Hello everyone. Today we are going to cover error message 1069: The service did not start due to logon failure” when you have AD FS farm with WID (Windows Internal Database) service not starting and consequently Active Directory Federation Service does not start either.
By default, after a successful deployment of one AD FS server, ‘NT SERVICE\adfssrv’ and ‘NT SERVICE\ALL SERVICES’ are configured in the server’s Local Security Policy as below:
REPRODUCING THE ISSUE
To reproduce the issue, I’ve changed the default domain policy to have ONLY AD FS account ‘NT SERVICE\adfssrv’ configured to ‘logon as a service’:
Once the GPO above is applied, when trying to start service ‘MSSQL$MICROSOFT##WID’, we get error message below:
Checking SYSTEM logs on event viewer, we find error message below:
The MSSQL$MICROSOFT##WID service was unable to log on as NT SERVICE\MSSQL$MICROSOFT##WID with the currently configured password due to the following error:
Logon failure: the user has not been granted the requested logon type at this computer.
Service: MSSQL$MICROSOFT##WID
Domain and account: NT SERVICE\MSSQL$MICROSOFT##WID
This service account does not have the required user right “Log on as a service.”
User Action
Assign “Log on as a service” to the service account on this computer. You can use Local Security Settings (Secpol.msc) to do this. If this computer is a node in a cluster, check that this user right is assigned to the Cluster service account on all nodes in the cluster.
If you have already assigned this user right to the service account, and the user right appears to be removed, check with your domain administrator to find out if a Group Policy object associated with this node might be removing the right.
CAUSE
As well explained in this official Microsoft article, when WID is installed, the NT SERVICE\MSSQL$MICROSOFT##WID local virtual account is created. This account is granted the Log on as a service user right by local Group Policy. If a Group Policy Object (GPO) that’s linked to a site, domain, or organizational unit overwrites the local Group Policy setting, the NT SERVICE\MSSQL$MICROSOFT##WID account doesn’t have the necessary user rights.
FIX
To fix this issue, you have two options:
Option 1: Add the local account ‘NT SERVICE\ALL SERVICES’ with logon as a service in the current GPO as below:
Option 2: Remove the GPO setting and AD FS server will consider the default local security policy configuration again.
After removing the GPO setting and updating the policy on the AD FS server, we can see the event ID 7036 in the SYSTEM logs in event viewer:
The MSSQL$MICROSOFT##WID service entered the running state.
Summary
In this article, we covered how to troubleshoot and fix the error message 1069: The service did not start due to logon failure” when using ad fs WITH wid (Windows Internal Database).
I hope you have enjoyed reading this article, and it helps you to manage your AD FS environment.
Enjoyed the article? Like and share. 🙂
Note: I do not represent the organization I work for, all the opinions expressed here, are my own. This post is provided AS IS with no warranties or guarantees and confers no rights.
In case you have any suggestions or feedback, please leave a comment.
[ ]’s
Ulysses Neves
