Solved

Event Log - Type: Failure Aud - Event ID: 18456 - Login failed for user 'NT AUTHORITY\NETWORK SERVICE'. [CLIENT: <named pipe>]

Posted on 2007-12-04
20
23,792 Views
Last Modified: 2012-06-27
Event Type:      Failure Audit
Event Source:      MSSQL$MICROSOFT##SSEE
Event Category:      (4)
Event ID:      18456
Date:            12/3/2007
Time:            11:45:00 PM
User:            NT AUTHORITY\NETWORK SERVICE
Computer:      SIMON
Description:
Login failed for user 'NT AUTHORITY\NETWORK SERVICE'. [CLIENT: <named pipe>]

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 18 48 00 00 0e 00 00 00   .H......
0008: 16 00 00 00 53 00 49 00   ....S.I.
0010: 4d 00 4f 00 4e 00 5c 00   M.O.N.\.
0018: 4d 00 49 00 43 00 52 00   M.I.C.R.
0020: 4f 00 53 00 4f 00 46 00   O.S.O.F.
0028: 54 00 23 00 23 00 53 00   T.#.#.S.
0030: 53 00 45 00 45 00 00 00   S.E.E...
0038: 07 00 00 00 6d 00 61 00   ....m.a.
0040: 73 00 74 00 65 00 72 00   s.t.e.r.
0048: 00 00                     ..      
0
Comment
Question by:bcmeyer1983
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 11
  • 8
20 Comments
 
LVL 51

Expert Comment

by:Netman66
ID: 20402791
Change the logon account for this service MSSQL$MICROSOFT##SSEE to the local SYSTEM account.

After restarting the service with the new account, try changing it back to Network Service with no password and see if it sticks.

If not, continue using the SYSTEM account.

0
 
LVL 2

Author Comment

by:bcmeyer1983
ID: 20402808
The first thing i did was look for that service. It does not exist on the server.....?
0
 
LVL 51

Expert Comment

by:Netman66
ID: 20404102
You have no MSSQL$ service at all on that server?
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 2

Author Comment

by:bcmeyer1983
ID: 20404188
i have:
mssql$bkupexec
mssql$sbsmonitoring
mssql$sharepoint
0
 
LVL 2

Author Comment

by:bcmeyer1983
ID: 20404194
they all three are on local system account
0
 
LVL 51

Expert Comment

by:Netman66
ID: 20408327
Interesting...the error would suggest one of the SQL accounts is using Network Service as a logon point but is failing.

If you open SQL Manager, is the Network Service account set on any of the DBs?
0
 
LVL 2

Author Comment

by:bcmeyer1983
ID: 20414968
partner of mine is telling me that this is related to sharepoint services. what can i do to check that?
0
 
LVL 2

Author Comment

by:bcmeyer1983
ID: 20415042
ok so i have it narrowed down to the following service:
Windows Internal Database (MICROSOFT##SSEE)
here is the path: C:\WINDOWS\SYSMSI\SSEE\MSSQL.2005\MSSQL\Binn\sqlservr.exe -sMICROSOFT##SSEE

what is this?
0
 
LVL 51

Expert Comment

by:Netman66
ID: 20415424
It's the Sharepoint DB.

0
 
LVL 2

Author Comment

by:bcmeyer1983
ID: 20415457
what can i check to get the error to stop?
0
 
LVL 51

Expert Comment

by:Netman66
ID: 20418791
What account does that service use to logon?
0
 
LVL 2

Author Comment

by:bcmeyer1983
ID: 20419364
now local, with errors still occuring...
0
 
LVL 51

Expert Comment

by:Netman66
ID: 20419903
Ok, now try rebooting the server so everything comes up in sequence.

0
 
LVL 2

Author Comment

by:bcmeyer1983
ID: 21125355
sorry for the delay and putting this on the back burner. but i still have this flooding my event log every couple of minutes. I have rebooted the server and changed the logon type to local, and also tried specifying the admin account with no luck....
0
 
LVL 2

Author Comment

by:bcmeyer1983
ID: 21125367
Event Type:      Failure Audit
Event Source:      MSSQL$MICROSOFT##SSEE
Event Category:      (4)
Event ID:      18456
Date:            3/14/2008
Time:            9:39:59 AM
User:            NT AUTHORITY\NETWORK SERVICE
Computer:      SIMON
Description:
Login failed for user 'NT AUTHORITY\NETWORK SERVICE'. [CLIENT: <named pipe>]

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00004818 0000000e 00000016 00490053
0010: 004f004d 005c004e 0049004d 00520043
0020: 0053004f 0046004f 00230054 00530023
0030: 00450053 00000045 00000007 0061006d
0040: 00740073 00720065 0000
0
 
LVL 51

Expert Comment

by:Netman66
ID: 21126258
Find this service: MSSQL$MICROSOFT##SSEE (or one corresponding to it)
Change the logon username to Local System.

0
 
LVL 2

Author Comment

by:bcmeyer1983
ID: 21126674
using the services.msc command i have changed: mssql$sharepoint to use local system
i will update you shortly


0
 
LVL 2

Author Comment

by:bcmeyer1983
ID: 21126719
no luck, same error...help
0
 
LVL 51

Accepted Solution

by:
Netman66 earned 500 total points
ID: 21126910
Interesting.  The error you posted showed the Network account had no permission, the SYSTEM should have.

This isn't "exactly" the error you are seeing - but I believe it should help you solve the issue.

http://support.microsoft.com/default.aspx?scid=kb;en-us;947378

I think it's related to Read permissions on the DB for Sharepoint.  

0
 

Expert Comment

by:PMajon
ID: 23604351
This solved the issue for me as well. My WSUS install corrupted after a migration from a VMware server to a Virtual Iron VM.

Find this service: MSSQL$MICROSOFT##SSEE (or one corresponding to it)
Change the logon username to Local System.

I then proceeded to uninstall WSUS 3 w/SP1 and reinstalled it.

My MSSQL$MICROSOFT##SSEE service is still using the local system account. What is the harm in leaving it this way? What is the procedure to revert it to the previous account permissions?
0

Featured Post

Salesforce Made Easy to Use

On-screen guidance at the moment of need enables you & your employees to focus on the core, you can now boost your adoption rates swiftly and simply with one easy tool.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, I had the need to build a standalone system to run a point-of-sale system. I’m running this on a low-voltage Atom processor, so I wanted a light-weight operating system, but still needed Windows. I chose to use Microsoft Windows Server 200…
On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question