question

Varun avatar image
Varun asked

Error 18456 NT AUTHORITY\SYSTEM

Lately one of the sql servers is seeing Error: 18456, Severity: 14, State: 11. Login failed for user 'NT AUTHORITY\SYSTEM'. [CLIENT: xxx.xx.131.221], when i dug into it i saw that this attempt is from cscript.exe on the same database server, i am not sure why this is appearing and why cscript is attemptingto connect to the database? Help needed.. Thanks in advance.

Here is more information, i added nt authority\System to the database instance, it successfully logged in and executed the below statement "SELECT dbo.sysprocesses.spid, dbo.sysprocesses.blocked, dbo.sysprocesses.waittime, dbo.sysprocesses.waitresource, dbo.sysprocesses.program_name, dbo.sysprocesses.loginame, dbo.sysdatabases.name FROM dbo.sysprocesses WITH (nolock) INNER JOIN dbo.sysdatabases ON dbo.sysprocesses.dbid = dbo.sysdatabases.dbid WHERE (dbo.sysprocesses.blocked <> 0) AND (dbo.sysprocesses.waittime > 60 * 1000) ORDER BY dbo.sysprocesses.waittime DESC"

securitylogin
10 |1200

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Blackhawk-17 avatar image
Blackhawk-17 answered

It sounds like some external monitoring tool is in use to ascertain SQL Server health.

10 |1200

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

kdevine avatar image
kdevine answered

What is installed on that server? Idera? Quest? SQLSentry? Something is trying to externally query the database...

10 |1200

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Kev Riley avatar image
Kev Riley answered

State 11 means that the user is valid but server access is denied. A fuller explanation of states for error 18456 can be found here

cscript is Windows Scripting Host - but I wouldn't know why this is attempting to access the db.

2 comments
10 |1200

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Thanks for a quick reply, but i dont think i got my answer.
0 Likes 0 ·
No - I wasn't trying to give you the answer, but hopefully the extra info about the connection error may have helped you pin down the cause. I'm not sure anyone here can tell you for certain what's running on your server
0 Likes 0 ·
Varun avatar image
Varun answered

Its SCOM Tool which was trying to hit the database, thanks for all the valuable answers.

10 |1200

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Write an Answer

Hint: Notify or tag a user in this post by typing @username.

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.