Click here to monitor SSC
SQLServerCentral is supported by Red Gate Software Ltd.
 
Log in  ::  Register  ::  Not logged in
 
 
 
        
Home       Members    Calendar    Who's On


Add to briefcase ««12

Login failed for user 'NT AUTHORITY\SYSTEM', Very straing Expand / Collapse
Author
Message
Posted Wednesday, February 13, 2013 8:47 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: General Forum Members
Last Login: Friday, December 6, 2013 7:16 AM
Points: 5, Visits: 24
Thanks, but no jobs owned by 'NT AUTHORITY\SYSTEM' just 'NT SERVICE\SQLSERVERAGENT' owned ones.


I did a SQL Profiler trace (Audit) and see a lot of these kind of queries, issued by NT AUTHORITY\SYSTEM via the Windows script Host, going on at the time of the login failures:

SELECT
d.name
, d.database_id
, CASE WHEN d.replica_id IS NULL THEN 0 ELSE 1 END AS is_replica
, ar.secondary_role_allow_connections
FROM sys.databases d
JOIN sys.availability_replicas ar on d.replica_id = ar.replica_id
JOIN sys.servers s ON s.name = ar.replica_server_name AND s.server_id = 0 /*local server*/
WHERE d.database_id = 18

What is this?
High Availability? We got it disabled...
Replication? We got it disabled...

Hmm.
Post #1419585
Posted Thursday, February 14, 2013 6:28 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: General Forum Members
Last Login: Thursday, February 14, 2013 6:23 AM
Points: 1, Visits: 0
I have faced similar issue, all i did is modified 'connection string' Configuration. Instead of '.....;user id=sa;...', try replacing it with '.....;uid=sa;...'.For The reason part ...i dont know why!?it may work
Let me know if it works!
Post #1420020
Posted Wednesday, April 3, 2013 6:01 PM
SSC Rookie

SSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC RookieSSC Rookie

Group: General Forum Members
Last Login: Wednesday, March 26, 2014 2:52 PM
Points: 46, Visits: 87
Well I have had the same issue. And log is generated every 15min saying that database could not connect to sql server database.

Granting sysadmin access to ntauthority\system should in fact solve the issue. But its stupid to do so with out actually knowing what application or script(in my case the call is coming from cscript.exe - which can be any automated vb or java script) is actually trying to access the server data.

For now I have no further information - I'm still investigating on the issue. If you find any clue let me know
Post #1438618
Posted Monday, April 29, 2013 9:10 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: General Forum Members
Last Login: Wednesday, July 16, 2014 12:12 PM
Points: 8, Visits: 273
I was seeing this on one of our servers, I looked at the Services running and ran profiler and came up with the same things like: generic queries where NT AUTHORITY\SYSTEM was trying to run things like:
SELECT size / 128.0 as fileSize,
FILEPROPERTY(name, 'SpaceUsed') / 128.0 as fileUsed,
CASE WHEN max_size = -1 OR max_size = 268435456 THEN -1 ELSE max_size / 128 END as fileMaxSize,
CASE WHEN growth = 0 THEN 0 ELSE 1 END as IsAutoGrow,
is_percent_growth as isPercentGrowth,
growth as fileGrowth,
physical_name
FROM sys.master_files WITH (NOLOCK)
WHERE type = 0 AND is_read_only = 0 AND data_space_id = 1
AND database_id = 4

Turns out System Center Operations Manager Agent was running HealthService.exe as Local System.
Post #1447591
Posted Friday, May 3, 2013 6:53 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: General Forum Members
Last Login: Friday, December 6, 2013 7:16 AM
Points: 5, Visits: 24
SCOM it is!

To make this work use a service account to run the scom agent service with this:

Member of "Performance Monitor Users" local group
Member of "Event Log Readers" local group if OS is Windows 2008 or Windows 2008 R2
Member of "Distributed COM Users" local group if SQL Server is running in a clustered configuration
Full access to Cluster if SQL Server is running in a clustered configuration
Permission to Log On Locally
SQL permission to VIEW ANY DEFINITION
SQL permission to VIEW SERVER STATE
SQL permission to login in each database including system databases
Member of "SQLAgentReaderRole" in msdb database
Post #1449176
Posted Thursday, July 24, 2014 10:32 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: General Forum Members
Last Login: Thursday, July 24, 2014 10:30 AM
Points: 3, Visits: 7
I am seeing this also. I granted owner permission to the NTAUTHORITY account for the first database it tries to hit. It run this batch twice:

SET NOCOUNT ON
SELECT size / 128.0 as fileSize,
FILEPROPERTY(name, 'SpaceUsed') / 128.0 as fileUsed,
CASE WHEN max_size = -1 OR max_size = 268435456 THEN -1 ELSE max_size / 128 END as fileMaxSize,
CASE WHEN growth = 0 THEN 0 ELSE 1 END as IsAutoGrow,
is_percent_growth as isPercentGrowth,
growth as fileGrowth,
physical_name
FROM sys.master_files WITH (NOLOCK)
WHERE type = 0 AND is_read_only = 0
AND database_id = 36

Then this batch:

SET NOCOUNT ON
SELECT fg.name as fileGroupName,
fg.data_space_id as fileGroupId,
fg.is_read_only as fileGroupReadOnly
FROM sys.filegroups fg WHERE type = 'FG' AND fg.is_read_only = 0


Then is tries to open another db and fails and goes back and runs the first batch on the first db again.


Anyone figured this out yet?

barry
Post #1595957
Posted Thursday, July 24, 2014 10:34 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: General Forum Members
Last Login: Thursday, July 24, 2014 10:30 AM
Points: 3, Visits: 7
Oops, I didn't notice the 2nd page of replies.
Post #1595959
« Prev Topic | Next Topic »

Add to briefcase ««12

Permissions Expand / Collapse