Configure SQL Server for protected users with integrated security

Here are the steps to configure your SQL Server to allow your Protected Users to connect to the Database using the Integrated Security authentication method.

According to Microsoft, Protected Users blocks the use of NTLM hashes. It is however possible to configure SQL Server to also use Kerberos for Integrated Security. This is supported out-of-the-box by Remote Desktop Manager.

For SQL Server to support Kerberos authentication, SPNs need to be created. By default, the service runs under accounts that lack the required permissions. You might have the following messages when SQL Server starts (you can see the logs in SSMS under Management SQL Server Logs): "The SQL Server Network Interface library could not register the Service Principal Name (SPN) for the SQL Server service."

You will need to configure the SQL Server service to run under Network Service as it has the necessary permissions. According to this article, it is also possible to grant the permissions to create SPNs to a service account. You will also need to change the account in SQL Server Configuration Manager.

However, SQL Server may still be reporting that it was unable to register the SPNs. Microsoft Kerberos Configuration Manager for SQL Server can be used to fix the SPNs. It shows clickable buttons in the Action columns.

After restarting the SQL Server service, you should see “The SQL Server Network Interface library successfully registered the Service Principal Name (SPN) [ MSSQLSvc/vdownsrv-sql3.downhill.loc:1433 ] for the SQL Server service.” in the logs.

At this point the connection should work again in Remote Desktop Manager.