIN\COMPUTER$
. I have installed this same product at over a dozen different companies, normally all works as I'd expect, but in one recent case the windows service was unable to connect to the database, getting the error:
Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'
Any ideas why this would be the case for LOCAL SYSTEM and not for NETWORK SERVICE? To work around this in the short term I had to switch to use a SQL Server login but would prefer to use Integrated Security if there's an easy solution to it. There were no error messages in the Security or System event log, although I'd not done anything to enable additional logging.
Normally I'd assume this is some sort of Kerberos/AD-type problem, and following articles like this and this would help. But the fact it works from NETWORK SERVICE suggests that the normal things I'd check are already ok (e.g. SPNs have been set up correctly and the machine domain account is enabled for delegation?). So what setting is it that's going wrong?
I don't have access to the servers without assistance from my client's IT team and there are other applications installed on the server that I need to be mindful to not disrupt, which both make troubleshooting a bit more delicate. Any suggestions for troubleshooting greatly appreciated!