bcmeyer1983
asked on
Event Log - Type: Failure Aud - Event ID: 18456 - Login failed for user 'NT AUTHORITY\NETWORK SERVICE'. [CLIENT: <named pipe>]
Event Type: Failure Audit
Event Source: MSSQL$MICROSOFT##SSEE
Event Category: (4)
Event ID: 18456
Date: 12/3/2007
Time: 11:45:00 PM
User: NT AUTHORITY\NETWORK SERVICE
Computer: SIMON
Description:
Login failed for user 'NT AUTHORITY\NETWORK SERVICE'. [CLIENT: <named pipe>]
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 18 48 00 00 0e 00 00 00 .H......
0008: 16 00 00 00 53 00 49 00 ....S.I.
0010: 4d 00 4f 00 4e 00 5c 00 M.O.N.\.
0018: 4d 00 49 00 43 00 52 00 M.I.C.R.
0020: 4f 00 53 00 4f 00 46 00 O.S.O.F.
0028: 54 00 23 00 23 00 53 00 T.#.#.S.
0030: 53 00 45 00 45 00 00 00 S.E.E...
0038: 07 00 00 00 6d 00 61 00 ....m.a.
0040: 73 00 74 00 65 00 72 00 s.t.e.r.
0048: 00 00 ..
Event Source: MSSQL$MICROSOFT##SSEE
Event Category: (4)
Event ID: 18456
Date: 12/3/2007
Time: 11:45:00 PM
User: NT AUTHORITY\NETWORK SERVICE
Computer: SIMON
Description:
Login failed for user 'NT AUTHORITY\NETWORK SERVICE'. [CLIENT: <named pipe>]
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 18 48 00 00 0e 00 00 00 .H......
0008: 16 00 00 00 53 00 49 00 ....S.I.
0010: 4d 00 4f 00 4e 00 5c 00 M.O.N.\.
0018: 4d 00 49 00 43 00 52 00 M.I.C.R.
0020: 4f 00 53 00 4f 00 46 00 O.S.O.F.
0028: 54 00 23 00 23 00 53 00 T.#.#.S.
0030: 53 00 45 00 45 00 00 00 S.E.E...
0038: 07 00 00 00 6d 00 61 00 ....m.a.
0040: 73 00 74 00 65 00 72 00 s.t.e.r.
0048: 00 00 ..
ASKER
The first thing i did was look for that service. It does not exist on the server.....?
You have no MSSQL$ service at all on that server?
ASKER
i have:
mssql$bkupexec
mssql$sbsmonitoring
mssql$sharepoint
mssql$bkupexec
mssql$sbsmonitoring
mssql$sharepoint
ASKER
they all three are on local system account
Interesting...the error would suggest one of the SQL accounts is using Network Service as a logon point but is failing.
If you open SQL Manager, is the Network Service account set on any of the DBs?
If you open SQL Manager, is the Network Service account set on any of the DBs?
ASKER
partner of mine is telling me that this is related to sharepoint services. what can i do to check that?
ASKER
ok so i have it narrowed down to the following service:
Windows Internal Database (MICROSOFT##SSEE)
here is the path: C:\WINDOWS\SYSMSI\SSEE\MSS
what is this?
Windows Internal Database (MICROSOFT##SSEE)
here is the path: C:\WINDOWS\SYSMSI\SSEE\MSS
what is this?
It's the Sharepoint DB.
ASKER
what can i check to get the error to stop?
What account does that service use to logon?
ASKER
now local, with errors still occuring...
Ok, now try rebooting the server so everything comes up in sequence.
ASKER
sorry for the delay and putting this on the back burner. but i still have this flooding my event log every couple of minutes. I have rebooted the server and changed the logon type to local, and also tried specifying the admin account with no luck....
ASKER
Event Type: Failure Audit
Event Source: MSSQL$MICROSOFT##SSEE
Event Category: (4)
Event ID: 18456
Date: 3/14/2008
Time: 9:39:59 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: SIMON
Description:
Login failed for user 'NT AUTHORITY\NETWORK SERVICE'. [CLIENT: <named pipe>]
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00004818 0000000e 00000016 00490053
0010: 004f004d 005c004e 0049004d 00520043
0020: 0053004f 0046004f 00230054 00530023
0030: 00450053 00000045 00000007 0061006d
0040: 00740073 00720065 0000
Event Source: MSSQL$MICROSOFT##SSEE
Event Category: (4)
Event ID: 18456
Date: 3/14/2008
Time: 9:39:59 AM
User: NT AUTHORITY\NETWORK SERVICE
Computer: SIMON
Description:
Login failed for user 'NT AUTHORITY\NETWORK SERVICE'. [CLIENT: <named pipe>]
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00004818 0000000e 00000016 00490053
0010: 004f004d 005c004e 0049004d 00520043
0020: 0053004f 0046004f 00230054 00530023
0030: 00450053 00000045 00000007 0061006d
0040: 00740073 00720065 0000
Find this service: MSSQL$MICROSOFT##SSEE (or one corresponding to it)
Change the logon username to Local System.
Change the logon username to Local System.
ASKER
using the services.msc command i have changed: mssql$sharepoint to use local system
i will update you shortly
i will update you shortly
ASKER
no luck, same error...help
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
This solved the issue for me as well. My WSUS install corrupted after a migration from a VMware server to a Virtual Iron VM.
Find this service: MSSQL$MICROSOFT##SSEE (or one corresponding to it)
Change the logon username to Local System.
I then proceeded to uninstall WSUS 3 w/SP1 and reinstalled it.
My MSSQL$MICROSOFT##SSEE service is still using the local system account. What is the harm in leaving it this way? What is the procedure to revert it to the previous account permissions?
Find this service: MSSQL$MICROSOFT##SSEE (or one corresponding to it)
Change the logon username to Local System.
I then proceeded to uninstall WSUS 3 w/SP1 and reinstalled it.
My MSSQL$MICROSOFT##SSEE service is still using the local system account. What is the harm in leaving it this way? What is the procedure to revert it to the previous account permissions?
After restarting the service with the new account, try changing it back to Network Service with no password and see if it sticks.
If not, continue using the SYSTEM account.