Document 1071638.1 25/02/15 4:25 p.m.

ORA-01031 While Connecting As Sysdba On Windows With A Domain User (Doc ID 1071638.1)

In this Document

Symptoms
Cause
Solution
References

APPLIES TO:

Oracle Database - Enterprise Edition - Version 9.2.0.1 to 11.2.0.3 [Release 9.2 to 11.2]
Information in this document applies to any platform.
Checked for relevance on 10-APR-2013

SYMPTOMS

While trying to connect to a database running on Windows using "/ as sysdba" from an OS session started as a domain
user the following error occurs:

sqlplus / as sysdba

SQL*Plus: Release 10.2.0.4.0 - Production on M Mar 8 17:22:36 2010

Copyright (c) 1982, 2007, Oracle. All Rights Reserved.

ERROR:
ORA-1031: Insufficient privileges.

The domain user is a direct member of the local ORA_DBA group. If the Oracle Service is started as a domain user and not
as Local System Account then the OS authentication will work for any user.

CAUSE

The settings of Active Directory are not allowing any user to read the MemberOf attribute of the domain user. The
inability to read the MemberOf attribute of a domain user prevents Oracle from determining what groups that user
belongs to. Oracle is not able to read the attributes of the domain user as long as it's service is started as Local System
Account.

SOLUTION

https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-state=ld47g2czb_910&id=1071638.1 Página 1 de 2
Document 1071638.1 25/02/15 4:25 p.m.

Discuss with the System Administrators and change the AD settings so that all the members of the Authenticated Users
group(dynamically evaluated for membership) will be able to read the MemberOf attribute of any domain user.

REFERENCES

BUG:9173748 - CANNOT USE OS AUTHENTICATION AS SYSDBA FOR A DOMAIN USER: ORA-1031

NOTE:77665.1 - WIN: OS Authentication - CONNECT AS SYSDBA Without a Password

https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-state=ld47g2czb_910&id=1071638.1 Página 2 de 2