x

Error 18456 NT AUTHORITY\SYSTEM

Lately one of the sql servers is seeing Error: 18456, Severity: 14, State: 11. Login failed for user 'NT AUTHORITY\SYSTEM'. [CLIENT: xxx.xx.131.221], when i dug into it i saw that this attempt is from cscript.exe on the same database server, i am not sure why this is appearing and why cscript is attemptingto connect to the database? Help needed.. Thanks in advance.

Here is more information, i added nt authority\System to the database instance, it successfully logged in and executed the below statement "SELECT dbo.sysprocesses.spid, dbo.sysprocesses.blocked, dbo.sysprocesses.waittime, dbo.sysprocesses.waitresource, dbo.sysprocesses.program_name, dbo.sysprocesses.loginame, dbo.sysdatabases.name FROM dbo.sysprocesses WITH (nolock) INNER JOIN dbo.sysdatabases ON dbo.sysprocesses.dbid = dbo.sysdatabases.dbid WHERE (dbo.sysprocesses.blocked <> 0) AND (dbo.sysprocesses.waittime > 60 * 1000) ORDER BY dbo.sysprocesses.waittime DESC"

more ▼

asked Jun 03, 2010 at 12:19 PM in Default

Varun gravatar image

Varun
86 4 5 7

(comments are locked)
10|1200 characters needed characters left

4 answers: sort oldest

It sounds like some external monitoring tool is in use to ascertain SQL Server health.

more ▼

answered Jun 03, 2010 at 01:32 PM

Blackhawk-17 gravatar image

Blackhawk-17
11.9k 28 31 36

(comments are locked)
10|1200 characters needed characters left

What is installed on that server? Idera? Quest? SQLSentry? Something is trying to externally query the database...

more ▼

answered Jun 03, 2010 at 01:39 PM

kdevine gravatar image

kdevine
31

(comments are locked)
10|1200 characters needed characters left

State 11 means that the user is valid but server access is denied. A fuller explanation of states for error 18456 can be found here

cscript is Windows Scripting Host - but I wouldn't know why this is attempting to access the db.

more ▼

answered Jun 03, 2010 at 12:45 PM

Kev Riley gravatar image

Kev Riley ♦♦
53k 47 49 76

Thanks for a quick reply, but i dont think i got my answer.
Jun 03, 2010 at 01:00 PM Varun
No - I wasn't trying to give you the answer, but hopefully the extra info about the connection error may have helped you pin down the cause. I'm not sure anyone here can tell you for certain what's running on your server
Jun 03, 2010 at 03:05 PM Kev Riley ♦♦
(comments are locked)
10|1200 characters needed characters left

Its SCOM Tool which was trying to hit the database, thanks for all the valuable answers.

more ▼

answered Jun 03, 2010 at 04:26 PM

Varun gravatar image

Varun
86 4 5 7

(comments are locked)
10|1200 characters needed characters left
Your answer
toggle preview:

Up to 2 attachments (including images) can be used with a maximum of 524.3 kB each and 1.0 MB total.

New code box

There's a new way to format code on the site - the red speech bubble logo will automatically format T-SQL for you. The original code box is still there for XML, etc. More details here.

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

SQL Server Central

Need long-form SQL discussion? SQLserverCentral.com is the place.

Topics:

x162
x84

asked: Jun 03, 2010 at 12:19 PM

Seen: 2700 times

Last Updated: Jun 03, 2010 at 01:01 PM