How to fix Error 12826 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: Error 12826 – Contained Database Authentication Disabled via RECONFIGURE WITH OVERRIDE

Why This Error Happens

This error occurs when an administrator runs sp_configure 'contained database authentication', 0 followed by RECONFIGURE WITH OVERRIDE while one or more contained databases are actively attached to the SQL Server 2025 instance. The WITH OVERRIDE clause forces the configuration change without validating whether contained databases currently depend on that setting, effectively bypassing the normal safety check. As a result, contained users who authenticate directly against the database (rather than the server-level login) lose their ability to connect, and no new contained databases can be created until the setting is reverted.

Step-by-Step Resolution Guide

Step 1: Identify Affected Contained Databases

  • Open SQL Server Management Studio (SSMS) or a query window connected to the instance.
  • Run the following query to list all contained databases on the server:
  SELECT name, containment, containment_desc 
  FROM sys.databases 
  WHERE containment <> 0;
  • Note each database name, as these are the ones currently impacted by the authentication disruption.

Step 2: Re-Enable Contained Database Authentication

  • Reverse the misconfiguration by setting the option back to enabled (1) at the server level.
  • Execute the following in a query window with sysadmin privileges:
  EXEC sp_configure 'show advanced options', 1;
  RECONFIGURE;
  EXEC sp_configure 'contained database authentication', 1;
  RECONFIGURE;
  • Avoid using WITH OVERRIDE this time, since it is unnecessary when enabling the feature.

Step 3: Validate Contained User Logins

  • Confirm that contained users can authenticate directly against the affected database without referencing a server-level login.
  • Use the following test connection string pattern (via sqlcmd or application connection):
  sqlcmd -S <ServerName> -d <ContainedDBName> -U <ContainedUser> -P <Password>
  • If login still fails, check sys.database_principals in the specific contained database to ensure the user account exists with authentication_type_desc = 'DATABASE'.

Step 4: Audit and Restrict Future Use of WITH OVERRIDE

  • Review SQL Server Agent jobs, deployment scripts, or DevOps pipelines (e.g., Azure DevOps, GitHub Actions) that may have issued the original RECONFIGURE WITH OVERRIDE command.
  • Add a safeguard check before any future reconfiguration, such as querying sys.databases for containment <> 0 and halting the script if contained databases are found.
  • Update internal runbooks to require explicit approval before using WITH OVERRIDE on any authentication or security-related configuration option.

Alternative or Verification Steps

  • Verify the fix by re-running EXEC sp_configure 'contained database authentication'; and confirming the run_value column shows 1.
  • If contained users still cannot authenticate after re-enabling the setting, restart the SQL Server service via Services.msc (Windows Server 2025/Windows 11) or run NET STOP MSSQLSERVER && NET START MSSQLSERVER from an elevated PowerShell session to force the configuration to take full effect.