2

We have a server running SQL 2008 R1. We have a web server in the DMZ that connects through the firewall to the SQL server and executes SQL Reporting Services reports using a domain user account.

On the SQL server, the event log has been auditing failed "Account Logon" events (event ID 680, code 0xC0000064) for this domain user. However, for each of these failure events, there is a successful Logon/Logoff event (event ID 540) for the same domain account. It should be noted that the username in the Account Logon events is specified as the UPN [email protected]), but the username in the Logon/Logoff events is specified as DOMAIN\Username. These events must be related to SSRS seeing as that is the only connection that should be using the account in question.

In addition, while monitoring our domain controller, each time one of the Account Logon events shows up, the domain controller CPU usage spikes to 80% or higher. I'm not sure if the two are related.

In my research, everything I have read indicates that Account Logon events are logged by domain controllers when authenticating a user. Therefore, my questions are:

  1. Why is my SQL server logging Account Logon events if they are supposed to be a domain controller event?
  2. Why is the UPN specified in one event, but the DOMAIN\Username format specified in another event?
  3. I'm not noticing any disruption in my application, so the failed logons are not affecting it. Why would this be?

UPDATE:

We have the same web application running on our Intranet as well. I just noticed that this application does not cause these same events to be generated. When that application connects to SSRS, it logs a couple successful Logon/Logoff events, but no Account Logon events at all. Therefore, this seems to be related to the other server being in the DMZ. I also noticed that the events generated by the Intranet connections show Kerberos as the authentication method used. However, the successful Logon/Logoff events generated from the DMZ connections indicate NTLM.

1 Answer 1

1

What is the value of the LmCompatibilityLevel registry value on the domain controller?

Authentication of trusted users fails on a Windows Server 2003-based server if the UPN format is used and if the value of the LmCompatibilityLevel entry is equal to or larger than 3

http://support.microsoft.com/kb/947861

LmCompatibilityLevel
http://technet.microsoft.com/en-us/library/cc960646.aspx

2
  • The LMCompatibilityLevel is set to 2.
    – DCNYAM
    May 16, 2012 at 13:24
  • I would check that registry value on the SQL Server, NOT the domain controller. I'd have to agree with Greg, the KB article sounds exactly what's going on.
    – Lucky Luke
    May 29, 2012 at 13:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .