Re: Login failed for user 'NT AUTHORITY\SYSTEM'

From: Robert Morley (rmorley_at_magma.ca.no.freakin.spam)
Date: 06/27/05 

Date: Mon, 27 Jun 2005 13:04:48 -0400

Don't know if you've solved your problem by now, but have you tried looking
at Linked/Remote servers? Depending how they're set up, they could be
trying to use NT AUTHORITY\SYSTEM and giving errors.

"Harold" <Harold@discussions.microsoft.com> wrote in message
news:3E0C8E46-13F1-4FD5-A8CD-0C2E51E0DCF0@microsoft.com...
>I have been getting a Login failed for user 'NT AUTHORITY\SYSTEM ' in my
>SQL
> server log every 30 minutes. I have run a trace to see what might be
> getting
> submitted to sql but nothing comes in for it.
> I have removed the built in administrators account but I added the NT
> AUTHORITY\SYSTEM account. This account had sysadmin privledges and it does
> get used and works. I fell that it might be something trying to access the
> physical files but do not know how to trace it down.
> The alerts are happening on 2000 server and 2003 server OS's.
>
> Any ideas?
>
> Thanks

Relevant Pages

  • Re: How can I tell if Im running as a service
    ... In particular, my reading ... of the meaning of SECURITY_SERVICE_RID is that the account is authorized to ... I also noticed that I could trace the lineage of service processes all ...
    (microsoft.public.win32.programmer.kernel)
  • Re: Incoming Call Tracing
    ... logic would suggest that they could back trace. ... made on your account certainly for past 3months. ... Yeah ithink they can do it......but ... How about getting caller display? ...
    (uk.telecom)
  • Re: Computer crash
    ... The software and associated registry keys are gone, so yeah, all trace of PP ... access which accounts, so if Party and Empire share that info, they could ... Somehow I doubt they would turn you down for an Empire account on ...
    (rec.gambling.poker)
  • Re: OT Help with posting
    ... Giganews is exactly the same (they themsleves ... could trace you but would only do so if you were spamming) you'd have ... individual net has in their terms and conditions that you ... They need a real address to post your account name and password to but as ...
    (alt.support.diabetes)
  • Re: OT PayPal
    ... At the moment we are trying to trace and resolve the provenience of this matter, so please get involved in helping us trace these bruteforcing attempts. ... Use the link below to access our mainframe database and confirm the information we have on file for your account. ... PayPal is committed in assisting law enforcement with any inquires related to attempts to misappropriate personal information with the intent to commit fraud or theft. ... Or better still copy the source code of the email then post it here as these scammers can be pesky so and so's and disguise the links destination, but you should be able too see how in the source code of the email. ...
    (uk.sport.football.clubs.celtic)