Another Error 18456

SQLServerCentral is supported by Red Gate Software Ltd.

Popular Topics

Home

Members

Calendar

Who's On

Home » SQL Server 2005 » SQL Server Express » Another Error 18456

Another Error 18456

Rate Topic

Display Mode

Topic Options

Author

Message

Assun

Posted Thursday, July 23, 2009 5:16 AM

Forum Newbie

Group: General Forum Members
Last Login: Monday, January 23, 2012 10:05 AM
Points: 1, Visits: 9

Hello,

I'm not a DBA and have very little knowledge of SQL, so I'd like to know if someone could help me, please. Forgive me if any question seems dumb.

Here's the problem: I'm having several entries in the SQL Server 2005 error logs related to login failures. Whenever a user tries to login, the frontend reports a possible wrong password and the SQL log records the following:

Error: 18456, Severity: 14, State: 8.
Login failed for user [Client: "IP"]
Error: 18456, Severity: 14, State: 8.
Login failed for user [Client: "IP"]

Error: 18456, Severity: 14, State: 8.
Login failed for user [Client: "IP"]
Error: 18456, Severity: 14, State: 5.
Login failed for user [Client: "IP"]

The entries are repeated in pairs for each login - 2 entries for sa followed by two entries for the user. It appears that everytime a user tries to login, the client app attempts to login first with sa and then the user (maybe that's the way it's supposed to be?!).

If I try to change the user's password on the client app, the problem remains. If I change the user's pass on Management Studio, everything's ok. However, some of the user's accounts do not show up on Management Studio, although they were active yesterday.

I've been looking around about these error codes and found out that 8 is for wrong passwords and 5 for invalid logins. However, can't really figure out what went wrong.

Hope someone can give me a hint.

Thanks,
PDA

>>> EDIT:
Apparently, other Administrator changed the sa password 2 weeks ago. I reset the password to the previous value and everything went back to normal. However, I still can't figure out how and why the users managed to work without a problem until now. Any thoughts?

Post #758104

salvatore doria

Posted Friday, July 31, 2009 9:32 AM

Grasshopper

Group: General Forum Members
Last Login: Friday, May 03, 2013 1:16 AM
Points: 21, Visits: 6

State 8 indicates "Password mismatch", State 5 indicates "Invalid UserId".
Is this some help for You?

Post #763203

govindarajan69

Posted Friday, June 08, 2012 2:25 AM

Grasshopper

Group: General Forum Members
Last Login: Monday, June 03, 2013 4:19 AM
Points: 15, Visits: 149

Hi,

I am also getting this error Error: 18456, Severity: 14, State: 8. + Login failed for user 'sa'. [CLIENT: 192.168.4.52], but the user is not accessing SQL Server directly. No application is configured with sa credentials.

is there anyway we can trace his pc and find out what is making connections to SQL Server directly?

Please suggest.

Regards
Govind

Post #1312946

anthony.green

Posted Friday, June 08, 2012 2:36 AM

SSCertifiable

Group: General Forum Members
Last Login: Wednesday, June 05, 2013 2:40 AM
Points: 5,075, Visits: 4,833

govindarajan69 (6/8/2012)

run a profile trace, blank template, then select failed login attempt from the security audit section of the event selections tab, bingo, you get to see whats trying to login

Want an answer fast? Try here
How to post data/code for the best help - Jeff Moden
Need a string splitter, try this - Jeff Moden
How to post performance problems - Gail Shaw
CrossTabs-Part1 & Part2 - Jeff Moden
SQL Server Backup, Integrity Check, and Index and Statistics Maintenance - Ola Hallengren
Managing Transaction Logs - Gail Shaw
Troubleshooting SQL Server: A Guide for the Accidental DBA - Jonathan Kehayias and Ted Krueger

Post #1312953

govindarajan69

Posted Sunday, June 10, 2012 12:45 AM

Grasshopper

Group: General Forum Members
Last Login: Monday, June 03, 2013 4:19 AM
Points: 15, Visits: 149

Hi Anthony,

Thanks for your reply.

I found that it was virus. One of the users laptop was constantly probing all sql servers with sa login. I removed it from LAN and got stopped. I also found that the trojan virus infected his laptop. Informed Network and Infra team to take necessary action.

Regards
Govind

Post #1313573

« Prev Topic | Next Topic »

Permissions