Solved

Windows Event Viewer has a lot of 'failure audit' events for failed logins

Posted on 2009-05-20
5
519 Views
Last Modified: 2012-05-07
I am receiving a lot of audits for people trying to access the SA account on SQL 2005. It looks to me to be from one IP address. I don't tend to use the SA account, so is this something I can rename or something similar? Would this stop the SA failed audits? I know it's probably a good idea to disable or rename the SA account so any help would be appreciated.
0
Comment
Question by:AbeSpain
  • 2
  • 2
5 Comments
 
LVL 42

Expert Comment

by:pcelba
ID: 24434160
The sa account renaming is a good idea and it increases security but it cannot stop attackers from their attemptes...
0
 
LVL 75

Accepted Solution

by:
Aneesh Retnakaran earned 500 total points
ID: 24434177
> Would this stop the SA failed audits?
no

If that ip doesnt belong to your network, possibly someone is trying to hack ur database, so better block those ip in your firewall

you can use the Windows authentication, that would be a great idea, but make sure that you chnage the connection string
0
 

Author Comment

by:AbeSpain
ID: 24434287
"you can use the Windows authentication, that would be a great idea, but make sure that you chnage the connection string "

Rather than auth using the users set up in the database?
0
 
LVL 75

Expert Comment

by:Aneesh Retnakaran
ID: 24434326
Yup. Windows authentication provides additional security, thats why i suggested you to use that.
0
 
LVL 42

Expert Comment

by:pcelba
ID: 24434494
The Windows authentication allows each Windows admin full SQL administrator access. I don't think this is correct in all situations.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Introduction In my previous article (http://www.experts-exchange.com/Microsoft/Development/MS-SQL-Server/SSIS/A_9150-Loading-XML-Using-SSIS.html) I showed you how the XML Source component can be used to load XML files into a SQL Server database, us…
This article shows gives you an overview on SQL Server 2016 row level security. You will also get to know the usages of row-level-security and how it works
Via a live example combined with referencing Books Online, show some of the information that can be extracted from the Catalog Views in SQL Server.
Viewers will learn how to use the UPDATE and DELETE statements to change or remove existing data from their tables. Make a table: Update a specific column given a specific row using the UPDATE statement: Remove a set of values using the DELETE s…

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question