Re: 18456 Login failed for user 'NT AUTHORITY\SYSTEM'

From: Anthony Thomas (ALThomas_at_kc.rr.com)
Date: 01/24/05 

Date: Sun, 23 Jan 2005 22:35:10 -0600

Grant permission to NT AUTHORITY\SYSTEM then trace the heck out of it until
you can nail down what service or statments are requiring the login.

Do you use FullText Searching? The Microsoft Search service must run under
LocalSystem and needs access.

Sincerely,

Anthony Thomas 

-- 
"bearcreek" <bearcreek@discussions.microsoft.com> wrote in message
news:7BFE6962-682F-4557-B44E-B0D499BC8B82@microsoft.com...
After removing user Builtin\Administrators the server began logging event
log
messages from SQLSERVERAGENT Alert Engine event id 322 saying the data
portion of event 19000 from MSSQLSERVER is invalid.   Associated with this
is
event id 17055 from MSSQLSERVER w/description 18456: Login failed for user
NT
AUTHORITY\SYSTEM.   These messages occur in bursts of of over 100 messages
every 5 minutes and just flood the application event log w/entries
I think what's going on is the Alert Engine is a service running under local
system and is unable to connect to SQL server.   Both the SQL Server agent
and the SQL Server service run under a domain account that is not a local
administrator, so I'm pretty sure the Alert Engine is not really running
from
the SQL Server agent.  (The event log entry implies the SOURCE is
SQLSERVERAGENT - but I'm sure it's not running under local system.)
Any ideas what's going on?    I could give my theories, but I'm no SQL
Server or W2K guru and my ideas might get in the way of other's better
ideas.
 OS is W2K, well patched up.   SQL server is SQL 2K SP3a (818).   This
server
is SQL Enterprise Edition.
-- 
BB

Relevant Pages

  • Re: Connecting to SQL from a Windows Service
    ... There is probably some way to debug this, but that's deeper Windows knowledge than I can dredge up right now. ... I looked into the Event Log and found that when my service ... 1st Login succeeds. ... You can try turning on login auditing in SQL Server and then check the ...
    (microsoft.public.sqlserver.connect)
  • Re: Authentication problem continued
    ... application pool? ... Login failures are logged to the Application event log therefore try to ... SQL Server is configured for Windows Authentication only and not mixed ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: catalog is empty after populating
    ... SQL Server is installed as the "Microsoft Search" service cannot write it's ... Tools -> Event Viewer and review the Application event log. ... >is only 1 MB and the catalog doesn't contain any items. ...
    (microsoft.public.sqlserver.fulltext)
  • Re: How Do I Prevent SQL 2000 From Posting This Message To The Event Viewer - Application Log
    ... situation (event log overload from transaction replication on 40+ DBs). ... Go to the SQL Server Properties via Enterprise Manager (i.e. right ... Erland Sommarskog wrote: ... TRACEOFF turns off the trace flag! ...
    (comp.databases.ms-sqlserver)
  • Windows authentication within a Windows Service
    ... on as Local System. ... When trying to connect remotely to SQL Server 2005 ... exception is raised saying "Login failed for user NT Authority/Anonymous ...
    (microsoft.public.sqlserver.security)