Failed Login trace with little data

• T_Peters

  Hall of Fame

  Points: 3052

  More actions

  April 16, 2009 at 10:58 am

  #220231

  Greetings,

  I'm trying to track down the source of some failed logins, but my trace isn't showing much information. I have the Security Audit > Audit Login Failed event selected with all of the columns, but most of the failed logins don't have an ApplicationName or HostName associated with them. Any ideas on how to track down the source of these?

  Thanks,

  Tim

• Rick Todd

  Hall of Fame

  Points: 3302

  More actions

  June 12, 2009 at 7:53 am

  #1008655

  I'm in exactly the same situation. If I figure out how to do it, I'll let you know.

  
  Rick Todd

• Rick Todd

  Hall of Fame

  Points: 3302

  More actions

  June 12, 2009 at 8:59 am

  #1008726

  OK, figured it out.

  I wrote a blog post about how to deal with it, and rather than reproduce it here:

  http://dwexperience.blogspot.com/2009/06/troubleshooting-researching-or-tracking.html

  HTH,

  
  Rick Todd

• RBarryYoung

  SSC Guru

  Points: 143329

  More actions

  June 12, 2009 at 9:14 am

  #1008743

  Nice writeup, Rick. You should consider submitting this as an article here.

  [font="Times New Roman"]-- RBarryYoung[/font], [font="Times New Roman"] (302)375-0451[/font] blog: MovingSQL.com, Twitter: @RBarryYoung[font="Arial Black"]
  Proactive Performance Solutions, Inc. [/font][font="Verdana"] "Performance is our middle name."[/font]