Could not obtain information about Windows NT group/user

Microsoft.SQLServer.2012.Could_not_obtain_information_about_Windows_NT_group_user_1_5_Rule (Rule)

Knowledge Base article:

Summary

A process executed within SQL Server or from the SQL Server Agent, such as the xp_logininfo stored procedure, a scheduled job, or a replication agent, needs to verify the credentials of a Windows-authenticated login. The attempt to retrieve those credentials on the domain failed for an unspecified reason.

Causes

One common cause of this error is a manually created domain group with “everyone” name. This name conflicts with the built-in hidden group with the same name. Other conflicts between objects in a domain can also cause the problem, as can insufficient permissions to retrieve the information about the objects.

There are many other root causes for this error; many of them are described in more detail in Microsoft Knowledge Base article 834124.

Resolutions

If you can see a domain group called "everyone," rename or delete that group to avoid a conflict with the hidden “everyone” group that is built in to the domain.
Verify trust relationships and firewall settings between any domains involved.
Verify that the account used to lookup the domain credentials has sufficient permissions to perform the operation. This account may be the logged-on user or the account used to start either the SQL Server or SQL Server Agent service, depending on the context.
Check whether there are any local or global groups, computers, or domain names in any of the local or trusted domains that have the same name as any of the other objects. If there is an overlap, rename one or more objects to avoid the duplication.
For more information about additional troubleshooting steps, see Microsoft Knowledge Base article 834124.

Overrideable Parameters

Name	Description	Default Value
Enabled	Enables or disables the workflow.	Yes
Priority	Defines Alert Priority.	1
Severity	Defines Alert Severity.	1

Element properties:

Target

Microsoft.SQLServer.2012.DBEngine

Category

EventCollection

Enabled

True

Event_ID

15404

Event Source

$Target/Property[Type="SQL!Microsoft.SQLServer.DBEngine"]/ServiceName$

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

True

Alert Message

Could not obtain information about Windows NT group/user

{0}

Event Log

Application

Comment

Mom2012ID='{48CE2DF2-6430-4354-9CC1-9DF0D9144DC3}';MOM2012GroupID={467ECC75-C5DA-42BD-955C-A73BBB51AF74}

Member Modules:

ID	Module Type	TypeId	RunAs
_F6DA1507_12AF_11D3_AB21_00A0C98620CE_	DataSource	Microsoft.Windows.EventProvider	Microsoft.SQLServer.SQLDefaultAccount
GenerateAlert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.SQLServer.2012.Could_not_obtain_information_about_Windows_NT_group_user_1_5_Rule" Target="SQL2012Core!Microsoft.SQLServer.2012.DBEngine" Enabled="true" ConfirmDelivery="true" Remotable="true" Comment="Mom2012ID='{48CE2DF2-6430-4354-9CC1-9DF0D9144DC3}';MOM2012GroupID={467ECC75-C5DA-42BD-955C-A73BBB51AF74}">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_F6DA1507_12AF_11D3_AB21_00A0C98620CE_" Comment="{F6DA1507-12AF-11D3-AB21-00A0C98620CE}" TypeID="Windows!Microsoft.Windows.EventProvider" RunAs="SQL!Microsoft.SQLServer.SQLDefaultAccount">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>$Target/Property[Type="SQL!Microsoft.SQLServer.DBEngine"]/ServiceName$</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>15404</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.SQLServer.2012.Could_not_obtain_information_about_Windows_NT_group_user_1_5_Rule.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>Event ID: $Data/EventDisplayNumber$. $Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue/>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>