Link to home
Start Free TrialLog in
Avatar of realtimer
realtimer

asked on

MSSQLSERVER event ID 18456 "Password did not match that for the login provided" filling log

(Windows 2012 R2 server with SQL 2012.) Windows Application log is filled with the following informational event several times a minute.

Login failed for user <user name>. Reason: Password did not match that for the login provided. [CLIENT: <IP>]

The user name is a SQL login name and not a Windows account. I believe this account is used by all users within the SQL application but I am not sure. The IP address shows those for many different computers from different subnets. The event is reported all hours of the day except maybe between midnight and 4:30 am.

Short of checking all the PC's and a large number of scheduled tasks on the SQL server, is there a simple way to determine where these are coming from?

Thank you.
Avatar of Neil Russell
Neil Russell
Flag of United Kingdom of Great Britain and Northern Ireland image

Goto one of the computers with the IP address listed and do the following in a CMD prompt

C:\> NETSTAT -bn

now look for the IP Address of your SQL Server in the out, the executable connecting to the server will be listed on he line directly below.
ASKER CERTIFIED SOLUTION
Avatar of arnold
arnold
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
realtimer, do you still need help with this question?