Post reply

Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.

  • September 29, 2010 at 11:28 am

    #241026

    We get this error on our SQL Server 2005 with SP3 about every minute:

    Event Type:Failure Audit

    Event Source:MSSQLSERVER

    Event Category:(4)

    Event ID:18456

    Date:9/29/2010

    Time:1:23:50 PM

    User:NT AUTHORITY\ANONYMOUS LOGON

    Computer:XXXXXXX

    Description:

    Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. [CLIENT: 12.xx.xx.xx]

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    Data:

    0000: 18 48 00 00 0e 00 00 00 .H......

    0008: 07 00 00 00 4c 00 53 00 ....L.S.

    0010: 53 00 51 00 4c 00 31 00 S.Q.L.1.

    0018: 00 00 07 00 00 00 6d 00 ......m.

    0020: 61 00 73 00 74 00 65 00 a.s.t.e.

    0028: 72 00 00 00 r...

    The IP address is the address of the server itself. We thought that it might be related to having anonymous access turned on for Analysis Services, but I disabled it, hit Apply, and the messages kept coming. Any idea how we can find out what is attempting to authenticate so we can disable it.

    Thanks,

    Adam

  • September 29, 2010 at 1:39 pm

    #1229303

    Run a profiler trace with the event "Audit Login Failed" selected. The trace should give you the Application Name with which the login is trying to connect

    Pradeep Adiga
    Blog: sqldbadiaries.com
    Twitter: @pradeepadiga

Viewing 2 posts - 1 through 1 (of 1 total)

You must be logged in to reply to this topic. Login to reply