I've been noticing recurring failed logon attempts onto our SQL server. It happens every minute with the same login. An example from the log file viewer
10/18/2011 13:54:50,Logon,Unknown,Login failed for user 'LOLZOR\lolsqlserver'. [CLIENT: ] 10/18/2011 13:54:50,Logon,Unknown,Error: 18456 Severity: 14 State: 16
State 16 means: Login valid, but not permissioned to use the target database
Note that the credentials are also used to start all the SQL Server services
Audit Login Failed
NTDomainName>LOLZOR
Error 18456
HostName EU_LOLWEB1
SPID">71</Column>
SessionLoginName"LOLZOR\lolsqlserver
TextData">Login failed for user 'LOLZOR\lolsqlserver'
ClientProcessID"2364
NTUserName"lolsqlserver
ApplicationName">Queue Reader Main (distribution)
StartTime">2011-10-18T12:18:21.72+02:00
ServerName">EU_LOLWEB1
DatabaseID">1</Column>
LoginName">LOLZOR\lolsqlserver
DatabaseName">master
EventSequence">528
- You will notice that the logons originate from the sql server itself
- Target DB seems to point to 'Master' (see below)
- If I trace the pid in process Monitor I can see that the login is performed by qrdsvc.exe
Description
Description: SQL Server Replication QueueReader Agent
Company: Microsoft Corporation
Name: qrdrsvc.exe
Version: 2005.90.4035.0
Path: C:\Program Files\Microsoft SQL Server\90\COM\qrdrsvc.exe
Command Line: "C:\Program Files\Microsoft SQL Server\90\COM\qrdrsvc.exe" -Distributor [EU_LOLWEB1] -DistributionDB [distribution] -DistributorSecurityMode 1 -Continuous -XJOBID 0xA368ED128C0EAA43A137B55FD4DD122F -XJOBNAME [[EU_LOLWEB1]].8] -XSTEPID 2 -XSUBSYSTEM Que
PID: 6096
Parent PID: 300
Session ID: 0
User: LOLZOR\lolsqlserver
Auth ID: 00000000:a3d8bc8d
Architecture: 32-bit
Virtualized: n/a
Integrity: n/a
Started: 18/10/2011 11:43:25
Ended: 18/10/2011 11:43:25
So from what I understand from http://www.eraofdata.com/blog/sql-18456-login-failures/ is that the user account does not have enough permissions on the Master database.
As a test I added the LOLZOR\lolsqlserver to the sysadmin role and restarted the SQL service. This did not change anything. the message still pops up every minute.
How is this possible since the account is running the service. I'd like to resolve this so issue and some help would be appreciated .
