SHOWPLAN permissions

One can be database owner, SHOWPLAN within the database, CONTROL Database, CONTROL Server, or ALTER TRACE at the server level.

See Rob Farley’s article for a script to run a test.

Rob Farley : SHOWPLAN permission denied even if the database isn’t actually used

To view a query plan, you need SHOWPLAN permission on the database level at least. You have this if you have CONTROL DATABASE, or CONTROL SERVER, or if you have ALTER TRACE at the instance level. I know this last one because it’s mentioned in Books Online

Source: sqlblog.com/blogs/rob_farley/archive/2015/04/14/showplan-permission-denied-even-if-the-database-isn-t-actually-used.aspx

ERROR: SSPI handshake failed with error code … Error: 18452

We were trying to connect a remote SQL publisher to a local subscriber and on the subscriber get these errors, found in the SQL Errorlog.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
Date        12/8/2016 6:52:42 AM
Log     SQL Server (Current - 12/7/2016 6:03:00 PM)
 
Source      Logon
 
Message
Error: 17806, Severity: 20, State: 14.
 
----
 
Date 12/8/2016 6:52:42 AM
Log SQL Server (Current - 12/7/2016 6:03:00 PM)
 
Source Logon
 
Message
SSPI handshake failed with error code 0x8009030c, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure. The logon attempt failed [CLIENT: 172.31.5.158]
 
----
Date        12/8/2016 6:52:42 AM
Log     SQL Server (Current - 12/7/2016 6:03:00 PM)
 
Source      Logon
 
Message
Error: 18452, Severity: 14, State: 1.
 
----
Date        12/8/2016 6:52:42 AM
Log     SQL Server (Current - 12/7/2016 6:03:00 PM)
 
Source      Logon
 
Message
Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. [CLIENT: xxx.xx.x.xxx]
 
----

However, the SQL login was coming from a domain that already HAD replication running on another database.

It turned out to be an incorrect login name, rather than an untrusted domain.

Never trust an error message.