Hi,
My problem,
We have a few SQL databases on SLQ2005 and MSDE on the same machine with SBS
server 2003.
Every week i have some logs who tell that a compleet unknown user 'Login
failed for user 'XXX'. [CLIENT: XXX]. The name of the user is always the same
but the client machine is always a different PC in the lan.
Their is an application that uses the SQL2005 and wich is installed on all
pc's in the lan. But their is no user like the 'XXX' in the log file.
The external software company who wrote the application says that it is
inpossible that it is something in their application.
So how can I log are check the traffic to the SQL server to find what
(application) is trying to connect with the unknown user ?????
Thanks
Koen
Uri Dimant - 17 Feb 2008 07:51 GMT
kenko
If you are in SQL Server 2005 (SP2) take a look into LOGON triggers(or
Profiler) to capture the info, however it could be that somebody tries to
attack you
> Hi,
>
[quoted text clipped - 16 lines]
> Thanks
> Koen