远程安装SQL Server 2019报错求助：已配置委派信任仍失败

问题描述 #

尝试通过PowerShell在远程服务器上安装SQL Server 2019，远程服务器出现委派权限相关报错。已配置AD中的"信任委派"权限，但错误依旧。

安装脚本 #

Start-Process -FilePath $setupFilePath -NoNewWindow -Wait -ArgumentList "/CONFIGURATIONFILE=$configFilePath"

配置文件内容 #

[OPTIONS]
IACCEPTPYTHONLICENSETERMS="True"
ACTION="Install"
IACCEPTROPENLICENSETERMS="True"
SUPPRESSPRIVACYSTATEMENTNOTICE="True"
QUIET="True"
FEATURES=SQLENGINE,CONN,IS,BC,SDK,SNAC_SDK
INSTANCENAME="MSSQLSERVER"
AGTSVCACCOUNT="NT AUTHORITY\System"
AGTSVCSTARTUPTYPE="Automatic"
ISSVCSTARTUPTYPE="Automatic"
ISSVCACCOUNT="NT AUTHORITY\System"
SQLSVCSTARTUPTYPE="Automatic"
SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS"
SQLSVCACCOUNT="NT AUTHORITY\System"
SQLSVCINSTANTFILEINIT="True"
SQLSYSADMINACCOUNTS="Domain\Account"
SQLTEMPDBFILECOUNT="4"
SQLTEMPDBFILESIZE="1024"
SQLTEMPDBFILEGROWTH="64"
SQLTEMPDBLOGFILESIZE="512"
SQLTEMPDBLOGFILEGROWTH="64"
INSTALLSQLDATADIR="C:\MSSQL"
SQLBACKUPDIR="C:\MSSQL\BACKUP"
SQLUSERDBDIR="C:\MSSQL\DATA"
SQLUSERDBLOGDIR="C:\MSSQL\LOG"
TCPENABLED="1"
SECURITYMODE="SQL"
SAPWD="P@ssw0rd"
SQLMAXMEMORY="4915"
SQLMINMEMORY="4915"
IAcceptSQLServerLicenseTerms="True"
UpdateEnabled="False"

错误信息 #

Exception summary:
The following is an exception stack listing the exceptions in outermost to innermost order
Inner exceptions are being indented

Exception type: Microsoft.SqlServer.Chainer.Infrastructure.ChainerInfrastructureException
    Message: 
        There was an error generating the XML document.
    HResult : 0x84b10001
        FacilityCode : 1201 (4b1)
        ErrorCode : 1 (0001)
    Data: 
      DisableWatson = true
    Stack: 
        at Microsoft.SqlServer.Chainer.Infrastructure.DataStoreService.SerializeObject(String rootPath, Object objectToSerialize, Boolean saveToCache)
        at Microsoft.SqlServer.Chainer.Infrastructure.DataStoreService.SerializeObject(Object objectToSerialize)
        at Microsoft.SqlServer.Chainer.Infrastructure.PublicConfigurationBridge.Calculate()
        at Microsoft.SqlServer.Chainer.Infrastructure.InputSettingService.CalculateSettings(IEnumerable`1 settingIds)
        at Microsoft.SqlServer.Chainer.Infrastructure.InputSettingService.CalculateAllSettings(Boolean chainerSettingOnly)
        at Microsoft.SqlServer.Configuration.SetupExtension.FinalCalculateSettingsAction.ExecuteAction(String actionId)
        at Microsoft.SqlServer.Chainer.Infrastructure.Action.Execute(String actionId, TextWriter errorStream)
        at Microsoft.SqlServer.Setup.Chainer.Workflow.ActionInvocation.<>c__DisplayClass2_0.<ExecuteActionWithRetryHelper>b__0()
        at Microsoft.SqlServer.Setup.Chainer.Workflow.ActionInvocation.ExecuteActionHelper(ActionWorker workerDelegate)
    Inner exception type: System.InvalidOperationException
        Message: 
                There was an error generating the XML document.
        HResult : 0x80131509
        Stack: 
                at System.Xml.Serialization.XmlSerializer.Serialize(XmlWriter xmlWriter, Object o, XmlSerializerNamespaces namespaces, String encodingStyle, String id)
                at System.Xml.Serialization.XmlSerializer.Serialize(TextWriter textWriter, Object o, XmlSerializerNamespaces namespaces)
                at Microsoft.SqlServer.Chainer.Infrastructure.DataStoreService.SerializeObject(String rootPath, Object objectToSerialize, Boolean saveToCache)
        Inner exception type: System.Security.Cryptography.CryptographicException
            Message: 
                        The requested operation cannot be completed. The computer must be trusted for delegation and the current user account must be configured to allow delegation.
                        
            HResult : 0x80090345
            Stack: 
                        at System.Security.Cryptography.ProtectedData.Protect(Byte[] userData, Byte[] optionalEntropy, DataProtectionScope scope)
                        at Microsoft.SqlServer.Common.SqlSecureString.WriteXml(XmlWriter writer)
                        at System.Xml.Serialization.XmlSerializationWriter.WriteSerializable(IXmlSerializable serializable, String name, String ns, Boolean isNullable, Boolean wrapped)
                        at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationWriterSqlEngineSetupPublic.Write7_SqlEngineSetupPublic(String n, String ns, SqlEngineSetupPublic o, Boolean isNullable, Boolean needType)
                        at Microsoft.Xml.Serialization.GeneratedAssembly.XmlSerializationWriterSqlEngineSetupPublic.Write8_SqlEngineSetupPublic(Object o)

排查建议 #

• 验证委派配置准确性：
  • 远程服务器需在AD中设置为信任此计算机以委派到任何服务( Kerberos only)
  • 执行安装的域账户需取消勾选账户敏感，不能被委派选项，确保账户具备委派权限
• 检查远程身份验证方式：
  • 强制使用Kerberos进行PowerShell远程连接，命令示例：Enter-PSSession -ComputerName <远程服务器名> -Authentication Kerberos，确认连接无异常
• 调整SAPWD传递方式：
  • 避免在配置文件中明文存储SAPWD，改为在安装脚本中直接传递参数：

    Start-Process -FilePath $setupFilePath -NoNewWindow -Wait -ArgumentList "/CONFIGURATIONFILE=$configFilePath", "SAPWD=`"P@ssw0rd`""
    

  • 测试时可临时关闭QUIET="True"，改为QUIETSIMPLE="True"，查看交互式安装中的具体提示
• 确认权限上下文：
  • 确保执行安装的域账户在远程服务器上拥有本地管理员权限，且未被组策略限制权限
• 查看详细安装日志：
  • 前往路径C:\Program Files\Microsoft SQL Server\150\Setup Bootstrap\Log，找到对应时间的日志文件，排查更具体的错误触发点

内容的提问来源于stack exchange，提问作者ET lee