Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I received a lot of event logged in the event viewer with this message. I notice it is always the same user id which encounters this error.

The user id is use by an application to access the database. However, this account does not exist on this server.

How do I trace the services/program use by this user id which causes these error messages?

Reason=Unknown user name or bad password&&User Name=<user name>&&Domain=<domain>&&Logon Type=3&&Logon Process=NtLmSsp&&Authentication Package=NTLM&&Workstation Name=<Workstation name>&&Caller User Name=-&&Caller Domain=-&&Caller Logon ID=-&&Caller Process ID=-&&Transited Services=-&&Source Network Address=-&&Source Port=-&&User=SYSTEM&&ComputerName=<Computer Name>
share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.