gddl630
asked on
procedure=xp_cmdshell text=An error occurred during the execution of xp_cmdshell
we are occasionally getting
Server message number=15121 severity=16 state=200 line=1 server=MARILYN procedure=xp_cmdshell text=An error occurred during the execution of xp_cmdshell. A call to 'LogonUserW' failed with error code: '1909'.
and this seems to fix it, albeit temporarily!?
Exec sp_xp_cmdshell_proxy_accou nt NULL
Exec sp_xp_cmdshell_proxy_accou nt 'domain\account', 'therightpassword'
any ideas why this may be happening?
this is fully patched w2k3 server R2 SP2 x64; sql2005 SP3 - Microsoft SQL Server 2005 9.00.4053.00 (X64)
Server message number=15121 severity=16 state=200 line=1 server=MARILYN procedure=xp_cmdshell text=An error occurred during the execution of xp_cmdshell. A call to 'LogonUserW' failed with error code: '1909'.
and this seems to fix it, albeit temporarily!?
Exec sp_xp_cmdshell_proxy_accou
Exec sp_xp_cmdshell_proxy_accou
any ideas why this may be happening?
this is fully patched w2k3 server R2 SP2 x64; sql2005 SP3 - Microsoft SQL Server 2005 9.00.4053.00 (X64)
Could it be the account is getting locked out due to some policy about maximum concurrent (NT) sessions or something? Can you have a look in the Windows Event Log (Security) for any errors associated with the account?
ASKER
not sure I've never had to do anything to limit maximum concurrent (NT) sessions - how do I check that?
as for the event log I can see entries like this one although no specific account is being mentioned
as for the event log I can see entries like this one although no specific account is being mentioned
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: 10/04/2010
Time: 05:39:23
User: NT AUTHORITY\SYSTEM
Computer: MARILYN
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name:
Domain:
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name: -
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
You could look at the Resultant-Set-of-Policy for the user to see if there's anything weird going on with policies. Here's a Microsoft KB on how to do this:
http://support.microsoft.com/kb/323276
http://support.microsoft.com/kb/323276
ASKER
thanks
I couldn't see anything unusual, but to point out again executing this fixes it:
Exec sp_xp_cmdshell_proxy_accou nt NULL
Exec sp_xp_cmdshell_proxy_accou nt 'domain\account', 'therightpassword'
I couldn't see anything unusual, but to point out again executing this fixes it:
Exec sp_xp_cmdshell_proxy_accou
Exec sp_xp_cmdshell_proxy_accou
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.