I am receiving this error every 20 to 40 minutes (does not appear to be at an exact time like I would get for a scheduled job).
I cannot seem to determine WHERE this error is coming from. What process is attempting this failed login.
If someone could help me to track this back to the source so I can determine what client or app or event is attempting this failed login. It appears to be something connecting under the SSAS service account using impersonation such as how SSAS lets a user connect and pass along their windows login name for the purposes of security row filtering, etc...
I see the login failures in the event viewer and started a trace against SSAS to see if I could learn more. I hoped I would see what app or client or hostname was making the connection then I could track it back that way, but no luck.
In the trace I get:
"The following system error occurred: The user name or password is incorrect. " with username of the SSAS Service account. Connection ID is zero, the timedate is filled in of course, but all other columns are empty.
It corresponds to an event log entry in the security log of:
Event ID 4625 login failure.
The account shown under the Security ID is my SSAS service account.
I'm totally at a loss as to determine where this failed login is coming from?
On the domain event log side of things I can see that a Kerberos authentication ticket (TGT) was requested.
Then it lists an account that belongs to someaccount@ourdomain.onmicrosoft.com with a user ID of NUILL SID.
Below is the event log from the SSAS server showing the audit failure for login:
-----
| | | | | [
Name] | Microsoft-Windows-Security-Auditing |
| | | [
Guid] | {54849625-5478-4994-A5BA-3E3B0328C30D} |
|
| | | Keywords | 0x8010000000000000 |
|
| | | | | [
SystemTime] | 2018-11-29T15:45:08.113110000Z |
|
| | | Computer | SSAS-SERVER-NAME.domainname.com |
|
| | SubjectUserSid | S-1-5-21-3937660100-2620109559-2965839201-25021 |
| | SubjectUserName | SSAS_SERVICE_ACCOUNT_NAME |
| | SubjectDomainName | domainname.com |
| | AuthenticationPackageName | Kerberos |
| | WorkstationName | SSAS-SERVER-NAME |
| | ProcessName | C:\Program
Files\Microsoft SQL
Server\MSAS13.TAB01\OLAP\bin\msmdsrv.exe |
-----------------------------------------