Re: Login failed for user NT AUTHORITY\NETWORK SERVICE

I ment to say "I end up with a Trace error in the log as soon as the server
goes
OFFLINE and the logging stops".

Just to be clear, I see the Failed Audit login message in the SQL log only
when I start the start the server. It doesnn't continuely happen, therefore
the only time I can try and trace the cause of the issue is as the server
starts up

"Matt" wrote:

Thanks Pawel,

The only way I am able to force the netork login failure is by restarting
the MSSQL server process. Of course, when I do this with the Profiler
running, I end up with a Trace error in the log as soon as the server goes
online and the logging stops. Any idea how I can make the Profiler keep
running even when the server gets restarted? Or is there a way that I can
make the profiler start when the server starts before loading anything else?

Matt

"Pawel Potasinski" wrote:

Well, it seems that some process working in Network Service user context is
trying to connect your instance and Network Service has no permission to
connect the target database in SQL Server. Run SQL Server Profiler and catch
failed login attempts (catch Audit Login Failed event with ApplicationName
and DatabaseName columns selected to trace).

--
Regards
Pawel Potasinski
[http://www.potasinski.pl]


U¿ytkownik "Matt" <Matt@xxxxxxxxxxxxxxxxxxxxxxxxx> napisa³ w wiadomo¶ci
news:AB02D9C1-DF84-4A43-BCA5-4A84B8323525@xxxxxxxxxxxxxxxx
Hi All,

I've done some searching around but can't find an answer to this problem.
I've recently noticed an error in the event logs relating to the Network
Service account trying to connect to my SQL 2005 server. The logs give me
the following information :-

12/06/2007 23:30:01,Logon,Unknown,Login failed for user 'NT
AUTHORITY\NETWORK SERVICE'. [CLIENT: 10.0.0.4]
12/06/2007 23:30:01,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State:
16.

This is all the info I have to go on. Can anyone provide me with some
assistance with trying to troubleshoot?



.

Relevant Pages

  • Re: Running profiler on busy 8-cpu Sql Server
    ... I always start with a light trace and add more detail as I go along to ... SQL Server MVP ... > I think it's also worth saying that you should introduce Profiler ... > SQL Server MVP ...
    (microsoft.public.sqlserver.server)
  • Re: Running profiler on busy 8-cpu Sql Server
    ... * I regularly run Profiler on VERy busy servers. ... where customers have told me 'theres no way to run Profiler, our server is ... SQL Server MVP ...
    (microsoft.public.sqlserver.server)
  • Re: URGENT deadlock question
    ... > Profiler to view a trace, SQL Server dumps rowsets across the network to ... > SQL Server doesn't feel like it can keep up with all the activity. ... > server-side trace to a trace file guarantees you'll see everything. ...
    (microsoft.public.sqlserver.server)
  • Re: Running profiler on busy 8-cpu Sql Server
    ... I also regularly use it on VERY busy servers nearly always without ... I think it's also worth saying that you should introduce Profiler gradually ... SQL Server MVP ... > SQL Server MVP ...
    (microsoft.public.sqlserver.server)
  • Re: SQL Profiler producing phantom traffic
    ... Could it be that there was a server side trace running? ... Vyas, MVP (SQL Server) ... > used profiler to help with their coding. ... > between the users machine and the SQL server. ...
    (microsoft.public.sqlserver.server)