Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a server running SQL 2008 R1. We have a web server in the DMZ that connects through the firewall to the SQL server and executes SQL Reporting Services reports using a domain user account.

On the SQL server, the event log has been auditing failed "Account Logon" events (event ID 680, code 0xC0000064) for this domain user. However, for each of these failure events, there is a successful Logon/Logoff event (event ID 540) for the same domain account. It should be noted that the username in the Account Logon events is specified as the UPN username@domain.com), but the username in the Logon/Logoff events is specified as DOMAIN\Username. These events must be related to SSRS seeing as that is the only connection that should be using the account in question.

In addition, while monitoring our domain controller, each time one of the Account Logon events shows up, the domain controller CPU usage spikes to 80% or higher. I'm not sure if the two are related.

In my research, everything I have read indicates that Account Logon events are logged by domain controllers when authenticating a user. Therefore, my questions are:

  1. Why is my SQL server logging Account Logon events if they are supposed to be a domain controller event?
  2. Why is the UPN specified in one event, but the DOMAIN\Username format specified in another event?
  3. I'm not noticing any disruption in my application, so the failed logons are not affecting it. Why would this be?

UPDATE:

We have the same web application running on our Intranet as well. I just noticed that this application does not cause these same events to be generated. When that application connects to SSRS, it logs a couple successful Logon/Logoff events, but no Account Logon events at all. Therefore, this seems to be related to the other server being in the DMZ. I also noticed that the events generated by the Intranet connections show Kerberos as the authentication method used. However, the successful Logon/Logoff events generated from the DMZ connections indicate NTLM.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

What is the value of the LmCompatibilityLevel registry value on the domain controller?

Authentication of trusted users fails on a Windows Server 2003-based server if the UPN format is used and if the value of the LmCompatibilityLevel entry is equal to or larger than 3

http://support.microsoft.com/kb/947861

LmCompatibilityLevel
http://technet.microsoft.com/en-us/library/cc960646.aspx

share|improve this answer
    
The LMCompatibilityLevel is set to 2. –  NYSystemsAnalyst May 16 '12 at 13:24
    
I would check that registry value on the SQL Server, NOT the domain controller. I'd have to agree with Greg, the KB article sounds exactly what's going on. –  Lucky Luke May 29 '12 at 13:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.