RE: Application error event every minute on MSSQLSERVER : "Failure Audit: Login failed for user 'NT AUTHORITY\SYSTEM' [Client: <local machine>]
- From: changliw@xxxxxxxxxxxxxxxxxxxx ("Charles Wang [MSFT]")
- Date: Tue, 20 May 2008 03:59:53 GMT
Hi KF,
I understand that you found the error message every minute in your event
error logs and that you would like to know how to work around this issue.
If I have misunderstood, please let me know.
As a possible workaround, I recommend that you first try explicitly adding
"NT AUTHORITY\SYSTEM" as a login to your SQL Server instance. If your SQL
Server is 2000, you can open Enterprise Manager, expand your SQL Server
instance, go to Security directly, right click Logins and click New
Login..., and then add the Windows login "NT AUTHORITY\SYSTEM". If your SQL
Server is 2005, you can do this in SQL Server Management Studio. You may
also explicitly assign the fixed server role "sysadmin" to it.
Also since "NT AUTHORITY\SYSTEM" is a service account, I think that some
service running under the account access your SQL Server instance every
minute. You may first check if it is your SQL Server Agent services. If
not, you can run SQL Profiler to monitor your SQL Server instance and add
the event "Audit Login failed". You may refer to these articles:
Using SQL Profiler (For SQL 2000)
http://www.microsoft.com/technet/prodtechnol/sql/70/tips/sqlprof.mspx
How to: Specify Events and Data Columns for a Trace File (SQL Server
Profiler)
http://msdn.microsoft.com/en-us/library/ms188674.aspx
From the SQL Profiler, you should be able to see the message regarding"Audit Login Failed" event and from the message you can find which service
(ApplicationName) submits a login.
Note that SQL Profiler is a component in SQL Server Standard Edition or
Enterprise Edition. You can find SQL Profiler from (SQL 2000) Start->All
Programs->Microsoft SQL Server->Profiler or (SQL 2005) Start->All
Programs->Microsoft SQL Server 2005->Performance Tools->SQL Server
Profiler.
Then you can change the service's startup account from Services from
control panel. Go to Services, double click the service, switch to the Log
On tab, change the service account to a domain user account and then
restart your service. You need to also ensure that the domain user account
is added to the logins of your SQL Server instance.
Hope this helps. If you have any other questions or concerns, please feel
free to let me know.
Best regards,
Charles Wang
Microsoft Online Community Support
===========================================================
Delighting our customers is our #1 priority. We welcome your
comments and suggestions about how we can improve the
support we provide to you. Please feel free to let my manager
know what you think of the level of service provided. You can
send feedback directly to my manager at: msdnmg@xxxxxxxxxxxxxx
===========================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.
Note: The MSDN Managed Newsgroup support offering is for
non-urgent issues where an initial response from the community
or a Microsoft Support Engineer within 1 business day is acceptable.
Please note that each follow up response may take approximately
2 business days as the support professional working with you may
need further investigation to reach the most efficient resolution.
The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by
contacting Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
============================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
=========================================================
.
- Follow-Ups:
- References:
- Prev by Date: RE: Msg 15404: Could not obtain information about user
- Next by Date: Re: SSL SQL 2005
- Previous by thread: Application error event every minute on MSSQLSERVER : "Failure Audit: Login failed for user 'NT AUTHORITY\SYSTEM' [Client: <local machine>]
- Next by thread: Re: Application error event every minute on MSSQLSERVER : "Failure Audit: Login failed for user 'NT AUTHORITY\SYSTEM' [Client: <local machine>]
- Index(es):
Relevant Pages
|
