Something I'd forgotten when I was setting up a new SQL server, was how the UAC (User Account Controls) permissions affect connections to SQL when the windows account in question is part of a group.
I've only experienced this with sysadmin accounts, but the problem can occur in applications or even Management Studio, where users who should have full sysadmin access find they cannot connect at all.
The only clue is that the SQL log contains the lines:
Source: Logon
Message: Error: 18456, Severity: 14, State: 11.
and
Source: Logon
Message: Login failed for user 'DOMAIN\grumpydba'. Reason: Token-based server access validation failed with an infrastructure error. Check for previous errors. [CLIENT: 1.2.3.4]
Issue is that SQL doesn't seem to apply sysadmin access rights to users / accounts that only exist in SQL groups.
Two quick fixes:
1. If you are opening SQL Management Studio, right click and select "Run as administrator". This should give you the access you expect.
2. Add the account explicitly as a SQL login, and grant sysadmin. (Use this if for a system account) This will give the account the relevant permissions and able to connect.
