Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have 2 application hosted on server A which connects to the database server B. For every few seconds, there is this error log in the event viewer of the database sever.

Both window services started successfully on server A which explains no reason for the invalid user name or password.

Anyone have encounter such issues before?

Reason=Unknown user name or bad password&&User Name=<account name>&&Domain=<machine name>&&Logon Type=3&&Logon Process=NtLmSsp&&Authentication Package=NTLM&&Workstation Name=<machine name>&&Caller User Name=-&&Caller Domain=-&&Caller Logon ID=-&&Caller Process ID=-&&Transited Services=-&&Source Network Address=-&&Source Port=-&&User=SYSTEM&&ComputerName=<machine name>
share|improve this question
Am I right in assuming this is MS SQL Server? – EEAA Jun 28 '10 at 2:37
I am using Oracle as the database server. – youcanlearnanything Jun 28 '10 at 2:48
Server A and Database Server B are both running on Window 2003 Server – youcanlearnanything Jun 28 '10 at 2:49
Both window services in server A runs under a custom created user "user01" this user name appears in database server B event viewer. – youcanlearnanything Jun 28 '10 at 3:36
could it be because the account used in Server A which does not exist in Database Server B which causes this issue? – youcanlearnanything Jun 30 '10 at 5:03
up vote 0 down vote accepted

According to your sqlnet configuration, Oracle may try to authenticate users using Windows NT native authentication.

Check the content of files sqlnet.ora (look for "AUTHENTICATION_SERVICES") and read the related Oracle documentation

share|improve this answer
what is the purpose of AUTHENTICATION_SERVICES. I should be updating this value at the client or server side? – youcanlearnanything May 10 '11 at 2:40
Which part of the documentation don't you understand? – Benoit May 10 '11 at 9:07

do you have any network monitors running that could be issuing port checks for specific services? sometimes when that network socket is opened, you can trigger an authentication error log event, even though there wasn't actually a bad login.

share|improve this answer
no network monitoring – youcanlearnanything May 10 '11 at 2:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.