Re: 18456 Login failed for user 'NT AUTHORITY\SYSTEM'

From: bearcreek (bearcreek_at_discussions.microsoft.com)
Date: 01/24/05 

Date: Mon, 24 Jan 2005 10:03:07 -0800

That's a good idea. Thanks.

No, not using fulltext Searching. There's a fair amount of info on the web
about fulltextsearcing and local system account, so I'm familiar with that
problem and had ruled it out but had not though about tracing the account.

"Anthony Thomas" wrote:

> Grant permission to NT AUTHORITY\SYSTEM then trace the heck out of it until
> you can nail down what service or statments are requiring the login.
>
> Do you use FullText Searching? The Microsoft Search service must run under
> LocalSystem and needs access.
>
> Sincerely,
>
>
> Anthony Thomas
>
>
> --
>
> "bearcreek" <bearcreek@discussions.microsoft.com> wrote in message
> news:7BFE6962-682F-4557-B44E-B0D499BC8B82@microsoft.com...
> After removing user Builtin\Administrators the server began logging event
> log
> messages from SQLSERVERAGENT Alert Engine event id 322 saying the data
> portion of event 19000 from MSSQLSERVER is invalid. Associated with this
> is
> event id 17055 from MSSQLSERVER w/description 18456: Login failed for user
> NT
> AUTHORITY\SYSTEM. These messages occur in bursts of of over 100 messages
> every 5 minutes and just flood the application event log w/entries
>
> I think what's going on is the Alert Engine is a service running under local
> system and is unable to connect to SQL server. Both the SQL Server agent
> and the SQL Server service run under a domain account that is not a local
> administrator, so I'm pretty sure the Alert Engine is not really running
> from
> the SQL Server agent. (The event log entry implies the SOURCE is
> SQLSERVERAGENT - but I'm sure it's not running under local system.)
>
> Any ideas what's going on? I could give my theories, but I'm no SQL
> Server or W2K guru and my ideas might get in the way of other's better
> ideas.
> OS is W2K, well patched up. SQL server is SQL 2K SP3a (818). This
> server
> is SQL Enterprise Edition.
> --
> BB
>
>
>

Relevant Pages

  • Re: 18456 Login failed for user NT AUTHORITYSYSTEM
    ... > No, not using fulltext Searching. ... > problem and had ruled it out but had not though about tracing the account. ... >> system and is unable to connect to SQL server. ...
    (microsoft.public.sqlserver.server)
  • Re: SQL Server 2005 Service Accounts Questions / Seeking Recommendations
    ... the account running the SQL Server Service can be Local System, ... Given then, that you run SQL Service as Local System (for example, a common ... > I'm only going to address the Service Broker issues (and some EXECUTE AS ...
    (microsoft.public.sqlserver.security)
  • Re: sql server
    ... The message is saying that you have SQL Server setup to use ... the local system account for the startup account. ... You need to change the SQL Server service startup account to ...
    (microsoft.public.sqlserver.security)
  • Re: Connect pocket pc (2003) to sql sever in trusted/integrated/ss
    ... it was SQL Server that was running in local system account. ... Here's connection string sample, note "Integrated Security=SSPI". ...
    (microsoft.public.dotnet.framework.compactframework)
  • Re: MSDE Service permissions
    ... Server is run under another privileged account than the current logged ... > "Create a least privileged local account with which to run the SQL Server ... Do not use the local system account or an administrator account. ... Andrea Montanari ...
    (microsoft.public.sqlserver.msde)