ORA-01031: insufficient privileges upon instance startup

Posted by David Yahalom under Windows, Oracle

A friend of mine who is a junior DBA approached me today with a strange problem that was bugging him for hours. He installed a new Windows Oracle 9i server and wanted to create the databases manually (something I always recommend over DBCA, as you get finger grain control over your database creation process and you feel more “in control” of whats going on inside your DB).

He created an init.ora file for his Instance and since he wanted to use OS authentication for Oracle, he left the parameter remote_login_passwordfile to its default value (”none”).

He then proceeded to creating his instance using the following command:

oradim -new -sid InstanceSID -startmode m -pfile C:location_to_pfileinit.ora -intpwd password

After which, the instance was created. He proceeded to creating the database itself. Since he was all keen about doing this manually he opened up a Windows CMD and did the following steps:

SET ORACLE_SID=InstanceSID
C:> sqlplus /nolog
SQL*Plus: Release 9.2.0.1.0 - Production on Wed Dec 13 10:18:27 2006
Copyright (c) 1982, 2002, Oracle Corporation. All rights reserved.
SQL> conn sys/password as sysdba
Connected to an idle instance.
SQL> startup nomount pfile=C:location_to_fileinit.ora;
ORA-01031: insufficient privileges
SQL>

As you see, he got an ORA-01031. He didn’t understand what is causing this. His O/S user was a member of the ORA_DBA group. He tried logging off windows and then logging backup in. Nothing.

The solution is actually quite simple. By default, if you install Oracle and don’t use the network configuration assistance you get a ORA_HOME without an SQLNET.ORA file. Without it, Oracle will not be able to use O/S authentication.

To solve this problem, simply create a file named sqlnet.ora in your %ORA_HOME%\network\network\admin directory and add to it the following line:

SQLNET.AUTHENTICATION_SERVICES = (NTS)

Save the file.

After this, try starting the instance using the same procedure described above and your O/S based logon should work just fine!