Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
Home
Discussion Groups
DB Engine
SQL ServerMSDESQL Server CE
Services
Analysis (Data Mining)Analysis (OLAP)DTSIntegration ServicesNotification ServicesReporting Services
Programming
CLRConnectivitySQLXML
Other Technologies
ClusteringEnglish QueryFull-Text SearchReplicationService Broker
General
Data WarehousingPerformanceSecuritySetupSQL Server ToolsOther SQL Server Topics
DirectoryUser Groups
Related Topics
MS AccessOther DB ProductsMS Server Products.NET DevelopmentVB DevelopmentJava DevelopmentMore Topics ...

SQL Server Forum / General / Security / November 2006

Tip: Looking for answers? Try searching our database.

event 17055 error code 18452 user (null) not associated with trusted account

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
kevin-helena-dana@ntlworld.com - 04 Nov 2006 08:56 GMT
Dear All,

I am new to this newsgroup so please forgive me if I am in the wrong
palce.

The subject line describes my problem in a nutshell.

I am getting and event id 17055 from one instance of our SQL Server
2000 DB on a windows 2003 server. There is a category (4) but, since I
am also new to Systems Admin, I don't know where to look for what this
means.

It occurs approximately every minute and is driving me mad!

The error text says code 18452  and mentions the user (null) is not
associated with a trsusted account.

Can anyone suggest where I might look for other clues to debug this?

I have looked on the web using Google but so far have not found
anything which obviously applies (and I have tried the not so obvious
too). Some people mention named pipes should be set for SQL Server 7
but we are running 2000. Also we have both windows and sql server
authentication set.

In any replies, I would be grateful if you would treat me like an idiot
(seriously) as I am very new to this stuff.

Many thanks to any experts who can guide me.

Kev
Theo Verweij - 04 Nov 2006 12:19 GMT
What servicepack level do you have in your SQL?

> Dear All,
>
[quoted text clipped - 27 lines]
>
> Kev
KEVIN GILES - 04 Nov 2006 13:27 GMT
I hope I am reportiung the right thing here:-

Management Management Console version 2.0
Version 5.2 (Build 3790.svr03_sp1_qfe.050504-1733 : Service Pack 1)

Sql Server enterprise manager about box says version 8.00

> What servicepack level do you have in your SQL?
>
[quoted text clipped - 29 lines]
>>
>> Kev
Theo Verweij - 04 Nov 2006 16:08 GMT
No, you are reporting the version and servicepack of win2k3 (sp1).

To check the version of SQL Server 2000:
Go to the enterprise manager, rightclick the server and select
properties. Here you can see the version and servicepack level of your
SQL Server.

The reason why I am asking this is, is that win2k3 only supports SP3 and
higher. RTM, SP1 and SP2 are only accepting trusted connections on named
pipes when they run on windows 2003.

>  I hope I am reportiung the right thing here:-
>
[quoted text clipped - 36 lines]
>>>
>>> Kev
KEVIN GILES - 04 Nov 2006 22:35 GMT
Thanks for that. You see I told you I was a bit slow - treat me like an
idiot.

The SQL Server is Developer edition version 8.00.2039 (SP4) so I guess that
this answers that question. I am not saying that Named Pipes is likely the
problem, just that others have said something about it. I really am stuck.

I am also grateful for the help offered.

Thanks again.

Kevin
> No, you are reporting the version and servicepack of win2k3 (sp1).
>
[quoted text clipped - 46 lines]
>>>>
>>>> Kev
Theo Verweij - 05 Nov 2006 09:44 GMT
Ok, it should work.
Can you send us the connectionstring you are using?

> Thanks for that. You see I told you I was a bit slow - treat me like an
> idiot.
[quoted text clipped - 58 lines]
>>>>>
>>>>> Kev
KEVIN GILES - 05 Nov 2006 12:30 GMT
Aaah ... well actually I am not able to tell you this. I am the systems
admin (junior, learner) and the message has been appearing for some time but
no-one can identify when it started. The connectionstring is therefore not
available.

from anecdotal evidence the messages may have been appearing from about the
time we had a new Sharepoint Server added to our network which uses a DB on
this server. This is purely speculative and I have done some investigation
on this with no success.

The main problem I have is that I do not know WHERE to look to find out who
is really trying to connect and from which machine. The event logs were my
starting point.

Are there any tools or other places I can look at to help id this supposedly
(null) user and their origin? Then I may be able to cut them off.

Sorry to be a pain but I believe that mutual assistance and expert advice is
the purpose of such newsgroups as this.

Thanks for all help so far.

Kevin
> Ok, it should work.
> Can you send us the connectionstring you are using?
[quoted text clipped - 66 lines]
>>>>>>
>>>>>> Kev
Theo Verweij - 05 Nov 2006 14:11 GMT
You are not a pain at all! - and an idiot would not ask these questions.

What you can do is use the SQL Profiler to audit all logins, to see what
connection is failing. Here you can see who is trying to connect to your
server, causing this error.

> Aaah ... well actually I am not able to tell you this. I am the systems
> admin (junior, learner) and the message has been appearing for some time but
[quoted text clipped - 89 lines]
>>>>>>>
>>>>>>> Kev
KEVIN GILES - 05 Nov 2006 22:14 GMT
Aha .. thansk for your kind comments.

I have run a profiler trace and found out that one of our sharepoint servers
IS attempting to run some stored proc and I will do further investigation at
work tommorow.

I will let you knoe the resukts but that hint was a great help so far.

Kevin
> You are not a pain at all! - and an idiot would not ask these questions.
>
[quoted text clipped - 100 lines]
>>>>>>>>
>>>>>>>> Kev
Arnie Rowland - 05 Nov 2006 16:01 GMT
The application log should show what computer is attempting to connect to
the SQL Server.

Signature

Arnie Rowland, Ph.D.
Westwood Consulting, Inc

Most good judgment comes from experience.
Most experience comes from bad judgment.
- Anonymous

You can't help someone get up a hill without getting a little closer to the
top yourself.
- H. Norman Schwarzkopf

> Aaah ... well actually I am not able to tell you this. I am the systems
> admin (junior, learner) and the message has been appearing for some time
[quoted text clipped - 91 lines]
>>>>>>>
>>>>>>> Kev
KEVIN GILES - 22 Nov 2006 20:05 GMT
Thanks for the help so far, everyone. This weekend we are likely to have a
shut down of our server network and I am going to check after each other
server is shutdown to see which of them has been trying to make contact.

I have looked in the app event log but there is no apparent info unless I am
missing something.

I will let you know how I get on after the weekend.

Kevin
> The application log should show what computer is attempting to connect to
> the SQL Server.
[quoted text clipped - 97 lines]
>>>>>>>>
>>>>>>>> Kev
Roger Wolter[MSFT] - 04 Nov 2006 17:54 GMT
There are two ways to identify yourself to SQL Server.  A SQL login requires
a user name and password.  A Windows login will allow you to log in because
your windows user has permissions.  When you install SQL Server you specify
whether it will accept Windows logins only or both Windows and SQL logins.
The error you are getting usually means that you installed SQL Server to
only accept Windows logins and now you are trying to log in as a SQL Server
user.  It can also mean that the Windows user you are trying to login as
doesn't have permissions to log in to SQL Server.  You can usually log in to
SQL Server if you are logged in to Windows on the server where SQL Server is
running as a Windows user who has administrator privileges on the Windows
box (it's possible to disable this but not very common).

Signature

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

> Dear All,
>
[quoted text clipped - 27 lines]
>
> Kev
KEVIN GILES - 04 Nov 2006 22:48 GMT
Thanks Roger.

I wonder if this is not the problem directly but a poart of it. The user is
reported as (null) which implies to me some kind of security ttranslation
from an actual user. Also, I wonder why this message would appear literally
every minute.

As an addendum, there is a message sent to system administrator saying 014 -
permission denied and then a similar "not associated" message. This arrives
at the same time as the event is logged.

I did also say that we have windows and Sql Server authority allowed - am I
missing the point?

Remember, treat me like an idiot and I will respond.

Thanks.
> There are two ways to identify yourself to SQL Server.  A SQL login
> requires a user name and password.  A Windows login will allow you to log
[quoted text clipped - 40 lines]
>>
>> Kev
Roger Wolter[MSFT] - 06 Nov 2006 01:57 GMT
The null user generally means that the Windows user was not able to
authenticate to the server.  The most common cause of this is the "double
hop" issue - login on to one Windows box and then using those credential to
log into SQL Server without delegation permissions.  That doesn't sound like
the issue here though.  It more likely that the Windows user you are running
as doesn't have permissions on the server where SQL is running.

Signature

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

> Thanks Roger.
>
[quoted text clipped - 57 lines]
>>>
>>> Kev
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2009 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.