How to fix Error 9751 on Windows Server 2025 / Windows 11

by

Why This Error Happens

Error 9751 typically occurs when SQL Server 2025’s authentication layer fails to validate credentials due to a mismatch in security protocol negotiation, often triggered by expired or misconfigured Service Principal Names (SPNs), corrupted Kerberos tickets, or TLS/SSL certificate issues on the Windows Server 2025/Windows 11 host. This can also result from Windows Security Support Provider Interface (SSPI) context failures when the SQL Server service account lacks proper delegation rights in Active Directory. Additionally, a mismatch between the client and server-supported authentication protocols (NTLM vs. Kerberos) can trigger this handshake failure.

Step-by-Step Resolution Guide

Step 1: Verify SPN Registration and Service Account Permissions

  • Open Command Prompt as Administrator and run setspn -L <DOMAIN>\<SQLServiceAccount> to check existing SPNs.
  • If missing, register the SPN manually using setspn -S MSSQLSvc/<ServerFQDN>:1433 <DOMAIN>\<SQLServiceAccount>.
  • Ensure the service account has “Read servicePrincipalName” and “Write servicePrincipalName” permissions in Active Directory Users and Computers.

Step 2: Reset and Validate Kerberos Ticket Cache

  • Run klist purge on the client and server to clear stale Kerberos tickets.
  • Restart the SQL Server service via services.msc or net stop MSSQLSERVER && net start MSSQLSERVER to force ticket renegotiation.
  • Check Event Viewer under Applications and Services Logs > Microsoft > Windows > Security-Kerberos for ticket validation errors.

Step 3: Correct TLS/SSL Certificate Configuration

  • Open SQL Server Configuration Manager and navigate to SQL Server Network Configuration > Protocols for MSSQLSERVER.
  • On the Certificate tab, confirm a valid, non-expired certificate is bound and matches the server’s FQDN.
  • If using “Force Encryption,” ensure the certificate’s private key is accessible to the SQL Server service account via certlm.msc.

Step 4: Review Authentication Protocol Settings

  • In SQL Server Management Studio (SSMS), go to Server Properties > Security and confirm “SQL Server and Windows Authentication mode” is correctly set.
  • On the Windows Server 2025 host, verify Group Policy under Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options allows both NTLM and Kerberos fallback if mixed environments exist.

Alternative or Verification Steps

  • Test the connection using sqlcmd -S <ServerName> -E to confirm successful Windows Authentication without errors.
  • If the issue persists, temporarily switch the connection string to use SQL Server Authentication (username/password) to isolate whether the fault lies specifically within the Kerberos/NTLM negotiation layer.