PREEMPTIVE_OS_AUTHENTICATIONOPS is recorded when a thread calls Windows security functions for authentication and authorisation work: validating logins, checking group memberships, building security tokens. The thread runs preemptively (outside SQL Server’s scheduler, state showing RUNNING) until Windows answers.
Every Windows-authenticated login touches this path, so some volume is a fact of life on domain-joined servers. The wait time is effectively a latency meter for your authentication infrastructure.
Is It a Problem?
Small, steady amounts, no. It becomes a genuine incident signal when average durations jump, because that means Active Directory calls are slow, and the symptom users report is “logging in to SQL Server takes ages” or intermittent connection timeouts, while everything already connected runs fine.
That combination, slow new connections but healthy running queries, is the classic fingerprint of this wait.
Common Causes
- Slow or overloaded domain controllers, or the server authenticating against a DC in a remote site.
- DNS misconfiguration sending authentication traffic to the wrong or dead DC.
- Large token sizes: accounts in thousands of AD groups make token building expensive.
- Network problems between the SQL Server and the DCs.
What To Do
- Correlate with connection behaviour: if login times degrade while this wait’s average climbs, the evidence points firmly outside SQL Server.
- Hand your infrastructure team the specifics: which server, what times, and that the SQL side is waiting on Windows authentication calls.
nltest /sc_query:<domain>and DC event logs pick it up from there. - Check which DC the server actually uses (
nltest /dsgetdc:<domain>) and whether sites and subnets route it sensibly. - For token bloat, group cleanup for the affected service accounts is the real fix.
How To See It
Rank it against everything else with Get-WaitStatistics. Watch the average duration over time; the count merely tracks how many logins you take.
Part of the SQL Server Wait Types Library.
Related deep dive: SOS_SCHEDULER_YIELD Wait Type.
Leave a Reply