Link to home
Create AccountLog in
Avatar of John Esraelo
John EsraeloFlag for United States of America

asked on

Login Failed for User "GetPwd"

I have seen a similar posting here that is dated back to 2006.
So, there were no reason to expected any responses from that thread...
Anyway, to make the long story, too late, I have been getting this on my server and was wondering if anyone knows what the real solution to this maybe.

I have a service broker, event handler, even queue, db mail working all together to provide me with this following notification.
...
there is this user name but no hostname or any other piece..
any information to this will be appreciated.
thx

The following Login Failures event occurred:
ServerName:              BRGSQL
PostTime:                Nov  8 2012  4:32PM
DatabaseName:            master
NT UserName              
NT DomainName            
Host Name                
LoginName                getpwd


it is fresh out of the oven as you see the date-stamp..
thx

JohnE
Avatar of Randy Knight, MCM
Randy Knight, MCM
Flag of United States of America image

Someone / something is trying to login using the SQL Server login name "getpwd".  The SQL Server error log should have more detail.
Avatar of Matt Bowler
Running a profiler trace filtered to this login and ensuring that you capture the user error - will give you about as much information as can be gotten....
Avatar of John Esraelo

ASKER

RKnight,
One does not have to have a local account to raise this event to fire up a notification for me to me..
I can try to connect using any name and this will fire it.
MattSQL,
This account does not exist, local nor domain..
in fact, what's bothering me is the fact that there is no HOST name associated..
FYI
guys,
here is where I get my information from and about this login..
I thought it was going to be an easy thing.. but as usual my questions always stuffs me in the obnubelated epic.

http://msdn.microsoft.com/en-us/library/ms187862.aspx
Are the login attempts always using the same login name?
You should still be able to filter a profiler trace to look for that name...

If profiler doesn't return something useful then SQL Server does not have access to any more data about the attempts.

Next step to investigate would be at the OS/network layer - and that is where my expertise ends sorry
I am sure we will find the source..
I am going to try to pull the application name from the collection.. if null then back to square 1
here is the new on a non-existing account trying to connect via sql client

The following Login Failures event occurred:
ServerName:              BRGSQL
PostTime:                Nov  8 2012  8:52PM
DatabaseName:            master
NT UserName
NT DomainName
Host Name                WIN-G0QFB44N18R
LoginName                gggg
Application Name         Microsoft SQL Server Management Studio




I will just have to sit tight and await that username to reappear..
ASKER CERTIFIED SOLUTION
Avatar of John Esraelo
John Esraelo
Flag of United States of America image

Link to home
membership
Create an account to see this answer
Signing up is free. No credit card required.
Create Account
well, this answer was provided to me by the Vendor / 3rd party software company and the answer that I have posted in above came from them and I kindly posted here so others can read it as well.