SQL Server error after update: The token supplied to the function is invalid

Question

I was using my machine (and SSMS) and everything was working fine. I did a reboot whereupon Windows 10 applied the following updates:

Windows Malicious Software Removal Tool for Windows 8, 8.1, 10 and Windows Server 2012, 2012 R2, 2016 x64 Edition - April 2017 (KB890830)
Security Update for Adobe Flash Player for Windows 10 Version 1607 (for x64-based Systems) (KB4018483)
Security Update for Microsoft Silverlight (KB4017094)
Cumulative Update for Windows 10 Version 1607 for x64-based Systems (KB4015217)

Now when I try to login in SSMS I'm getting the following error:

A connection was successfully established with the server, but then an error occurred during the login process. (provider: SSL Provider, error: 0 - The token supplied to the function is invalid (Microsoft SQL Server)

The token supplied to the function is invalid

This looks like it is security related, but I don't know what to do to fix it. My machine uses Windows Server Essentials for backups (and the connector is green).

Did you ever find a solution for this? I am getting the same error with SSMS 17. — gymbrall, Jun 16 '17 at 16:38
Nope. I restored my computer to before the update to get it working again. But every now and then it updates automatically and causes the issue again. Very frustrating — WhiskerBiscuit, Jul 10 '17 at 21:55
Have you tried posting this on https://superuser.com/ or https://dba.stackexchange.com/ ? — Alex, Jul 11 '17 at 01:00
Try: https://serverfault.com/questions/423013/sql-an-error-occurred-during-the-pre-login-handshake it has a lot of different solutions you can try. One solution mentions Win 10 explicitly: https://stackoverflow.com/questions/3270199/a-connection-was-successfully-established-with-the-server-but-then-an-error-occ/44703629#44703629 — Alex, Jul 12 '17 at 00:45
Few things that you can try 1. See if your SQL services are running (Probably you can stop the services and start it again) 2. Reset the IIS 3. Run the `netsh Winsock reset` in command prompt — DataWrangler, Jul 12 '17 at 09:08
What version of SQL Server, and is that server local or remote? You assume the problem is with your client; this need not be the case. Also, since you can compare working and non-working situations (apparently), a Wireshark trace could give you more clues. — Jeroen Mostert, Jul 17 '17 at 13:45

Amol Jadhav · Answer 1 · 2019-09-04T14:37:49.793

5

I had faced the same issue with SQL Server. I followed some steps and my problem was resolved. Those steps are as -

Click Start, click Run, type regedit in the Open box, and then click OK.
Locate and then click the following subkey in the registry: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL
On the Edit menu, point to New, and then click DWORD Value.
Type SendExtraRecord for the name of the DWORD value, and then press Enter.
Right-click SendExtraRecord, and then click Modify.
In the Value data box, type 2 to disable the split record in schannel, and then click OK.
Exit Registry Editor. Done!

edited Sep 04 '19 at 14:37

answered Apr 13 '17 at 15:02

Amol Jadhav

101
1
12

I've seen that before, but unfortunately it didn't work for me. – WhiskerBiscuit Apr 13 '17 at 15:54
1

Oops.. I will get back to you if I get any other solution. – Amol Jadhav Apr 13 '17 at 15:56

score 5 · Answer 2 · answered Jul 17 '17 at 14:47

5

Execute in command line with administrative privilege and reboot.

netsh winsock reset

answered Jul 17 '17 at 14:47

Slawomir Cieslinski

625
5
14

@Joshua Resets the Winsock catalog to a clean state. – Slawomir Cieslinski Mar 13 '20 at 13:03

score 3 · Answer 3 · answered Jun 07 '19 at 20:43

I just wanted to answer this question for completeness. I'm not sure that any of the previous answers solved the problem for me so here goes...

I consistently received the following error when using SSMS v18.0 while trying to connect to one of our QA databases: The token supplied to the function is invalid

Turns out that our certificates had just been renewed and unknown to me at the time they were renewed with a new signature algorithm (from RSA/SHA256 to RSA/SHA512). The eventual solution was to modify the list of enabled algorithms in the registry (Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010003) and then restart the machine: enable RSA/SHA512 registry

score 2 · Answer 4 · answered Jul 17 '17 at 21:27

It seems that others have had success simply by restarting the machine's IIS.

That would be as simple as this:

Click Start, click Run type IISReset, and then click OK. SOURCE (Microsoft)

Otherwise, there are some settings in SSCM that you might need to ensure are properly set, and which may be culprits for a wide range of issues:

ensure Shared Memory protocol is enabled

ensure Named Pipes protocol is enabled

ensure TCP/IP is enabled, and s ahead of the Named Pipes in the settings SOURCE (SO)

(These settings are in your SSCM). There is also a nice blog post about setting these settings as a solution for a different error.

I hope this helps spark some ideas! It seems like this is a fairly common issue without very many concrete suggestions for solutions.

If none of those work (I thought I would suggest them as due diligence in case they resolved the issue), you might have to look into what is being modified by Windows Malicious Software Removal Tool.

Other people have run into issues using SSMS after similar updates in the past, and they seem to offer Internet Explorer as the offender. To fix it, they unregistered and registered their ieproxy.dll.

They suggest doing:

Launch command line in administrative mode. Go to C:\Program Files\Internet Explorer or c:\Program Files (x86)\Internet Explorer if you have Win x64.

Execute regsvr32 /u ieproxy.dll (this might throw an error if it isn't loaded)

Execute regsvr32 ieproxy.dll SOURCE (SO)

This seems to have been successful for them, hope it works!

score 1 · Accepted Answer · answered Aug 02 '18 at 04:37

1

Just answering my own question for posterity:

Open MMC and select the certificates add-on for local computer. Open up the server certificate and disable server and client authentication purposes. Restart SQL server. Finished.

answered Aug 02 '18 at 04:37

WhiskerBiscuit

4,795
8
62
100

score 0 · Answer 6 · answered Jan 07 '22 at 23:51

I fixed this in my environment by doing the following.

Creating a self signed certificate
Open SQL Server Configuration Manager.
Expand SQL Server Network Configuration.
Right click Protocols for MSSQLSERVER (Your instance name here) open properties.
Go to the Certificate tab.
In the Certificate drop down choose your certificate.

In my case I used IIS to generate the cert but you can also used PowerShell if IIS is not installed on your SQL server like it is on mine. https://learn.microsoft.com/en-us/powershell/module/pki/new-selfsignedcertificate?view=windowsserver2022-ps

Per this article: SSL Certificate missing from dropdown in SQL Server Configuration Manager

Make sure the certificate's subject name exactly matches the name of the SQL server or the certificate will not appear in the drop down.

At that point I was able to login to SSMS without the error.

Here are some example of the errors I saw before fixing the issue.

Of course when login to SSMS (Sorry no screenshot)

When doing a repair of SQL