SQL Clone
SQLServerCentral is supported by Redgate
 
Log in  ::  Register  ::  Not logged in
 
 
 


Another Error 18456


Another Error 18456

Author
Message
Assun
Assun
Grasshopper
Grasshopper (17 reputation)Grasshopper (17 reputation)Grasshopper (17 reputation)Grasshopper (17 reputation)Grasshopper (17 reputation)Grasshopper (17 reputation)Grasshopper (17 reputation)Grasshopper (17 reputation)

Group: General Forum Members
Points: 17 Visits: 9
Hello,

I'm not a DBA and have very little knowledge of SQL, so I'd like to know if someone could help me, please. Forgive me if any question seems dumb.

Here's the problem: I'm having several entries in the SQL Server 2005 error logs related to login failures. Whenever a user tries to login, the frontend reports a possible wrong password and the SQL log records the following:

Error: 18456, Severity: 14, State: 8.
Login failed for user [Client: "IP"]
Error: 18456, Severity: 14, State: 8.
Login failed for user [Client: "IP"]

Error: 18456, Severity: 14, State: 8.
Login failed for user [Client: "IP"]
Error: 18456, Severity: 14, State: 5.
Login failed for user [Client: "IP"]

The entries are repeated in pairs for each login - 2 entries for sa followed by two entries for the user. It appears that everytime a user tries to login, the client app attempts to login first with sa and then the user (maybe that's the way it's supposed to be?!).

If I try to change the user's password on the client app, the problem remains. If I change the user's pass on Management Studio, everything's ok. However, some of the user's accounts do not show up on Management Studio, although they were active yesterday.

I've been looking around about these error codes and found out that 8 is for wrong passwords and 5 for invalid logins. However, can't really figure out what went wrong.

Hope someone can give me a hint.

Thanks,
PDA


>>> EDIT:
Apparently, other Administrator changed the sa password 2 weeks ago. I reset the password to the previous value and everything went back to normal. However, I still can't figure out how and why the users managed to work without a problem until now. Any thoughts?
salvatore doria
salvatore doria
SSC Rookie
SSC Rookie (27 reputation)SSC Rookie (27 reputation)SSC Rookie (27 reputation)SSC Rookie (27 reputation)SSC Rookie (27 reputation)SSC Rookie (27 reputation)SSC Rookie (27 reputation)SSC Rookie (27 reputation)

Group: General Forum Members
Points: 27 Visits: 6
State 8 indicates "Password mismatch", State 5 indicates "Invalid UserId".
Is this some help for You?
govindarajan69
govindarajan69
SSC-Enthusiastic
SSC-Enthusiastic (166 reputation)SSC-Enthusiastic (166 reputation)SSC-Enthusiastic (166 reputation)SSC-Enthusiastic (166 reputation)SSC-Enthusiastic (166 reputation)SSC-Enthusiastic (166 reputation)SSC-Enthusiastic (166 reputation)SSC-Enthusiastic (166 reputation)

Group: General Forum Members
Points: 166 Visits: 215
Hi,

I am also getting this error Error: 18456, Severity: 14, State: 8. + Login failed for user 'sa'. [CLIENT: 192.168.4.52], but the user is not accessing SQL Server directly. No application is configured with sa credentials.

is there anyway we can trace his pc and find out what is making connections to SQL Server directly?

Please suggest.

Regards
Govind
anthony.green
anthony.green
One Orange Chip
One Orange Chip (25K reputation)One Orange Chip (25K reputation)One Orange Chip (25K reputation)One Orange Chip (25K reputation)One Orange Chip (25K reputation)One Orange Chip (25K reputation)One Orange Chip (25K reputation)One Orange Chip (25K reputation)

Group: General Forum Members
Points: 25724 Visits: 6519
govindarajan69 (6/8/2012)
Hi,

I am also getting this error Error: 18456, Severity: 14, State: 8. + Login failed for user 'sa'. [CLIENT: 192.168.4.52], but the user is not accessing SQL Server directly. No application is configured with sa credentials.

is there anyway we can trace his pc and find out what is making connections to SQL Server directly?

Please suggest.

Regards
Govind


run a profile trace, blank template, then select failed login attempt from the security audit section of the event selections tab, bingo, you get to see whats trying to login



Want an answer fast? Try here
How to post data/code for the best help - Jeff Moden
When a question, really isn't a question - Jeff Smith
Need a string splitter, try this - Jeff Moden
How to post performance problems - Gail Shaw
CrossTabs-Part1 & Part2 - Jeff Moden
SQL Server Backup, Integrity Check, and Index and Statistics Maintenance - Ola Hallengren
Managing Transaction Logs - Gail Shaw
Troubleshooting SQL Server: A Guide for the Accidental DBA - Jonathan Kehayias and Ted Krueger


govindarajan69
govindarajan69
SSC-Enthusiastic
SSC-Enthusiastic (166 reputation)SSC-Enthusiastic (166 reputation)SSC-Enthusiastic (166 reputation)SSC-Enthusiastic (166 reputation)SSC-Enthusiastic (166 reputation)SSC-Enthusiastic (166 reputation)SSC-Enthusiastic (166 reputation)SSC-Enthusiastic (166 reputation)

Group: General Forum Members
Points: 166 Visits: 215
Hi Anthony,

Thanks for your reply.

I found that it was virus. One of the users laptop was constantly probing all sql servers with sa login. I removed it from LAN and got stopped. I also found that the trojan virus infected his laptop. Informed Network and Infra team to take necessary action.

Regards
Govind
Go


Permissions

You can't post new topics.
You can't post topic replies.
You can't post new polls.
You can't post replies to polls.
You can't edit your own topics.
You can't delete your own topics.
You can't edit other topics.
You can't delete other topics.
You can't edit your own posts.
You can't edit other posts.
You can't delete your own posts.
You can't delete other posts.
You can't post events.
You can't edit your own events.
You can't edit other events.
You can't delete your own events.
You can't delete other events.
You can't send private messages.
You can't send emails.
You can read topics.
You can't vote in polls.
You can't upload attachments.
You can download attachments.
You can't post HTML code.
You can't edit HTML code.
You can't post IFCode.
You can't post JavaScript.
You can post emoticons.
You can't post or upload images.

Select a forum

































































































































































SQLServerCentral


Search