Re: MSSQL$SBSMONITORING Login to Disabled Account?

Tech-Archive recommends: Speed Up your PC by fixing your registry

175MB for the database is pretty well ordinary. The 'owner' of the cleanup
task is 'Administrator' but I wasn't sure if the admin login credentials
were necessary for the cleanup, I'm guessing no as it appears that your
cleanup has been working despite the account being disabled and the current
login failures.

or sortta, it's behaving as I expected but I needed the confirmation.

or put another way, I don't think I can help. _Something_ is triggering the
logon attempt.

Though disabling the 500 account is an accepted practice in nonSBS
environments I believe you are seeing a minor consequence of doing so on
SBS. I'd live with it. I don't disable 500.

"Bilbo fake email hal-pc.org>" <wlp<fauxatdot> wrote in message
news:s7l9v2patu0bpmvmukcskdnll3sg7c9lg5@xxxxxxxxxx
OK Gumby, 'scuse me -- I'm a little slow on the uptake.

I don't have SQL Server 2000 or later installed on that SBS.
All it has is the MSDE component.

As to the monitoring database size, I found these:

SBSMonitoring.MDF = 175,872 KB
SBSMonitoring_log.LDF = 1,024 KB

I don't really know what that tells me though. Since I don't have
SQL Server installed, I can't have the tools you were using, can I?
I couldn't find 'em at any rate.

I COULD go and reset all the monitoring and alert stuff like Susan
says and I suppose that would shrink the db size -- this one could
have almost two years of data in it.

Is this yet another routine maintenance thing that we didn't find out
about in the promo stuff for SBS? :)

I still don't know what that process is doing trying to login to the
Administrator account. (mumble, mumble)


Thanks,

Bilbo


On Mon, 12 Mar 2007 10:51:10 +1100, "SuperGumby [SBS MVP]"
<not@xxxxxxxxxxx> wrote:

I didn't post the link for no reason.

"Bilbo fake email hal-pc.org>" <wlp<fauxatdot> wrote in message
news:5u39v29q8o2sl1k7ofh11ki8gr28tkmn77@xxxxxxxxxx
Supergumby,

I haven't a clue. How would I tell?

Bilbo

On Sun, 11 Mar 2007 08:39:15 +1100, "SuperGumby [SBS MVP]"
<not@xxxxxxxxxxx> wrote:

hmmm, 3AM is when the monitoring database cleanup happens, how big is
your
monitoring database?
http://www.supergumby.dyndns.org/sbs/monitoring.htm

"Bilbo fake email hal-pc.org>" <wlp<fauxatdot> wrote in message
news:lh06v25pvcn78n0hr9mr9amgaotinds6ie@xxxxxxxxxx
You can disable the built-in ("original") Administrator account. This
one has been disabled for almost two years and the only time I had to
enable it was during the SBS 2K3 SP1 installation process. It's rare
that it's ever truly needed.

It's an extremely popular target for hackers and we're logging
numerous attempts by outsiders to login to it each week. (They fail.)

Be that as it may, this behavior only started recently but I can't
tell tell exactly when.

I don't recall giving any SQL type process a password for the
Administrator account and I don't understand why this login attempt is
happening.

Is it significant that QuickBooks Premier has a database server
process running on this server? It has its own USER account and it's
not in any administrator group. Just wondering.

TIA


On Sat, 10 Mar 2007 12:31:49 -0600, "Cris Hanna [SBS-MVP]"
<crisnospamhanna@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

You can't disable the original Administrator account. You shouldn't
be
logging in as Administrator, except when needing to certain
activities.

"Bilbo fake email hal-pc.org>" <wlp<fauxatdot> wrote in message
news:4am4v2p56ofq54s7u9igc8077gcjd1ftla@xxxxxxxxxx
I have a SBS 2K3 SP1 Server that has a really peculiar thing going on.
At about 03:00 local every morning, the MSSQL$SBSMONITORING
(SQLSERVER.EXE image) process attempts to login to some account
that I've disabled.

There are two such accounts: Administrator and Guest.

The Login type is 3, Kerberos and the Event Id is 531.

Is anything serious going on here? Why should this process try to
login to a disabled account?

TIA
--
BilBo


--
BilBo


--
BilBo


--
BilBo


.

Relevant Pages

  • Re: Please! Doesnt anyone know a better way to do this?
    ... account, they need to automatically be directed to the page to enter data ... session variable on the Account page. ... I assume here that you're checking a database when the user attempts to ... When a new user attempts to login or clicks to register, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: PLEASE.....ANY HELP GREATLY APPRECIATED
    ... Administrator account without needing to go through Windows. ... "John John" wrote: ... I wanted to get rid of that annoying login screen on my home computer (which ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Request Help: I lost privileges after changing Network ID to a Workgroup from a domain, even th
    ... Logging in as administrator worked. ... that when you disjoin from a domain you can continue to use the same account ... You probably need to login ... >> I suspect my problem is something basic related to Group Policy but I ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Minimum Password Age GPO
    ... their account to require them to change their password at next login, that if they then login in under 24 hours time they will be prompted to change their password but will not be able to change their password?? ... The "require to change password" box is a different flag that goes with the account. ... The minimum password age settings does not apply to you as the administrator. ...
    (microsoft.public.windows.group_policy)
  • Re: Administrator Account Restrictions
    ... Per user Group Policy Restrictions for XP Home and XP Pro ... >> I have created an account with admin access. ... How do I set the Administrator ... >> Currently I have disabled the multi user login capability so that I can enter ...
    (microsoft.public.windowsxp.security_admin)