Login Failed

dthillsr used Ask the Experts™
I am getting a Failure Audit in the Application event log for a SQL database. I am not a DBA but know enough SQL to be dangerous. The errors occur on a database that is not used anymore. It is offline, if I put it online the errors go away. I would like to put the database back online but not have the errors. The error I keep getting about every minute is login failed for user domain\user [CLIENT xxx.xxx.xxx.xxx]. The severity is 14 and a state of 16 in the SQL log. The good database does not generate the errors for the user. My goal as stated earlier is no errors and the database generating the errors put back offline without generating the errors.
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
dsackerContract ERP Admin/Consultant

Do you have some automated job running periodically that still checks that databases. Check in the SQL Alerts, open the Jobs, and check the list of jobs there. Sounds like something is still trying to run periodically.

If that doesn't work, check any tasks on the NT scheduler.

Please check for Automated Service of your computer (service which are started)


I checked the Task Schedular and there are no tasks running that have anything to do with SQL server. All Automatic services are started and I deleted the one job that was there and recreated it for the correct database and I do not have anything showing up under Alerts.
dsackerContract ERP Admin/Consultant

In the audit log, is there an IP address associated with the failure.

(I'm just running through the checklist of possibilities, including someone's terminal.)
Database Administrator
There might be below possibilities -

[1] If the login which you mentioned above can be seen in SQL Server.
Solution: Check the default database of the login. The defaultdb must be set to the db which you want to make offline.
Change it to some other database which is online and login has permission on that db.

[2] If you do not see the login on the server, this meant that the login is part of any Domain group - Run below and look for permission path. If you see NULL means login is part of a domain group.
exec master..xp_logininfo 'domain\login'

If you see that login is part of a domain group, change defaultdb of that domain group to any other db.

[3] An application login is trying to access this db. Look for IP-Address and run -
nslookup xxx.xxx.xxx.xxx
You might see the exact name of host causing the problem.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial