Skip to content

Troubleshooting

Symptom Likely cause Resolution
Query or view execution fails with "The server principal 'EQQLogin' is not able to access the database" After restoring an EQQuery backup the EQQLogin database user in the target database becomes orphaned (SID mismatch), or the QQCrossDbCertificate is missing/mismatched. Settings → Database → wrench icon (Maintain Permissions) on the affected database row → enter SA credentials → Run. See details below.
Menu item not visible Your role lacks that permission. Ask a Security Administrator to grant the role.
"License expiring in N days" banner Close to expiry. Settings → License Manager → Activate New License or Refresh License.
Query missing from Use Queries list Status is not Active, or database scope mismatch. Manage Queries → confirm status; Security → Users → verify user has that DB.
Login loops / infinite spinner Expired session token or cached JS after upgrade. Hard-reload (Ctrl+F5) or clear site data; check ExpireTime setting.
MFA lockout More wrong codes than MaxAttempts. Admin opens Security → Users → user → Reset MFA.
Export stuck or empty Result larger than an Excel sheet cap. Increase LimitRowExcelPerSheet or use CSV/JSON.
"View To Use" dropdown empty in Query Editor No Active views for the selected database. Activate at least one View under Manage Views.
API call returns 401 Expired API key or MFA change revoked it. Regenerate under My Account → API Keys.
cURL snippet fails with 500 Required parameter missing or password auth mismatch. Re-run in the Query To JSON builder; the test panel gives the verbatim error.
Modal dialog blocks page Outstanding license/warning pop-up. Read the message, click OK; if recurring, open License Manager.

EQQLogin or QQCert broken after database restore

Symptom — queries or views that worked before now fail with:

SqlException: The server principal "EQQLogin" is not able to access the database
"<YourDatabase>" under the current security context.

Confirmed by checking C:\EQQ\EQQ_App\logs\error<date>.log.

Root cause — EQQ uses two SQL Server security objects per client database:

Object What it is What breaks on restore
EQQLogin database user Maps the EQQLogin server login to a user inside each client DB SID in the restored DB no longer matches the server-level login — user becomes orphaned
QQCrossDbCertificate A certificate stored in both EQQuery and each client DB, used to sign EQQ stored procedures so they can execute cross-database Certificate in the client DB no longer matches the one in EQQuery after a restore

Fix — Maintain DB Permissions (in-app, no installer needed)

  1. Settings → Database.
  2. Click the wrench icon (Maintain Permissions) on the affected database row.
  3. Enter the SQL Server Admin User (sa) and Admin Password.
  4. Click Run.

EQQ checks each security object and auto-fixes what it can. The result table shows:

Column Meaning
Check Security object being verified (EQQLogin user, QQCrossDbCertificate, QQCertUser, AUTHENTICATE grant, …)
Passed Green ✔ = OK, Red ✗ = problem found
Auto-fixed Wrench icon = EQQ repaired it automatically
Note Detail on what was wrong or what was done

If All checks passed the query error will be gone. Repeat for each additional database that shows the same error.

If auto-fix fails — Manual Repair Option A (recommended)

Open SSMS connected to the SQL Server instance as sa, then run the bundled script:

EQQUtility\Scripts\AfterRestoreDatabase\0 Repair All Security After Restore.sql

The script reads the certificate password and folder path from tQQAppSettings / tQQControl automatically — no parameters to edit.

If auto-fix fails — Manual Repair Option B (T-SQL)

Before exporting the certificate, SQL Server writes files as its service account. You must first delete existing cert files and grant write permission:

$certFolder = "C:\EQQ\EQQ_Control\Certificate"

Remove-Item "$certFolder\QQCrossDbCertificate.cer" -ErrorAction SilentlyContinue
Remove-Item "$certFolder\QQCrossDbCertificate.pvk" -ErrorAction SilentlyContinue

$svc = Get-WmiObject Win32_Service -Filter "Name='MSSQLSERVER'" -ErrorAction SilentlyContinue
if (-not $svc) { $svc = Get-WmiObject Win32_Service | Where-Object { $_.Name -like 'MSSQL$*' } | Select-Object -First 1 }
icacls $certFolder /grant "$($svc.StartName):(OI)(CI)M" /T

Then in SSMS as sysadmin:

-- 1. Re-export the certificate from EQQuery
USE [EQQuery];
BACKUP CERTIFICATE [QQCrossDbCertificate]
  TO FILE = N'C:\EQQ\EQQ_Control\Certificate\QQCrossDbCertificate.cer'
  WITH PRIVATE KEY (
    FILE                   = N'C:\EQQ\EQQ_Control\Certificate\QQCrossDbCertificate.pvk',
    DECRYPTION BY PASSWORD = N'<cert-password-from-tQQAppSettings>',
    ENCRYPTION BY PASSWORD = N'<cert-password-from-tQQAppSettings>'
  );

-- 2. Import into the client database (repeat for each affected DB)
USE [YourDatabase];
IF EXISTS (SELECT 1 FROM sys.database_principals WHERE name = 'QQCertUser')
    DROP USER [QQCertUser];
IF EXISTS (SELECT 1 FROM sys.certificates WHERE name = 'QQCrossDbCertificate')
    DROP CERTIFICATE [QQCrossDbCertificate];

CREATE CERTIFICATE [QQCrossDbCertificate]
  FROM FILE = N'C:\EQQ\EQQ_Control\Certificate\QQCrossDbCertificate.cer'
  WITH PRIVATE KEY (
    FILE                   = N'C:\EQQ\EQQ_Control\Certificate\QQCrossDbCertificate.pvk',
    DECRYPTION BY PASSWORD = N'<cert-password>',
    ENCRYPTION BY PASSWORD = N'<cert-password>'
  );

-- 3. Re-create the certificate user and grant cross-database access
CREATE USER [QQCertUser] FOR CERTIFICATE [QQCrossDbCertificate];
GRANT AUTHENTICATE ON DATABASE::[YourDatabase] TO [QQCertUser];

After running, click Run in the Maintain Permissions dialog again to confirm all checks pass.

This also applies after adding a new database

After attaching a new database to EQQ via Settings → Database → Add, run Maintain Permissions on it to provision EQQLogin and the certificate before running any queries.

Log file locations (server side)

Log Path Content
Application errors App_Data/Logs/error.log Exceptions, stack traces. Rolling daily, 30-day retention.
Debug trace App_Data/Logs/debug.log Trace-level diagnostics.
Info events App_Data/Logs/info.log Logins, license checks, background jobs.

Getting help