I received a lot of event logged in the event viewer with this message. I notice it is always the same user id which encounters this error.
The user id is use by an application to access the database. However, this account does not exist on this server.
How do I trace the services/program use by this user id which causes these error messages?
Reason=Unknown user name or bad password&&User Name=<user name>&&Domain=<domain>&&Logon Type=3&&Logon Process=NtLmSsp&&Authentication Package=NTLM&&Workstation Name=<Workstation name>&&Caller User Name=-&&Caller Domain=-&&Caller Logon ID=-&&Caller Process ID=-&&Transited Services=-&&Source Network Address=-&&Source Port=-&&User=SYSTEM&&ComputerName=<Computer Name>