Post reply

Frequent Error message: Login failed for user

  • August 4, 2004 at 11:41 am

    #86209

    I am getting frequent error messages in the error log "Login failed for user xxx"  the two accounts that get errors are a SQL account and a Domain account.  The domain account is the same account that runs the SQL Service and agent.  I'm not sure how to go about to troubleshoot this issue.  Any ideas or suggestion would be helpfull.

    Thanks

     

  • August 4, 2004 at 12:54 pm

    #517702

    For the domain account, check your system event logs to see if you have any errors at the same time indicating a domain controller was unavailable. The SQL Server one wouldn't be related to that. Are there any automated processes that might be running as these accounts? Have you run a profiler trace to see what host these failures may be coming from?

    K. Brian Kelley
    @kbriankelley

  • August 5, 2004 at 7:59 am

    #517835

    I don't know what you mean by 'frequent' login failures. But I have had cases where I was getting login failures every second for a single login. It turned out the user was trying to 'map' to my drive and that was causing the failures.

    -SQLBill

  • August 5, 2004 at 9:48 am

    #517867

    Saw something similar once: I noticed 19 consecutive login failures from each login on one of my SQL Server instances - all in under a minute! I immediately started a profiler trace. Then it happened again on a different box. I thought I was getting hit with a dictionary attack so I turned the profiler trace on for each MSSQL instance I support. Sure enough it happened again - it turned out to be one of the sysadmins running the "Microsoft Baseline Security Analzyzer"! (to check that a Windows update went through). DOH!!

Viewing 4 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic. Login to reply