Error message when you try to log on to Microsoft Dynamics CRM 3.0: "Login failed for user NT Authority\Anonymous" (921393)


The information in this article applies to:

  • Microsoft CRM 3.0

SYMPTOMS

When you try to log on to Microsoft Dynamics CRM 3.0, you receive the following error message:
Login failed for user NT Authority\Anonymous.
Then, if you press F5, you receive the following error message:
Microsoft CRM could not log on to the system. Make sure your user record is enabled and that you have been assigned at least one security role. For more information, contact your system administrator.
Additionally, when you try to use the Deployment Manager to access the User Manager, you receive the following error message:
The server http://CRMSERVER/MSCRMServices is not responding. This might happen if it is currently unavailable, it is not a Microsoft CRM Server, or you do not have sufficient privileges to run the User Manager. For more information, please contact your system administrator.
Note CRMSERVER is a placeholder that represents an actual Microsoft Dynamics CRM server.

CAUSE

This problem occurs because the service principal name (SPN) is not set.

RESOLUTION

To resolve this problem, follow these steps:
  1. Log on to the computer that is running Microsoft SQL Server.
  2. Click Start, point to All Programs, point to Administrative Tools, and then click Services.
  3. Right-click MSSQLSERVER, and then click Properties.
  4. To see which account is used as the logon account, click the Log On tab.

    Note If the Local System account is selected, this account is the computer account. The SPN must be added to the account that is running the MSSQLSERVER service.
  5. On the computer on which Microsoft Dynamics CRM is installed, log on as a user who has the domain administrator role.
  6. Install the Windows Support Tools on the Microsoft Dynamics CRM server. The tools are on the Microsoft Windows Server 2003 CD or on the Microsoft Windows 2000 Server CD.
  7. Click Start, point to All Programs, point to Windows Support Tools, and then click Command Prompt.
  8. At the command prompt, run the following commands.
    setspn -A MSSQLSVC/SQL_server_name:1433 Service Account
setspn -A MSSQLSVC/SQL_server_name.Domain_name:1433 Service Account
    Note SQL_server_name is a placeholder that represents an actual SQL server name. Domain_name is a placeholder that represents an actual domain name. Service Account is a placeholder that represents the service account that is running the MSSQLSERVER service. The SPN must be added to this service account. If the Local System account is running the MSSQLSERVER service, use the SQL_server_name for the name of the service account. If a user account is running the MSSQLSERVER service, use Domain_name/user_account_name for the name of the service account.
  9. To verify that the SPN is set, run the following command at the command prompt.
    setspn -L Service Account
Modification Type:MajorLast Reviewed:6/27/2006
Keywords:kberrmsg kbMBSadministration kbtshoot kbMBSinstallation kbMBSMigrate kbprb KB921393 kbAudEndUser kbAudKnowledgeWorker
©2004 Microsoft Corporation. All rights reserved.