Post reply

logon failed for user sa

  • February 12, 2023 at 7:31 pm

    Go to Answer

    #4148751

    Hello

    Immediately before running the daily backup created in SQL Server Configuration Manager, login errors appear in the SA account, but the system informs that the backups ended successfully.

    segbd

    The sql agent service account, is a domain administration account, which is sysadmin. Must I configure this account owner of the databases?

    This situation is related to the backup task, because I changed the backup execution time and the messages appeared too.

    If I perform a backup manually these messages do not appear.

    I installed the SQL with SQL Server and windows authentication mode.

    Can I have some help

    Thanks

    Urantia

     

     

     

     

  • February 13, 2023 at 11:08 am

    #4148961

    Hi,

    what kind of backup do you use?

    Maintenance Plans or regular jobs?

    Are there some steps in your job, or only one backup step?

    I think, we need more information to help you.

    Kind regards,

    Andreas

  • February 13, 2023 at 11:25 am

    #4148965

    Hi,

    what kind of backup do you use? - Maintenance Plans

    Are there some steps in your job, or only one backup step? --- 2 steps (backup and backups retention)

    Urantia

     

     

  • February 13, 2023 at 11:38 am

    #4148968

    It may be best adding an audit or an XE session to track more information about the login failure, more specifically the application name it is using, hopefully that will give you more insight into what is running at the time.

     

    It may also be whatever is attempting to backup the system database as those are being backed up by VSS, so what other backup software is in use and does that use scripts or has been misconfigured for the user databases.  Things like Veeam, NetBackup, Commvault etc.

  • February 13, 2023 at 11:50 am

    #4148974

    I do not use any aplication for the backup

    I use a Maintenance Plan  created in SQL Server Management Studio - 2 steps (backup and retention)

    Thanks

     

     

     

     

  • February 13, 2023 at 12:02 pm

    #4148985

    Hm,

    the message I/O frozen, I only can remember this message from snapshot backup of the sql server.

    If we use regular backup, I've never seen this message before. And we got about 200 sql server and a lot of databases, and a lot of backup jobs.

    Can you look at the owner of the backup job?

    Kind regards,

    Andreas

     

     

  • February 13, 2023 at 12:09 pm

    #4148989

    Urantia wrote:

    I do not use any aplication for the backup

    I use a Maintenance Plan  created in SQL Server Management Studio - 2 steps (backup and retention)

    Thanks

     

    You may not for your user databases but the system database sure are

    IO frozen

    IO resumed

    These are VSS backups, backing up your master/model/msdb databases.

  • February 13, 2023 at 9:05 pm

    #4149242

    Hello

    execution time

    Diario - not system database.

    Mensal . not system database

    Sistema - system database - Yes, Vss

    sysadmin role

    job owner

    job activity monitor

    The server is a domain controller and the account of the Sql Agent is the Administrator of the domain, wich is a sysadmin in SQL

    Thanks in advanced

    Urantia

     

     

     

     

  • February 14, 2023 at 11:15 am

    Answer

    #4149447

    SQL on a Domain Controller, wow you're brave, if SQL is compromised so could be your entire domain.

     

    So you need to setup a trace, extended event, audit to track failed logins, and ensure you are specifically capturing the application name that is being used when these failure occur.  That will then give you hopefully some better insights into what is attempting to login as SA and from what application, so you can go and troubleshoot this further.

  • February 15, 2023 at 10:54 am

    #4149959

    Yes, I know. Not the best choice (domain controller)

    Dificult to ensure that I capture specifically the application name, when I do not know the name

    Those logins failure occurs only when a backup databases task (manegement plan) is executed.

    But, Thanks anyway

    Best regards

     

Viewing 10 posts - 1 through 9 (of 9 total)

You must be logged in to reply to this topic. Login to reply