Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 8406
  • Last Modified:

MSSQLServer Failure Audit Event ID 18456, Category (4)

We're running Windows Server 2003 x64, SQL 2005 x64, and MOSS SharePoint 2007 all on the same box.

We receive this error message in the event log every minute.  The strange thing is the user is NT Authority\Syste.

I'll post the text here as well as a screen shot.  Any ideas?  I've tried solutions recommended on eventid.net to no avail.

Type: Failure Audit
Event ID: 18456
Category (4)
Computer: PLATO
Description: Login failed for user 'NT AUTHORITY\SYSTEM'. [CLIENT: <local machine>]

Data: 0000: 18 48 00 00 0e 00 00 00   .H......
0008: 06 00 00 00 50 00 4c 00   ....P.L.
0010: 41 00 54 00 4f 00 00 00   A.T.O...
0018: 07 00 00 00 6d 00 61 00   ....m.a.
0020: 73 00 74 00 65 00 72 00   s.t.e.r.
0028: 00 00                     ..      

1 Solution

 For the error in the ERRORLOG, the STATE tell that the process doesn't have permission of the login database. It apears to use NT authentication, running as localsystem. The possible cause might be because your sharepoint services are also set to run with nt authority\system.

Modify the sharepoint services logon a/c credentials by opening the services mmc (start>>run>>services.msc)

the errors should go away. additionally check the version of SQL and upgrade it to SP2


Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now