Login Failure for NT Authority\System user

Question

Login Failure for NT Authority\System user

mdn_2k5

SSC Eights!

Points: 814
More actions
June 15, 2010 at 12:52 am

#236447

Hi Friends,
We have a prodution server which runs SQL Server 2005 (Std 64 Bit).
There is a "Login Failure for NT Authority\System" error logged in the error log every minute.
Error Message Details
--------------------
Date6/15/2010 2:49:23 AM
LogSQL Server (Current - 6/15/2010 2:49:00 AM)
SourceLogon
Message
Login failed for user 'NT AUTHORITY\SYSTEM'. [CLIENT: <local machine>]
We could nt find what exactly causes this issue.Please let me know any solutions,suggestions and comments about this issue.
Thanks in Advance
Dhayanithy

Viewing 9 posts - 1 through 8 (of 8 total)

You must be logged in to reply to this topic. Login to reply

Henrico Bekker One Orange Chip Points: 27652 More actions · Answer 1

You have a service trying to run/authenticate as NT Auth..... against your SQL Instance.

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
This thing is addressing problems that dont exist. Its solution-ism at its worst. We are dumbing down machines that are inherently superior. - Gilfoyle

Perry Whittle SSC Guru Points: 233821 More actions · Answer 2

track the machine down using its ip address and find out what is trying to authenticate

-----------------------------------------------------------------------------------------------------------

"Ya can't make an omelette without breaking just a few eggs" 😉

mdn_2k5 SSC Eights! Points: 814 More actions · Answer 3

Friends, Thanks for the Reply.

Here are few details I found on the server.

Below are the tasks which are run by the NT Authority\System user in the server.

1.EXECUTE msdb.dbo.sp_sqlagent_get_perf_counters - SQL Agent Alert Engine

2.SELECT ISNULL(SUSER_SNAME(), SUSER_NAME()) - SQL Agent EMail Logger

3.UPDATE msdb.dbo.sysjobactivity - SQL Agent Job Invocation Engine

4.msdb.dbo.sysmail_help_admin_account_sp;1 - SQL Agent90 - id <2764>

I suspect on the No.1 task which could cause the issue,since it is batched every minute when checked in the Activity Monitor.But not sure on what way its affecting.

Any ideas???

Thanks in advance

Dhayanithy

Henrico Bekker One Orange Chip Points: 27652 More actions · Answer 4

grant sysadmin rights on SQL to NT Auth\SYSTEM and see if the error still occurs.

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
This thing is addressing problems that dont exist. Its solution-ism at its worst. We are dumbing down machines that are inherently superior. - Gilfoyle

mdn_2k5 SSC Eights! Points: 814 More actions · Answer 5

Hi Henrico Bekker,

Thanks a lot for the reply

The user NT Authority\System has SysAdmin rights already.

Thanks

Dhayanithy

mdn_2k5 SSC Eights! Points: 814 More actions · Answer 6

Hi Friends,

Just wanted to add this bit to the error message.Here in the message The state shown as 16.

Source : Logon

Message : Login failed for user 'NT AUTHORITY\SYSTEM'. [CLIENT: <local machine>]

Date : 6/14/2010 8:03:19 AM

Log : SQL Server (Current - 6/16/2010 2:02:00 AM)

Source : Logon

Message : Error: 18456, Severity: 14, State: 16.

Thanks in Advance

Dhayanithy

richardgazey SSC Veteran Points: 215 More actions · Answer 7

I had this happening - and it turned out to be a test installation of Microsoft reporting services -which was running as a service

It had been installed and developers tried and rejected it as a reporting tool.

May be worth a try

preity SSC Enthusiast Points: 116 More actions · Answer 8

Had the same issue. Stopping the SQL Server Reporting Services worked for me.