How to resolve Event ID 18456 "Failure Audit"
I'm running into an issue where in event viewer on our SQL/Sharepoint server I get the error
Event ID 18456, Category (4), "Login failed for user 'NT AUTHORITY\NETWORK SERVICE'.[CLIENT:<local machine>], the event occurs every minute it seems. I'm having trouble narrowing down the source, even after enabling diagnostic logging on the Sharepoint server, we are using SQL Server Express version 2005. The actual server itself is running Windows 2003 SP2.
I've run though a few of the other resolutions on experts exchange to this event ID on other questions and have yet to come across a suitable solution.
Event ID 18456, Category (4), "Login failed for user 'NT AUTHORITY\NETWORK SERVICE'.[CLIENT:<local machine>], the event occurs every minute it seems. I'm having trouble narrowing down the source, even after enabling diagnostic logging on the Sharepoint server, we are using SQL Server Express version 2005. The actual server itself is running Windows 2003 SP2.
I've run though a few of the other resolutions on experts exchange to this event ID on other questions and have yet to come across a suitable solution.
ASKER
Thanks for providing feedback but I'm still confused. I have managed to locate the error log now and the Error: 18456 has Severity:14 and State:16. I believe it has to do with a old database we have removed but something is still trying to connect to it.
How would I isolate and remove this phantom connection?
How would I isolate and remove this phantom connection?
In sql accounts (for the server) you will find an accoun that has a nonexisting database. This account is the culprit, or the faulty logons target, when you see the databasename maybe youll figure out what local app/service/scheduled task thats been left orphan when removing the database.
Can you see a pattern, is it logon failures every minute, hour or what? Can this give you a clue.
Regards Marten
Can you see a pattern, is it logon failures every minute, hour or what? Can this give you a clue.
Regards Marten
What sql flabour arevwe talking about, standard, enterprice or express?
Are sql agent running?
Regards Marten
Are sql agent running?
Regards Marten
ASKER
2005 Express, yes I believe the sql agent is running.
2005 Express, yes I believe the sql agent is running.
SQL Server Express does not include/support SQL Server Agent.
SQL Server Express does not include/support SQL Server Agent.
There is no profiler tool or sql agent in express!
You have an old app om the server someware.
Not a sql thing but, click start and ru, type msconfig and hit enter.
Now examine all things that starts automatically, odds are you'll find your culprit in there somewere!
Regards Marten
You have an old app om the server someware.
Not a sql thing but, click start and ru, type msconfig and hit enter.
Now examine all things that starts automatically, odds are you'll find your culprit in there somewere!
Regards Marten
ASKER
There is a SQL Server Agent under services but it is stopped.
I checked under startup and there isn't anything extraneous loaded up.
I checked under startup and there isn't anything extraneous loaded up.
>>There is a SQL Server Agent under services but it is stopped. <<
Than you must have installed another edition of SQL Server at some time. Try starting it. If it starts then set it to start automtically.
Than you must have installed another edition of SQL Server at some time. Try starting it. If it starts then set it to start automtically.
ASKER
Done, the SQL Server Agent has been started and set to start automatically
Is the matter resolved?
Regards Marten
Regards Marten
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
This was the resolution to the problem.
If it still wint work, use SET SPN for the sql server so kerberos can be utilized.
Regards Marten