Error: 18456, Severity: 14, State: 11. Login-based server access validation failed with an infrastructure error We are getting the above error on a SQL 2012 server running Windows Server 2008R2 when connecting using an application and a service account. The server also has Config Manager database and GAP policy applied

The login will work if the user is sysadmin (but the application won't)  

Of course we have looked at Aaron Bertrand's post on 18456 errors, which states:


  States 11 &amp; 12 mean that SQL Server was able to authenticate you, but weren't able to validate with the underlying Windows permissions. It could be that the Windows login has no profile or that permissions could not be checked due to UAC. Try running SSMS as administrator and/or disabling UAC. Another reason could be that the domain controller could not be reached. You may need to resort to re-creating the login (see this post from Simon Sabin).


and also http://blog.sqlauthority.com/2015/08/19/sql-server-login-failed-for-user-reason-token-based-server-access-validation-failed-with-an-infrastructure-error/

So we have ensured that we have a profile on the servers by logging on with the service account.
We have run the application as administrator
We have confirmed connectivity to the DC
We have removed and re-created the login
We have confirmed there are no DENYs for the user or group  

We have confirmed that the user and also the public role has connect permissions to the ConfigMgrEndpoint as well as SQL

What have we missed?
What else do we need to do to resolve this issue?
Check the new endpoint name on sys.endpoints table and grant connect permission for the user. The new endpoint name should be different from "TSQL Default TCP".

Use this script for windows login:

GRANT CONNECT ON ENDPOINT::"NEW_ENDPOINT_NAME" TO [DOMAIN\firstname.lastname]


Or use this for sql authentication login:

GRANT CONNECT ON ENDPOINT::"NEW_ENDPOINT_NAME" TO "username"