Being Flooded with Security Event ID 4793 - Sql 2012 Windows 2008 R2

• maurizio_salviato

  SSC Veteran

  Points: 246

  More actions

  October 27, 2016 at 3:21 am

  #331242

  Hi all.

  I have a SQL server joined in a Active Directory Domain. The security event log is getting flooded (1 message every 30 seconds) with Event 4793 with the following content:

  Subject:

  Security ID:NT SERVICE\MSSQLSERVER

  Account Name:MSSQLSERVER

  Account Domain:NT Service

  Logon ID:0x22fc7

  Additional Information:

  Caller Workstation:MSCSSQL1

  Provided Account Name (unauthenticated):-

  Status Code:0x0

  I know that MSCSSQL1 is the name of the server

  Can anybody help me how to stop the flooding?

  Best Regards

• HanShi

  SSC-Dedicated

  Points: 33507

  More actions

  October 27, 2016 at 4:02 am

  #1909067

  Perhaps this gives you the insight about the cause:

  https://social.msdn.microsoft.com/Forums/sqlserver/en-US/79a9d797-7a09-40cb-85b4-f26d19fa1c45/being-flooded-with-security-event-id-4793-windows-2008-r2-sql-2008-r2?forum=sqlsecurity

  http://serverfault.com/questions/390026/being-flooded-with-security-event-id-4793-windows-2008-r2

  These articles mention it has to do with the Password Policy Check.

  ** Don't mistake the ‘stupidity of the crowd’ for the ‘wisdom of the group’! **