Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
Home
Discussion Groups
DB Engine
SQL ServerMSDESQL Server CE
Services
Analysis (Data Mining)Analysis (OLAP)DTSIntegration ServicesNotification ServicesReporting Services
Programming
CLRConnectivitySQLXML
Other Technologies
ClusteringEnglish QueryFull-Text SearchReplicationService Broker
General
Data WarehousingPerformanceSecuritySetupSQL Server ToolsOther SQL Server Topics
DirectoryUser Groups
Related Topics
MS AccessOther DB ProductsMS Server Products.NET DevelopmentVB DevelopmentJava DevelopmentMore Topics ...

SQL Server Forum / General / Security / May 2008

Tip: Looking for answers? Try searching our database.

Application error event every minute on MSSQLSERVER : "Failure Audit: Login failed for user 'NT AUTHORITY\SYSTEM' [Client: <local machine>]

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
Ken Fine - 20 May 2008 00:25 GMT
Hi,

My event viewer offers up an error each and every minute with a source of
MSSQLSERVER: "Failure Audit: Login failed for user 'NT AUTHORITY\SYSTEM'
[Client: <local machine>.

Can anyone suggest a possible source and a possible solution? Clearly it is
a regular process of some sort originating with the system itself. Most
external traffic to SQL Server-related ports is firewalled off.

The system in question is a domain controller running IIS and SQL Server on
the same box (which I know you are not supposed to do as a best practice.)

Thank you,
-KF
Charles Wang [MSFT] - 20 May 2008 04:59 GMT
Hi KF,
I understand that you found the error message every minute in your event
error logs and that you would like to know how to work around this issue.
If I have misunderstood, please let me know.

As a possible workaround, I recommend that you first try explicitly adding
"NT AUTHORITY\SYSTEM" as a login to your SQL Server instance. If your SQL
Server is 2000, you can open Enterprise Manager, expand your SQL Server
instance, go to Security directly, right click Logins and click New
Login..., and then add the Windows login "NT AUTHORITY\SYSTEM". If your SQL
Server is 2005, you can do this in SQL Server Management Studio. You may
also explicitly assign the fixed server role "sysadmin" to it.

Also since "NT AUTHORITY\SYSTEM" is a service account, I think that some
service running under the account access your SQL Server instance every
minute. You may first check if it is your SQL Server Agent services. If
not, you can run SQL Profiler to monitor your SQL Server instance and add
the event "Audit Login failed". You may refer to these articles:
Using SQL Profiler (For SQL 2000)
http://www.microsoft.com/technet/prodtechnol/sql/70/tips/sqlprof.mspx
How to: Specify Events and Data Columns for a Trace File (SQL Server
Profiler)
http://msdn.microsoft.com/en-us/library/ms188674.aspx

From the SQL Profiler, you should be able to see the message regarding
"Audit Login Failed" event and from the message you can find which service
(ApplicationName) submits a login.
Note that SQL Profiler is a component in SQL Server Standard Edition or
Enterprise Edition. You can find SQL Profiler from (SQL 2000) Start->All
Programs->Microsoft SQL Server->Profiler or (SQL 2005) Start->All
Programs->Microsoft SQL Server 2005->Performance Tools->SQL Server
Profiler.

Then you can change the service's startup account from Services from
control panel. Go to Services, double click the service, switch to the Log
On tab, change the service account to a domain user account and then
restart your service. You need to also ensure that the domain user account
is added to the logins of your SQL Server instance.

Hope this helps. If you have any other questions or concerns, please feel
free to let me know.

Best regards,
Charles Wang
Microsoft Online Community Support
===========================================================
Delighting our customers is our #1 priority. We welcome your
comments and suggestions about how we can improve the
support we provide to you. Please feel free to let my manager
know what you think of the level of service provided. You can
send feedback directly to my manager at: msdnmg@microsoft.com.
===========================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for
non-urgent issues where an initial response from the community
or a Microsoft Support Engineer within 1 business day is acceptable.
Please note that each follow up response may take approximately
2 business days as the support professional working with you may
need further investigation to reach the most efficient resolution.
The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by
contacting Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
============================================================
Signature

This posting is provided "AS IS" with no warranties, and confers no rights.

=========================================================
Ken Fine - 20 May 2008 18:56 GMT
Thank you Charles. Your answer was complete and informative -- I learned a
lot from it. My problem is solved!

-KF

> Hi KF,
> I understand that you found the error message every minute in your event
[quoted text clipped - 69 lines]
> rights.
> =========================================================
Charles Wang [MSFT] - 21 May 2008 03:43 GMT
Hi Ken,
You are welcome. I am very glad to hear that the suggestions are helpful.

Have a nice day!

Best regards,
Charles Wang
Microsoft Online Community Support
=========================================================
Delighting our customers is our #1 priority. We welcome your
comments and suggestions about how we can improve the
support we provide to you. Please feel free to let my manager
know what you think of the level of service provided. You can
send feedback directly to my manager at: msdnmg@microsoft.com.
=========================================================
Signature

This posting is provided "AS IS" with no warranties, and confers no rights.

=========================================================
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2009 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.