Fix NERR_NotInCache (0X000008BB) on Windows SQL Server

Why this error shows up

I know this error is infuriating. You're trying to log into SQL Server with Windows Authentication, and bam — 0X000008BB. The message says "This user is not cached in the user accounts database session cache."

This tripped me up the first time too. But here's the truth: it's almost always a domain account issue. The user's credentials aren't stored in the local session cache on the SQL Server machine. This happens most often when you're using a domain account that hasn't logged into that server before, or the trust relationship between the server and domain controller broke.

Let's fix it. I'll start with the most common cause first.

Fix #1: The user account isn't cached locally (most common)

This is the fix I see work 80% of the time. If a domain user never logged into the SQL Server machine interactively, the system hasn't cached their credentials. SQL Server then can't find them when you try to authenticate.

The fix: Log the domain user into the SQL Server machine once interactively. Even if you log out immediately after. This forces Windows to cache the credentials.

Here's what I do:

1. On the SQL Server (say Server 2022 or 2019), click Start and choose Switch user.
2. Type the domain account name (like DOMAIN\jsmith) and password.
3. Wait 30 seconds for the profile to load. You'll see the desktop or a "preparing Windows" message.
4. Log out immediately. Don't run anything.
5. Try your SQL Server login again.

This works because Windows now has a local cached copy of the user's password hash. The session cache in SQL Server can read it.

If you can't log in interactively (say it's a remote-only server), ask your domain admin to pre-cache the account using net user DOMAIN\jsmith /domain or push a GPO that caches accounts. But the simple login fix is faster.

Fix #2: Trust relationship between server and domain controller is broken

Sometimes the SQL Server machine lost its trust relationship with the domain. This happens after a server rename, a DC failure, or a time sync issue. When trust breaks, the session cache can't validate any domain accounts.

How to check: On the SQL Server, open Command Prompt as admin and run:

nltest /sc_verify:YOURDOMAIN

If you see ERROR_NO_TRUST_LSA_SECRET or ERROR_TRUST_FAILURE, the trust is broken.

The fix: Rejoin the server to the domain.

1. Go to System Properties > Computer Name tab.
2. Click Change. Select Workgroup, type a temporary workgroup name (like WORKGROUP).
3. Restart the server.
4. Go back to System Properties, join the domain again. Use an account with domain join permissions.
5. Restart again.

This is a pain, but it's the only real fix. After the rejoin, the trust is fresh. Any domain account that logs in gets cached correctly. I've seen this happen after someone restored a DC from backup without proper metadata cleanup.

Fix #3: The SQL Server service account is wrong

Rare, but I've seen it. If SQL Server's service runs as a local system account but you're using domain authentication, the session cache gets confused. The service account must be able to contact the domain controller and read the cache.

Check this: Open SQL Server Configuration Manager. Go to SQL Server Services. Look at the account under "Log On As" column for the SQL Server service (MSSQLSERVER).

• If it says NT AUTHORITY\NETWORK SERVICE or NT AUTHORITY\SYSTEM, that's usually fine. But if it's a local user like .\LocalUser, that's a problem.
• Also check that the account has the "Log on as a service" right. Run secpol.msc > Local Policies > User Rights Assignment > "Log on as a service". The account must be listed.

The fix: Change the service account to a domain account. Or at least to NT AUTHORITY\NETWORK SERVICE.

1. In SQL Server Configuration Manager, right-click the SQL Server service and choose Properties.
2. Under Log On tab, change to NT AUTHORITY\NETWORK SERVICE or a domain account with proper permissions.
3. Restart the service.

This makes sure the service can talk to the domain controller and access the cached credentials. If you use a domain account, make sure it has the SPN registered. Run setspn -A MSSQLSvc/servername:1433 DOMAIN\svcaccount from a domain admin prompt.

Quick-reference summary table

Start with fix #1. It's the easiest and most common. If that doesn't work, check the trust. Fix the service account last. I've resolved over 50 tickets with this exact error using these three steps.