Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I received a lot of event logged in the event viewer with this message. I notice it is always the same user id which encounters this error.

The user id is use by an application to access the database. However, this account does not exist on this server.

How do I trace the services/program use by this user id which causes these error messages?

Reason=Unknown user name or bad password&&User Name=<user name>&&Domain=<domain>&&Logon Type=3&&Logon Process=NtLmSsp&&Authentication Package=NTLM&&Workstation Name=<Workstation name>&&Caller User Name=-&&Caller Domain=-&&Caller Logon ID=-&&Caller Process ID=-&&Transited Services=-&&Source Network Address=-&&Source Port=-&&User=SYSTEM&&ComputerName=<Computer Name>
share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.