New SharePoint Subscription Edition Farm got errors WEB01’s machine account was refused at SP_CONFIG Event 3351 and SQL Exception 15404

If Microsoft Monitoring Service is installed on WEB01, temporarily stop it and check whether only the WEB01$ Event 3351 stops; a matching SharePoint Subscription Edition case isolated the machine-account login attempts to that service.^1^

Do not grant DOMAIN\WEB01$ access to SP_CONFIG merely to suppress the event. Treat the two identities separately:

• DOMAIN\WEB01$: a process on WEB01 is connecting under the computer identity.
• DOMAIN\FarmAcc: SQL Server is failing to obtain directory information for the farm account. SQL error 15404 identifies an invalid/unresolvable principal or a failed impersonation/trust lookup; code 0x5 alone does not establish which policy or network control denied it.^2^

1. Isolate the WEB01$ connection

Requires local administrator rights on WEB01.

1. Open Services and look for Microsoft Monitoring Service.
2. If present, record its current startup state, then stop it during a controlled test.
3. Wait through the normal event interval or reproduce the operation.
4. Check whether new Event 3351 entries for DOMAIN\WEB01$ stop.
5. Start the service again after testing.

If the event stops, inspect and reconfigure or remove the monitoring workflow that probes SP_CONFIG; stopping monitoring permanently is not the preferred remediation. If it continues—or the service is absent—correlate the timestamp with WEB01 services, scheduled tasks, monitoring agents, and ULS entries rather than adding a SQL login for the computer.

A SharePoint farm administrator can filter the ULS log as follows:^3^

Get-SPLogEvent |
  Where-Object {
    $_.Area -eq "SharePoint Foundation" -and
    ($_.Message -match "WEB01\$|SP_CONFIG|3351|5586|15404")
  } |
  Select-Object Timestamp, Process, Area, Category, Level, Message |
  Format-List

2. Resolve FarmAcc error 15404 independently

Requires local administrator rights on SQL Server and assistance from the AD/firewall administrators.

1. In SQL Server Configuration Manager → SQL Server Services, record the Log On As identity for the Database Engine.
2. Confirm that DOMAIN\FarmAcc exists, is spelled correctly, and remains an enabled domain-user account. The SharePoint farm account must be a domain user; SharePoint services do not support MSA or gMSA identities.^4^
3. On the SQL server, test discovery and name resolution for the domain containing FarmAcc:

nltest /dsgetdc:<FarmAccDomain> /force /kdc
nslookup <FarmAccDomain>
w32tm /query /status
Test-NetConnection <DC-FQDN> -Port 53
Test-NetConnection <DC-FQDN> -Port 88
Test-NetConnection <DC-FQDN> -Port 389
Test-NetConnection <DC-FQDN> -Port 135
Test-NetConnection <DC-FQDN> -Port 445

Fixed-port tests do not validate dynamic RPC. Windows Server 2008 and later uses TCP dynamic ports 49152–65535 for RPC services including LSA, SAM, and Netlogon; validate those with firewall logs or a network trace.^5^

Conditional SQL resolutions

Apply the matching branch only after establishing the condition:

• SQL uses a domain account that is locked: unlock it and verify its domain connectivity.
• The SQL service identity lacks a full trust relationship with FarmAcc’s domain: use a SQL service account from the same domain as FarmAcc, or repair the required inter-domain trust.
• SQL runs as Local System or Network Service: ensure the SQL server’s machine account is trusted by the domain containing FarmAcc.

These are the documented resolutions for error 15404.^2^ Change the Database Engine account only through SQL Server Configuration Manager, not services.msc; schedule a maintenance window because restarting the service makes the instance’s databases temporarily unavailable.^6^

If hardening blocks the directory lookup

Generate effective Group Policy reports on the SQL server and relevant DC. Check Network access: Restrict clients allowed to make remote calls to SAM on the system enforcing the denied call—especially the DC handling the lookup.

Do not disable this policy or delete RestrictRemoteSam based only on error 15404. First identify the denied caller through DC security logs, SQL logs, or a network trace. If that policy is confirmed as the source, modify the authoritative DC GPO with the AD security team, granting only the approved identity or group required for remote access. Microsoft documents that restrictive Remote SAM policy on DCs can cause access-denied failures and recommends applying a consistent DC policy.^7^

References

1. How to fix error ralted to Login failed for user domain/machinename$ on SharePoint subscription servers - Microsoft Q&A
2. MSSQLSERVER_15404
3. View diagnostic logs in SharePoint Server
4. Plan for administrative and service accounts in SharePoint Server
5. How to configure a firewall for Active Directory domains and trusts
6. SQL Server Configuration Manager: Change the service startup account
7. Error 0x5 Access Denied when you rename a computer that is member of a domain