Re: 18456 Login failed for user 'NT AUTHORITY\SYSTEM'

From: bearcreek (bearcreek_at_discussions.microsoft.com)
Date: 01/26/05 

Date: Wed, 26 Jan 2005 12:17:10 -0800

"bearcreek" wrote:

> That's a good idea. Thanks.
>
> No, not using fulltext Searching. There's a fair amount of info on the web
> about fulltextsearcing and local system account, so I'm familiar with that
> problem and had ruled it out but had not though about tracing the account.
>
> "Anthony Thomas" wrote:
>
> > Grant permission to NT AUTHORITY\SYSTEM then trace the heck out of it until
> > you can nail down what service or statments are requiring the login.
> >
> > Do you use FullText Searching? The Microsoft Search service must run under
> > LocalSystem and needs access.
> >
> > Sincerely,
> >
> >
> > Anthony Thomas
> >
> >
> > --
> >
> > "bearcreek" <bearcreek@discussions.microsoft.com> wrote in message
> > news:7BFE6962-682F-4557-B44E-B0D499BC8B82@microsoft.com...
> > After removing user Builtin\Administrators the server began logging event
> > log
> > messages from SQLSERVERAGENT Alert Engine event id 322 saying the data
> > portion of event 19000 from MSSQLSERVER is invalid. Associated with this
> > is
> > event id 17055 from MSSQLSERVER w/description 18456: Login failed for user
> > NT
> > AUTHORITY\SYSTEM. These messages occur in bursts of of over 100 messages
> > every 5 minutes and just flood the application event log w/entries
> >
> > I think what's going on is the Alert Engine is a service running under local
> > system and is unable to connect to SQL server. Both the SQL Server agent
> > and the SQL Server service run under a domain account that is not a local
> > administrator, so I'm pretty sure the Alert Engine is not really running
> > from
> > the SQL Server agent. (The event log entry implies the SOURCE is
> > SQLSERVERAGENT - but I'm sure it's not running under local system.)
> >
> > Any ideas what's going on? I could give my theories, but I'm no SQL
> > Server or W2K guru and my ideas might get in the way of other's better
> > ideas.
> > OS is W2K, well patched up. SQL server is SQL 2K SP3a (818). This
> > server
> > is SQL Enterprise Edition.
> > --
> > BB
> >
> >
> >

Relevant Pages

  • Re: 18456 Login failed for user NT AUTHORITYSYSTEM
    ... No, not using fulltext Searching. ... problem and had ruled it out but had not though about tracing the account. ... > system and is unable to connect to SQL server. ... > SQLSERVERAGENT - but I'm sure it's not running under local system.) ...
    (microsoft.public.sqlserver.server)
  • Re: security and service start up account
    ... is that the local system account can't access the ... > You should consider using a local account with just enough rights to run ... > Microsoft SQL Server Support ... > Protection Program and to order your FREE Security Tool Kit, ...
    (microsoft.public.sqlserver.security)
  • RE: Service Accounts and Sysadmin Role Members
    ... Based on my research, SQL Server, SQL Server Agent, MSDE and/or MSDE Agent ... logon as local system account. ... because they all log as local system account. ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • Re: Scheduling DTS job
    ... The SQL server agent is running as Local System Account. ... Nothing has been changed in sybase box. ...
    (microsoft.public.sqlserver.dts)
  • Re: I need Help...
    ... You have to provide the account for SQL Server to run under. ... OS gives you the choice of running a service as the "local system account" ... an error message saying "the service did not start due to logon ...
    (microsoft.public.dotnet.general)
Loading