Event 18456 - Failure Audit in event viewer

Event 18456 - Failure Audit in event viewer - SLQ2005

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

MecII - 11 Jul 2008 20:46 GMT

We currently use BrightStor/Arcserve as our backup software which includes
the option to use either their own database product or use Microsoft's SQL
server.
In September 2007 I decided to switch and place the database on the SQL 2005
server.
Everything has been running fine but in early February I started to get
errors posting in the SQL 2005 Server error log and in event manager.

Event Viewer
Failure Audit Event ID: 18456 Category (4)
Login failed for user 'Domain\ServerName$'. [CLIENT: 192.168.105.12]
0000: 18 48 00 00 0e 00 00 00 .H......
0008: 0b 00 00 00 4d 00 52 00 ....M.R.
0010: 41 00 53 00 51 00 4c 00 A.S.Q.L.
0018: 32 00 30 00 30 00 35 00 2.0.0.5.
0020: 00 00 07 00 00 00 6d 00 ......m.
0028: 61 00 73 00 74 00 65 00 a.s.t.e.
0030: 72 00 00 00 r...

In the SQL error log I have these errors listed:

Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. [CLIENT:
192.168.105.12]
Error: 18456, Severity: 14, State: 11.

But mostly these errors
Login failed for user 'Domain Name\Computer Name$'. [CLIENT: 192.168.105.12]
Error: 18456, Severity: 14, State: 11.

192.168.105.12 is the backup server that hold BrightStor/Arcserve
I do not have any problems accessing the data in the database so other than
this error posting every 30 seconds it appears everything is working.

If anyone has thoughts on this please post.

Thanks,
Mark

Reply to this Message

Denny Cherry - 13 Jul 2008 22:49 GMT

Something within the Arcserver software is trying to log into the
database with the local service account for the machine running on
192.168.105.12. You can get rid of this by allowing the domain
account for the computer it self access to the database.

CREATE LOGIN [DomainName\ComputerName$] FROM WINDOWS;

As always give it the minimum needed rights to run.

Denny

>We currently use BrightStor/Arcserve as our backup software which includes
>the option to use either their own database product or use Microsoft's SQL
[quoted text clipped - 33 lines]
>Thanks,
>Mark

Reply to this Message

MecII - 15 Jul 2008 15:18 GMT

Thanks for the reply.

You'll have to forgive me I am not an SQL expert by any means, I know enough
just to be dangerous. From what I have gathered that this is an SQL command
"CREATE LOGIN [DomainName\ComputerName$] FROM WINDOWS" the part I am not sure
of is which database would I create this against, the master?

Thanks,
MecII

> Something within the Arcserver software is trying to log into the
> database with the local service account for the machine running on
[quoted text clipped - 44 lines]
> >Thanks,
> >Mark

Reply to this Message

MecII - 15 Jul 2008 15:25 GMT

I decided to give it a try and got this error when I tried to create the login:
Msg 15025, Level 16, State 2, Line 1
The server principal 'DomainName\ComputerName$' already exists.

Any other thoughts?

Thanks,
MecII

> Something within the Arcserver software is trying to log into the
> database with the local service account for the machine running on
[quoted text clipped - 44 lines]
> >Thanks,
> >Mark

Reply to this Message