Post reply

Login failed for user 'NT AUTHORITY\SYSTEM'

  • October 7, 2011 at 3:52 am

    #258645

    I get hundreds of these messages in my SQL Server logs every day.

    The messages have a sev 14 and a state 16 (which I believe means 'login valid, but not permissioned to use target database'.

    I have been searching the web for answers, but have drawn a blank thus far.

    One suggestion was to run a SQL Profiler trace.

    I did this and found that the ApplicationName is 'Microsoft Windows Script Host', but when I checked the Task Manager on the server, the ClientProcessID specified in the Profiler trace does not appear in the list of PIDs.

    I have also checked my Logins, and NT AUTHORITY\SYSTEM is present and enabled, and it has a server rol;e of 'sysadmin', so I cannot see why the login would not be able to access any of the databases.

    Any help in tracking this down would be greatly appreciated.

  • October 7, 2011 at 5:21 am

    #1391636

    State=16 means that the incoming user does not have permissions to log into the target database.

    What is the default database for that user? Does that DB exist and is it accessible?

  • October 7, 2011 at 5:51 am

    #1391646

    According to the Application Event Viewer and SQL Profiler it is trying to access master, and that is the default database for NT AUTHORITY\SYSTEM.

  • October 7, 2011 at 7:38 am

    #1391720

    Sounds like the user account maybe disabled, you can see the SQL aspect on the last tab of the user.

  • October 11, 2011 at 3:43 am

    #1392735

    Thanks for the reply, but I have already checked that.

    The radio buttons are set to :

    Permission to connect to database engine - Grant

    Login - Enabled.

    Does anyone have any suggestions regarding what I can check next?

    According to the error, the host is the same IP address as the server that SQL Server is running on.

    Best Regards

    Barry

  • October 11, 2011 at 6:57 am

    #1392822

    Did you recently changed the password for the login?

    This happens when you have an application running on hte system using the login credentials

    and you change the password for the login.

    Somewhere, in the connection string, hte credentials are hard coded wrongly.

    Can you find that application which is using the login, anywhere on it can you search the login user name, password etc...

    Delete it and re enter your actual password.

    Regards,

    Sushant

    Regards
    Sushant Kumar
    MCTS,MCP

  • October 11, 2011 at 7:13 am

    #1392835

    Hi,

    These messages have been going on for many months, since before I was at the company, and I don't know what application is causing them.

  • October 12, 2011 at 7:36 am

    #1393428

    What do you get in the SID column of master.sys.server_principals for 'NT AUTHORITY\SYSTEM'? I get:

    0x010100000000000512000000

    There is a trick in http://security.fnal.gov/cookbook/LocalSystem.html for becoming the NT AUTHORITY\SYSTEM account. You could try this and use SQLCMD to see if you can log in. HTH

  • September 16, 2014 at 10:48 pm

    #1745950

    You should give permission to the database for which you are trying to connect.

Viewing 9 posts - 1 through 8 (of 8 total)

You must be logged in to reply to this topic. Login to reply