Re: Failure Audit 18456

I assume that the client IP address is your web server address, is that
correct? Does your web application seem to be working properly?

Does your web application login as 'sa' to the SQL Server? Has the 'sa'
password been changed recently? Can you login as 'sa'?

For error 18456, there should be some 'state' information appearing in your
logs which will give a better clue as to the underlying reason. See:
http://blogs.msdn.com/sql_protocols/archive/2006/02/21/536201.aspx

RLF

<csgraham10001@xxxxxxxxxxxxxx> wrote in message
news:465474ad-fb66-4aa6-96ee-ae78782503ac@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
hi im currently having a problem on my webserver. im getting an error
message as below:

This is filling my event viewer very quickly - im thinking this is an
attack of some description. what must i do to make sure that they cant
damage my files ??? any help appreciated.

Event Type: Failure Audit
Event Source: MSSQL$SQLEXPRESS
Event Category: (4)
Event ID: 18456
Date: 21/10/2008
Time: 13:46:03
User: N/A
Computer: DS606
Description:
Login failed for user 'sa'. [CLIENT: 213.205.110.146]



.

Relevant Pages

  • Newbie question: How to move a web site to a local laptop?
    ... have a web site that shows a study we did. ... so pc acts as both web server and client? ... OS is windows2000 professional and we have a login page. ...
    (comp.lang.java.help)
  • Re: session object II
    ... web server does not hold a static connection with a client. ... Create a web service on the web server that will accept and return ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Quick Start certificate
    ... Where do I specify what the root path is. ... Then run the client. ... Did you give your web server identity permission to ... It's done through the certificate tool that's installed ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Quick Start certificate
    ... I have enabled diagnostics on the client and the web service. ... Did you give your web server identity permission to ... read the certificate on the server? ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • RE: Penetration test of 1 IP address
    ... It does not look like the login screen found on the ... Penetration test of 1 IP address ... "I have been asked to perform a security audit of 1 IP address for client." ...
    (Pen-Test)
Loading