We recently found quite a few errors in SQL error log at weekend the past Sunday, it lasts about 8 hours. . The login is from an untrusted domain and cannot be used with Windows authentication. [CLIENT 10.50...)
We traced to the client IP address, and I asked if she tried to login over the weekend, but she didn't.
But she said this monday morning, windows asked her to change the password, this is because we have policy that have to change password in 3 months.
So on Sunday she had some SSMS queries open that was left so from last Friday.
So we guess it is probably from SSMS of her workstation that keep trying to connect the server. and since her password is expired, it shows errors for windows authentication errors.
My question is, when SSMS is open from client machine, even she was not working on it the whole weekend, why it keep trying to connect to server?
is it supposed to work that way for SSMS?