Re: Login failed for user NT AUTHORITY\NETWORK SERVICE

OK, with a bit of luck, patience and timing, I managed to get a trace of the
Audit Login Failed notice. It looks like our CRM application is having a bad
day and isn't able to logon to something. However, even though I enabled all
columns in the Profiler and made sure DatabaseName column was selected, I
only get columns ApplicationName - TextData listed. The all-important info
aon what table the service is trying to access is still missing.

Any thoughts?

"Matt" wrote:

I ment to say "I end up with a Trace error in the log as soon as the server
goes
OFFLINE and the logging stops".

Just to be clear, I see the Failed Audit login message in the SQL log only
when I start the start the server. It doesnn't continuely happen, therefore
the only time I can try and trace the cause of the issue is as the server
starts up

"Matt" wrote:

Thanks Pawel,

The only way I am able to force the netork login failure is by restarting
the MSSQL server process. Of course, when I do this with the Profiler
running, I end up with a Trace error in the log as soon as the server goes
online and the logging stops. Any idea how I can make the Profiler keep
running even when the server gets restarted? Or is there a way that I can
make the profiler start when the server starts before loading anything else?

Matt

"Pawel Potasinski" wrote:

Well, it seems that some process working in Network Service user context is
trying to connect your instance and Network Service has no permission to
connect the target database in SQL Server. Run SQL Server Profiler and catch
failed login attempts (catch Audit Login Failed event with ApplicationName
and DatabaseName columns selected to trace).

--
Regards
Pawel Potasinski
[http://www.potasinski.pl]


U¿ytkownik "Matt" <Matt@xxxxxxxxxxxxxxxxxxxxxxxxx> napisa³ w wiadomo¶ci
news:AB02D9C1-DF84-4A43-BCA5-4A84B8323525@xxxxxxxxxxxxxxxx
Hi All,

I've done some searching around but can't find an answer to this problem.
I've recently noticed an error in the event logs relating to the Network
Service account trying to connect to my SQL 2005 server. The logs give me
the following information :-

12/06/2007 23:30:01,Logon,Unknown,Login failed for user 'NT
AUTHORITY\NETWORK SERVICE'. [CLIENT: 10.0.0.4]
12/06/2007 23:30:01,Logon,Unknown,Error: 18456<c/> Severity: 14<c/> State:
16.

This is all the info I have to go on. Can anyone provide me with some
assistance with trying to troubleshoot?



.

Relevant Pages

  • Re: Running profiler on busy 8-cpu Sql Server
    ... I always start with a light trace and add more detail as I go along to ... SQL Server MVP ... > I think it's also worth saying that you should introduce Profiler ... > SQL Server MVP ...
    (microsoft.public.sqlserver.server)
  • Re: URGENT deadlock question
    ... > Profiler to view a trace, SQL Server dumps rowsets across the network to ... > SQL Server doesn't feel like it can keep up with all the activity. ... > server-side trace to a trace file guarantees you'll see everything. ...
    (microsoft.public.sqlserver.server)
  • Re: URGENT deadlock question
    ... >> network to the Profiler client, but there is no guarantee you'll see ... >> everything if SQL Server doesn't feel like it can keep up with all ... Just make sure the trace file is created on a local ...
    (microsoft.public.sqlserver.server)
  • Re: SQL 7 Traces
    ... Profiler 2K can generate the xp calls for a defined trace in 7 format. ... Tibor Karaszi, SQL Server MVP ...
    (microsoft.public.sqlserver.programming)
  • Re: Per databse CPU usage
    ... You might want to use a server-side trace instead of Profiler if you're ... SQL Server MVP ... > We are experiencing CPU performance issues, some requests just> take all the CPU for 10 to 20 seconds. ...
    (microsoft.public.sqlserver.server)